?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r10391: * setting version to 3.0.20a
[Samba.git] / source / rpc_server / srv_lsa_nt.c
blob021f1dc8e0f286e250c15c6e84ca0a3496c43389
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Jeremy Allison 2001,
8 * Copyright (C) Rafal Szczesniak 2002,
9 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
10 * Copyright (C) Simo Sorce 2003.
11 * Copyright (C) Gerald (Jerry) Carter 2005.
12 *
13 * This program is free software; you can redistribute it and/or modify
14 * it under the terms of the GNU General Public License as published by
15 * the Free Software Foundation; either version 2 of the License, or
16 * (at your option) any later version.
17 *
18 * This program is distributed in the hope that it will be useful,
19 * but WITHOUT ANY WARRANTY; without even the implied warranty of
20 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21 * GNU General Public License for more details.
22 *
23 * You should have received a copy of the GNU General Public License
24 * along with this program; if not, write to the Free Software
25 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 */
27
28 /* This is the implementation of the lsa server code. */
29
30 #include "includes.h"
31
32 #undef DBGC_CLASS
33 #define DBGC_CLASS DBGC_RPC_SRV
34
35 extern PRIVS privs[];
36
37 struct lsa_info {
38 DOM_SID sid;
39 uint32 access;
40 };
41
42 struct generic_mapping lsa_generic_mapping = {
43 POLICY_READ,
44 POLICY_WRITE,
45 POLICY_EXECUTE,
46 POLICY_ALL_ACCESS
47 };
48
49 /*******************************************************************
50 Function to free the per handle data.
51 ********************************************************************/
52
53 static void free_lsa_info(void *ptr)
54 {
55 struct lsa_info *lsa = (struct lsa_info *)ptr;
56
57 SAFE_FREE(lsa);
58 }
59
60 /***************************************************************************
61 Init dom_query
62 ***************************************************************************/
63
64 static void init_dom_query(DOM_QUERY *d_q, const char *dom_name, DOM_SID *dom_sid)
65 {
66 d_q->buffer_dom_name = (dom_name != NULL) ? 1 : 0; /* domain buffer pointer */
67 d_q->buffer_dom_sid = (dom_sid != NULL) ? 1 : 0; /* domain sid pointer */
68
69 /* this string is supposed to be non-null terminated. */
70 /* But the maxlen in this UNISTR2 must include the terminating null. */
71 init_unistr2(&d_q->uni_domain_name, dom_name, UNI_BROKEN_NON_NULL);
72
73 /*
74 * I'm not sure why this really odd combination of length
75 * values works, but it does appear to. I need to look at
76 * this *much* more closely - but at the moment leave alone
77 * until it's understood. This allows a W2k client to join
78 * a domain with both odd and even length names... JRA.
79 */
80
81 /*
82 * IMPORTANT NOTE !!!!
83 * The two fields below probably are reversed in meaning, ie.
84 * the first field is probably the str_len, the second the max
85 * len. Both are measured in bytes anyway.
86 */
87
88 d_q->uni_dom_str_len = d_q->uni_domain_name.uni_max_len * 2;
89 d_q->uni_dom_max_len = d_q->uni_domain_name.uni_str_len * 2;
90
91 if (dom_sid != NULL)
92 init_dom_sid2(&d_q->dom_sid, dom_sid);
93 }
94
95 /***************************************************************************
96 init_dom_ref - adds a domain if it's not already in, returns the index.
97 ***************************************************************************/
98
99 static int init_dom_ref(DOM_R_REF *ref, char *dom_name, DOM_SID *dom_sid)
100 {
101 int num = 0;
102
103 if (dom_name != NULL) {
104 for (num = 0; num < ref->num_ref_doms_1; num++) {
105 fstring domname;
106 rpcstr_pull(domname, ref->ref_dom[num].uni_dom_name.buffer, sizeof(domname), -1, 0);
107 if (strequal(domname, dom_name))
108 return num;
109 }
110 } else {
111 num = ref->num_ref_doms_1;
112 }
113
114 if (num >= MAX_REF_DOMAINS) {
115 /* index not found, already at maximum domain limit */
116 return -1;
117 }
118
119 ref->num_ref_doms_1 = num+1;
120 ref->ptr_ref_dom = 1;
121 ref->max_entries = MAX_REF_DOMAINS;
122 ref->num_ref_doms_2 = num+1;
123
124 ref->hdr_ref_dom[num].ptr_dom_sid = dom_sid != NULL ? 1 : 0;
125
126 init_unistr2(&ref->ref_dom[num].uni_dom_name, dom_name, UNI_FLAGS_NONE);
127 init_uni_hdr(&ref->hdr_ref_dom[num].hdr_dom_name, &ref->ref_dom[num].uni_dom_name);
128
129 init_dom_sid2(&ref->ref_dom[num].ref_dom, dom_sid );
130
131 return num;
132 }
133
134 /***************************************************************************
135 init_lsa_rid2s
136 ***************************************************************************/
137
138 static void init_lsa_rid2s(DOM_R_REF *ref, DOM_RID2 *rid2,
139 int num_entries, UNISTR2 *name,
140 uint32 *mapped_count, BOOL endian)
141 {
142 int i;
143 int total = 0;
144 *mapped_count = 0;
145
146 SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
147
148 become_root(); /* lookup_name can require root privs */
149
150 for (i = 0; i < num_entries; i++) {
151 BOOL status = False;
152 DOM_SID sid;
153 uint32 rid = 0xffffffff;
154 int dom_idx = -1;
155 pstring full_name;
156 fstring dom_name, user;
157 enum SID_NAME_USE name_type = SID_NAME_UNKNOWN;
158
159 /* Split name into domain and user component */
160
161 unistr2_to_ascii(full_name, &name[i], sizeof(full_name));
162 split_domain_name(full_name, dom_name, user);
163
164 /* Lookup name */
165
166 DEBUG(5, ("init_lsa_rid2s: looking up name %s\n", full_name));
167
168 status = lookup_name(dom_name, user, &sid, &name_type);
169
170 if((name_type == SID_NAME_UNKNOWN) && (lp_server_role() == ROLE_DOMAIN_MEMBER) && (strncmp(dom_name, full_name, strlen(dom_name)) != 0)) {
171 DEBUG(5, ("init_lsa_rid2s: domain name not provided and local account not found, using member domain\n"));
172 fstrcpy(dom_name, lp_workgroup());
173 status = lookup_name(dom_name, user, &sid, &name_type);
174 }
175
176 if (name_type == SID_NAME_WKN_GRP) {
177 /* BUILTIN aliases are still aliases :-) */
178 name_type = SID_NAME_ALIAS;
179 }
180
181 DEBUG(5, ("init_lsa_rid2s: %s\n", status ? "found" :
182 "not found"));
183
184 if (status && name_type != SID_NAME_UNKNOWN) {
185 sid_split_rid(&sid, &rid);
186 dom_idx = init_dom_ref(ref, dom_name, &sid);
187 (*mapped_count)++;
188 } else {
189 dom_idx = -1;
190 rid = 0;
191 name_type = SID_NAME_UNKNOWN;
192 }
193
194 init_dom_rid2(&rid2[total], rid, name_type, dom_idx);
195 total++;
196 }
197
198 unbecome_root();
199 }
200
201 /***************************************************************************
202 init_reply_lookup_names
203 ***************************************************************************/
204
205 static void init_reply_lookup_names(LSA_R_LOOKUP_NAMES *r_l,
206 DOM_R_REF *ref, uint32 num_entries,
207 DOM_RID2 *rid2, uint32 mapped_count)
208 {
209 r_l->ptr_dom_ref = 1;
210 r_l->dom_ref = ref;
211
212 r_l->num_entries = num_entries;
213 r_l->ptr_entries = 1;
214 r_l->num_entries2 = num_entries;
215 r_l->dom_rid = rid2;
216
217 r_l->mapped_count = mapped_count;
218 }
219
220 /***************************************************************************
221 Init lsa_trans_names.
222 ***************************************************************************/
223
224 static void init_lsa_trans_names(TALLOC_CTX *ctx, DOM_R_REF *ref, LSA_TRANS_NAME_ENUM *trn,
225 int num_entries, DOM_SID2 *sid,
226 uint32 *mapped_count)
227 {
228 int i;
229 int total = 0;
230 *mapped_count = 0;
231
232 /* Allocate memory for list of names */
233
234 if (num_entries > 0) {
235 if (!(trn->name = TALLOC_ARRAY(ctx, LSA_TRANS_NAME, num_entries))) {
236 DEBUG(0, ("init_lsa_trans_names(): out of memory\n"));
237 return;
238 }
239
240 if (!(trn->uni_name = TALLOC_ARRAY(ctx, UNISTR2, num_entries))) {
241 DEBUG(0, ("init_lsa_trans_names(): out of memory\n"));
242 return;
243 }
244 }
245
246 become_root(); /* Need root to get to passdb to for local sids */
247
248 for (i = 0; i < num_entries; i++) {
249 BOOL status = False;
250 DOM_SID find_sid = sid[i].sid;
251 uint32 rid = 0xffffffff;
252 int dom_idx = -1;
253 fstring name, dom_name;
254 enum SID_NAME_USE sid_name_use = (enum SID_NAME_USE)0;
255
256 sid_to_string(name, &find_sid);
257 DEBUG(5, ("init_lsa_trans_names: looking up sid %s\n", name));
258
259 /* Lookup sid from winbindd */
260
261 status = lookup_sid(&find_sid, dom_name, name, &sid_name_use);
262
263 DEBUG(5, ("init_lsa_trans_names: %s\n", status ? "found" :
264 "not found"));
265
266 if (!status) {
267 sid_name_use = SID_NAME_UNKNOWN;
268 memset(dom_name, '\0', sizeof(dom_name));
269 sid_to_string(name, &find_sid);
270 dom_idx = -1;
271
272 DEBUG(10,("init_lsa_trans_names: added unknown user '%s' to "
273 "referenced list.\n", name ));
274 } else {
275 (*mapped_count)++;
276 /* Store domain sid in ref array */
277 if (find_sid.num_auths == 5) {
278 sid_split_rid(&find_sid, &rid);
279 }
280 dom_idx = init_dom_ref(ref, dom_name, &find_sid);
281
282 DEBUG(10,("init_lsa_trans_names: added %s '%s\\%s' (%d) to referenced list.\n",
283 sid_type_lookup(sid_name_use), dom_name, name, sid_name_use ));
284
285 }
286
287 init_lsa_trans_name(&trn->name[total], &trn->uni_name[total],
288 sid_name_use, name, dom_idx);
289 total++;
290 }
291
292 unbecome_root();
293
294 trn->num_entries = total;
295 trn->ptr_trans_names = 1;
296 trn->num_entries2 = total;
297 }
298
299 /***************************************************************************
300 Init_reply_lookup_sids.
301 ***************************************************************************/
302
303 static void init_reply_lookup_sids(LSA_R_LOOKUP_SIDS *r_l,
304 DOM_R_REF *ref, LSA_TRANS_NAME_ENUM *names,
305 uint32 mapped_count)
306 {
307 r_l->ptr_dom_ref = 1;
308 r_l->dom_ref = ref;
309 r_l->names = names;
310 r_l->mapped_count = mapped_count;
311 }
312
313 static NTSTATUS lsa_get_generic_sd(TALLOC_CTX *mem_ctx, SEC_DESC **sd, size_t *sd_size)
314 {
315 DOM_SID local_adm_sid;
316 DOM_SID adm_sid;
317
318 SEC_ACE ace[3];
319 SEC_ACCESS mask;
320
321 SEC_ACL *psa = NULL;
322
323 init_sec_access(&mask, POLICY_EXECUTE);
324 init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
325
326 sid_copy(&adm_sid, get_global_sam_sid());
327 sid_append_rid(&adm_sid, DOMAIN_GROUP_RID_ADMINS);
328 init_sec_access(&mask, POLICY_ALL_ACCESS);
329 init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
330
331 sid_copy(&local_adm_sid, &global_sid_Builtin);
332 sid_append_rid(&local_adm_sid, BUILTIN_ALIAS_RID_ADMINS);
333 init_sec_access(&mask, POLICY_ALL_ACCESS);
334 init_sec_ace(&ace[2], &local_adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
335
336 if((psa = make_sec_acl(mem_ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
337 return NT_STATUS_NO_MEMORY;
338
339 if((*sd = make_sec_desc(mem_ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, &adm_sid, NULL, NULL, psa, sd_size)) == NULL)
340 return NT_STATUS_NO_MEMORY;
341
342 return NT_STATUS_OK;
343 }
344
345 #if 0 /* AD DC work in ongoing in Samba 4 */
346
347 /***************************************************************************
348 Init_dns_dom_info.
349 ***************************************************************************/
350
351 static void init_dns_dom_info(LSA_DNS_DOM_INFO *r_l, const char *nb_name,
352 const char *dns_name, const char *forest_name,
353 struct uuid *dom_guid, DOM_SID *dom_sid)
354 {
355 if (nb_name && *nb_name) {
356 init_unistr2(&r_l->uni_nb_dom_name, nb_name, UNI_FLAGS_NONE);
357 init_uni_hdr(&r_l->hdr_nb_dom_name, &r_l->uni_nb_dom_name);
358 r_l->hdr_nb_dom_name.uni_max_len += 2;
359 r_l->uni_nb_dom_name.uni_max_len += 1;
360 }
361
362 if (dns_name && *dns_name) {
363 init_unistr2(&r_l->uni_dns_dom_name, dns_name, UNI_FLAGS_NONE);
364 init_uni_hdr(&r_l->hdr_dns_dom_name, &r_l->uni_dns_dom_name);
365 r_l->hdr_dns_dom_name.uni_max_len += 2;
366 r_l->uni_dns_dom_name.uni_max_len += 1;
367 }
368
369 if (forest_name && *forest_name) {
370 init_unistr2(&r_l->uni_forest_name, forest_name, UNI_FLAGS_NONE);
371 init_uni_hdr(&r_l->hdr_forest_name, &r_l->uni_forest_name);
372 r_l->hdr_forest_name.uni_max_len += 2;
373 r_l->uni_forest_name.uni_max_len += 1;
374 }
375
376 /* how do we init the guid ? probably should write an init fn */
377 if (dom_guid) {
378 memcpy(&r_l->dom_guid, dom_guid, sizeof(struct uuid));
379 }
380
381 if (dom_sid) {
382 r_l->ptr_dom_sid = 1;
383 init_dom_sid2(&r_l->dom_sid, dom_sid);
384 }
385 }
386 #endif /* AD DC work in ongoing in Samba 4 */
387
388
389 /***************************************************************************
390 _lsa_open_policy2.
391 ***************************************************************************/
392
393 NTSTATUS _lsa_open_policy2(pipes_struct *p, LSA_Q_OPEN_POL2 *q_u, LSA_R_OPEN_POL2 *r_u)
394 {
395 struct lsa_info *info;
396 SEC_DESC *psd = NULL;
397 size_t sd_size;
398 uint32 des_access=q_u->des_access;
399 uint32 acc_granted;
400 NTSTATUS status;
401
402
403 /* map the generic bits to the lsa policy ones */
404 se_map_generic(&des_access, &lsa_generic_mapping);
405
406 /* get the generic lsa policy SD until we store it */
407 lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
408
409 if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status)) {
410 if (geteuid() != 0) {
411 return status;
412 }
413 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
414 acc_granted, des_access));
415 DEBUGADD(4,("but overwritten by euid == 0\n"));
416 }
417
418 /* This is needed for lsa_open_account and rpcclient .... :-) */
419
420 if (geteuid() == 0)
421 acc_granted = POLICY_ALL_ACCESS;
422
423 /* associate the domain SID with the (unique) handle. */
424 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
425 return NT_STATUS_NO_MEMORY;
426
427 ZERO_STRUCTP(info);
428 sid_copy(&info->sid,get_global_sam_sid());
429 info->access = acc_granted;
430
431 /* set up the LSA QUERY INFO response */
432 if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
433 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
434
435 return NT_STATUS_OK;
436 }
437
438 /***************************************************************************
439 _lsa_open_policy
440 ***************************************************************************/
441
442 NTSTATUS _lsa_open_policy(pipes_struct *p, LSA_Q_OPEN_POL *q_u, LSA_R_OPEN_POL *r_u)
443 {
444 struct lsa_info *info;
445 SEC_DESC *psd = NULL;
446 size_t sd_size;
447 uint32 des_access=q_u->des_access;
448 uint32 acc_granted;
449 NTSTATUS status;
450
451
452 /* map the generic bits to the lsa policy ones */
453 se_map_generic(&des_access, &lsa_generic_mapping);
454
455 /* get the generic lsa policy SD until we store it */
456 lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
457
458 if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status)) {
459 if (geteuid() != 0) {
460 return status;
461 }
462 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
463 acc_granted, des_access));
464 DEBUGADD(4,("but overwritten by euid == 0\n"));
465 acc_granted = des_access;
466 }
467
468 /* associate the domain SID with the (unique) handle. */
469 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
470 return NT_STATUS_NO_MEMORY;
471
472 ZERO_STRUCTP(info);
473 sid_copy(&info->sid,get_global_sam_sid());
474 info->access = acc_granted;
475
476 /* set up the LSA QUERY INFO response */
477 if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
478 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
479
480 return NT_STATUS_OK;
481 }
482
483 /***************************************************************************
484 _lsa_enum_trust_dom - this needs fixing to do more than return NULL ! JRA.
485 ufff, done :) mimir
486 ***************************************************************************/
487
488 NTSTATUS _lsa_enum_trust_dom(pipes_struct *p, LSA_Q_ENUM_TRUST_DOM *q_u, LSA_R_ENUM_TRUST_DOM *r_u)
489 {
490 struct lsa_info *info;
491 uint32 enum_context = q_u->enum_context;
492
493 /*
494 * preferred length is set to 5 as a "our" preferred length
495 * nt sets this parameter to 2
496 * update (20.08.2002): it's not preferred length, but preferred size!
497 * it needs further investigation how to optimally choose this value
498 */
499 uint32 max_num_domains = q_u->preferred_len < 5 ? q_u->preferred_len : 10;
500 TRUSTDOM **trust_doms;
501 uint32 num_domains;
502 NTSTATUS nt_status;
503
504 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
505 return NT_STATUS_INVALID_HANDLE;
506
507 /* check if the user have enough rights */
508 if (!(info->access & POLICY_VIEW_LOCAL_INFORMATION))
509 return NT_STATUS_ACCESS_DENIED;
510
511 nt_status = secrets_get_trusted_domains(p->mem_ctx, (int *)&enum_context, max_num_domains, (int *)&num_domains, &trust_doms);
512
513 if (!NT_STATUS_IS_OK(nt_status) &&
514 !NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES) &&
515 !NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MORE_ENTRIES)) {
516 return nt_status;
517 } else {
518 r_u->status = nt_status;
519 }
520
521 /* set up the lsa_enum_trust_dom response */
522
523 init_r_enum_trust_dom(p->mem_ctx, r_u, enum_context, max_num_domains, num_domains, trust_doms);
524
525 return r_u->status;
526 }
527
528 /***************************************************************************
529 _lsa_query_info. See the POLICY_INFOMATION_CLASS docs at msdn.
530 ***************************************************************************/
531
532 NTSTATUS _lsa_query_info(pipes_struct *p, LSA_Q_QUERY_INFO *q_u, LSA_R_QUERY_INFO *r_u)
533 {
534 struct lsa_info *handle;
535 LSA_INFO_UNION *info = &r_u->dom;
536 DOM_SID domain_sid;
537 const char *name;
538 DOM_SID *sid = NULL;
539
540 r_u->status = NT_STATUS_OK;
541
542 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
543 return NT_STATUS_INVALID_HANDLE;
544
545 switch (q_u->info_class) {
546 case 0x02:
547 {
548 unsigned int i;
549 /* check if the user have enough rights */
550 if (!(handle->access & POLICY_VIEW_AUDIT_INFORMATION))
551 return NT_STATUS_ACCESS_DENIED;
552
553 /* fake info: We audit everything. ;) */
554 info->id2.auditing_enabled = 1;
555 info->id2.count1 = 7;
556 info->id2.count2 = 7;
557 if ((info->id2.auditsettings = TALLOC_ARRAY(p->mem_ctx,uint32, 7)) == NULL)
558 return NT_STATUS_NO_MEMORY;
559 for (i = 0; i < 7; i++)
560 info->id2.auditsettings[i] = 3;
561 break;
562 }
563 case 0x03:
564 /* check if the user have enough rights */
565 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
566 return NT_STATUS_ACCESS_DENIED;
567
568 /* Request PolicyPrimaryDomainInformation. */
569 switch (lp_server_role()) {
570 case ROLE_DOMAIN_PDC:
571 case ROLE_DOMAIN_BDC:
572 name = get_global_sam_name();
573 sid = get_global_sam_sid();
574 break;
575 case ROLE_DOMAIN_MEMBER:
576 name = lp_workgroup();
577 /* We need to return the Domain SID here. */
578 if (secrets_fetch_domain_sid(lp_workgroup(), &domain_sid))
579 sid = &domain_sid;
580 else
581 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
582 break;
583 case ROLE_STANDALONE:
584 name = lp_workgroup();
585 sid = NULL;
586 break;
587 default:
588 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
589 }
590 init_dom_query(&r_u->dom.id3, name, sid);
591 break;
592 case 0x05:
593 /* check if the user have enough rights */
594 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
595 return NT_STATUS_ACCESS_DENIED;
596
597 /* Request PolicyAccountDomainInformation. */
598 name = get_global_sam_name();
599 sid = get_global_sam_sid();
600 init_dom_query(&r_u->dom.id5, name, sid);
601 break;
602 case 0x06:
603 /* check if the user have enough rights */
604 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
605 return NT_STATUS_ACCESS_DENIED;
606
607 switch (lp_server_role()) {
608 case ROLE_DOMAIN_BDC:
609 /*
610 * only a BDC is a backup controller
611 * of the domain, it controls.
612 */
613 info->id6.server_role = 2;
614 break;
615 default:
616 /*
617 * any other role is a primary
618 * of the domain, it controls.
619 */
620 info->id6.server_role = 3;
621 break;
622 }
623 break;
624 default:
625 DEBUG(0,("_lsa_query_info: unknown info level in Lsa Query: %d\n", q_u->info_class));
626 r_u->status = NT_STATUS_INVALID_INFO_CLASS;
627 break;
628 }
629
630 if (NT_STATUS_IS_OK(r_u->status)) {
631 r_u->undoc_buffer = 0x22000000; /* bizarre */
632 r_u->info_class = q_u->info_class;
633 }
634
635 return r_u->status;
636 }
637
638 /***************************************************************************
639 _lsa_lookup_sids
640 ***************************************************************************/
641
642 NTSTATUS _lsa_lookup_sids(pipes_struct *p, LSA_Q_LOOKUP_SIDS *q_u, LSA_R_LOOKUP_SIDS *r_u)
643 {
644 struct lsa_info *handle;
645 DOM_SID2 *sid = q_u->sids.sid;
646 int num_entries = q_u->sids.num_entries;
647 DOM_R_REF *ref = NULL;
648 LSA_TRANS_NAME_ENUM *names = NULL;
649 uint32 mapped_count = 0;
650
651 if (num_entries > MAX_LOOKUP_SIDS) {
652 num_entries = 0;
653 DEBUG(5,("_lsa_lookup_sids: limit of %d exceeded, truncating SID lookup list to %d\n", MAX_LOOKUP_SIDS, num_entries));
654 r_u->status = NT_STATUS_NONE_MAPPED;
655 }
656
657 ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
658 names = TALLOC_ZERO_P(p->mem_ctx, LSA_TRANS_NAME_ENUM);
659
660 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle)) {
661 r_u->status = NT_STATUS_INVALID_HANDLE;
662 goto done;
663 }
664
665 /* check if the user have enough rights */
666 if (!(handle->access & POLICY_LOOKUP_NAMES)) {
667 r_u->status = NT_STATUS_ACCESS_DENIED;
668 goto done;
669 }
670 if (!ref || !names)
671 return NT_STATUS_NO_MEMORY;
672
673 done:
674
675 /* set up the LSA Lookup SIDs response */
676 init_lsa_trans_names(p->mem_ctx, ref, names, num_entries, sid, &mapped_count);
677 if (NT_STATUS_IS_OK(r_u->status)) {
678 if (mapped_count == 0)
679 r_u->status = NT_STATUS_NONE_MAPPED;
680 else if (mapped_count != num_entries)
681 r_u->status = STATUS_SOME_UNMAPPED;
682 }
683 init_reply_lookup_sids(r_u, ref, names, mapped_count);
684
685 return r_u->status;
686 }
687
688 /***************************************************************************
689 lsa_reply_lookup_names
690 ***************************************************************************/
691
692 NTSTATUS _lsa_lookup_names(pipes_struct *p,LSA_Q_LOOKUP_NAMES *q_u, LSA_R_LOOKUP_NAMES *r_u)
693 {
694 struct lsa_info *handle;
695 UNISTR2 *names = q_u->uni_name;
696 int num_entries = q_u->num_entries;
697 DOM_R_REF *ref;
698 DOM_RID2 *rids;
699 uint32 mapped_count = 0;
700
701 if (num_entries > MAX_LOOKUP_SIDS) {
702 num_entries = MAX_LOOKUP_SIDS;
703 DEBUG(5,("_lsa_lookup_names: truncating name lookup list to %d\n", num_entries));
704 }
705
706 ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
707 rids = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_RID2, num_entries);
708
709 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle)) {
710 r_u->status = NT_STATUS_INVALID_HANDLE;
711 goto done;
712 }
713
714 /* check if the user have enough rights */
715 if (!(handle->access & POLICY_LOOKUP_NAMES)) {
716 r_u->status = NT_STATUS_ACCESS_DENIED;
717 goto done;
718 }
719
720 if (!ref || !rids)
721 return NT_STATUS_NO_MEMORY;
722
723 done:
724
725 /* set up the LSA Lookup RIDs response */
726 init_lsa_rid2s(ref, rids, num_entries, names, &mapped_count, p->endian);
727 if (NT_STATUS_IS_OK(r_u->status)) {
728 if (mapped_count == 0)
729 r_u->status = NT_STATUS_NONE_MAPPED;
730 else if (mapped_count != num_entries)
731 r_u->status = STATUS_SOME_UNMAPPED;
732 }
733 init_reply_lookup_names(r_u, ref, num_entries, rids, mapped_count);
734
735 return r_u->status;
736 }
737
738 /***************************************************************************
739 _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
740 ***************************************************************************/
741
742 NTSTATUS _lsa_close(pipes_struct *p, LSA_Q_CLOSE *q_u, LSA_R_CLOSE *r_u)
743 {
744 if (!find_policy_by_hnd(p, &q_u->pol, NULL))
745 return NT_STATUS_INVALID_HANDLE;
746
747 close_policy_hnd(p, &q_u->pol);
748 return NT_STATUS_OK;
749 }
750
751 /***************************************************************************
752 ***************************************************************************/
753
754 NTSTATUS _lsa_open_secret(pipes_struct *p, LSA_Q_OPEN_SECRET *q_u, LSA_R_OPEN_SECRET *r_u)
755 {
756 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
757 }
758
759 /***************************************************************************
760 ***************************************************************************/
761
762 NTSTATUS _lsa_open_trusted_domain(pipes_struct *p, LSA_Q_OPEN_TRUSTED_DOMAIN *q_u, LSA_R_OPEN_TRUSTED_DOMAIN *r_u)
763 {
764 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
765 }
766
767 /***************************************************************************
768 ***************************************************************************/
769
770 NTSTATUS _lsa_create_trusted_domain(pipes_struct *p, LSA_Q_CREATE_TRUSTED_DOMAIN *q_u, LSA_R_CREATE_TRUSTED_DOMAIN *r_u)
771 {
772 return NT_STATUS_ACCESS_DENIED;
773 }
774
775 /***************************************************************************
776 ***************************************************************************/
777
778 NTSTATUS _lsa_create_secret(pipes_struct *p, LSA_Q_CREATE_SECRET *q_u, LSA_R_CREATE_SECRET *r_u)
779 {
780 return NT_STATUS_ACCESS_DENIED;
781 }
782
783 /***************************************************************************
784 ***************************************************************************/
785
786 NTSTATUS _lsa_set_secret(pipes_struct *p, LSA_Q_SET_SECRET *q_u, LSA_R_SET_SECRET *r_u)
787 {
788 return NT_STATUS_ACCESS_DENIED;
789 }
790
791 /***************************************************************************
792 ***************************************************************************/
793
794 NTSTATUS _lsa_delete_object(pipes_struct *p, LSA_Q_DELETE_OBJECT *q_u, LSA_R_DELETE_OBJECT *r_u)
795 {
796 return NT_STATUS_ACCESS_DENIED;
797 }
798
799 /***************************************************************************
800 _lsa_enum_privs.
801 ***************************************************************************/
802
803 NTSTATUS _lsa_enum_privs(pipes_struct *p, LSA_Q_ENUM_PRIVS *q_u, LSA_R_ENUM_PRIVS *r_u)
804 {
805 struct lsa_info *handle;
806 uint32 i;
807 uint32 enum_context = q_u->enum_context;
808 int num_privs = 0;
809 LSA_PRIV_ENTRY *entries = NULL;
810 LUID_ATTR luid;
811
812 /* remember that the enum_context starts at 0 and not 1 */
813
814 if ( lp_enable_privileges() )
815 num_privs = count_all_privileges();
816 else
817 DEBUG(2,("_lsa_enum_privs: client trying to enumerate privileges by not enabled in smb.conf!\n"));
818
819 if ( enum_context >= num_privs )
820 return NT_STATUS_NO_MORE_ENTRIES;
821
822 DEBUG(10,("_lsa_enum_privs: enum_context:%d total entries:%d\n",
823 enum_context, num_privs));
824
825 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
826 return NT_STATUS_INVALID_HANDLE;
827
828 /* check if the user have enough rights
829 I don't know if it's the right one. not documented. */
830
831 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
832 return NT_STATUS_ACCESS_DENIED;
833
834 if ( !(entries = TALLOC_ZERO_ARRAY(p->mem_ctx, LSA_PRIV_ENTRY, num_privs )) )
835 return NT_STATUS_NO_MEMORY;
836
837 for (i = 0; i < num_privs; i++) {
838 if( i < enum_context) {
839 init_unistr2(&entries[i].name, NULL, UNI_FLAGS_NONE);
840 init_uni_hdr(&entries[i].hdr_name, &entries[i].name);
841
842 entries[i].luid_low = 0;
843 entries[i].luid_high = 0;
844 } else {
845 init_unistr2(&entries[i].name, privs[i].name, UNI_FLAGS_NONE);
846 init_uni_hdr(&entries[i].hdr_name, &entries[i].name);
847
848 luid = get_privilege_luid( &privs[i].se_priv );
849
850 entries[i].luid_low = luid.luid.low;
851 entries[i].luid_high = luid.luid.high;
852 }
853 }
854
855 enum_context = num_privs;
856
857 init_lsa_r_enum_privs(r_u, enum_context, num_privs, entries);
858
859 return NT_STATUS_OK;
860 }
861
862 /***************************************************************************
863 _lsa_priv_get_dispname.
864 ***************************************************************************/
865
866 NTSTATUS _lsa_priv_get_dispname(pipes_struct *p, LSA_Q_PRIV_GET_DISPNAME *q_u, LSA_R_PRIV_GET_DISPNAME *r_u)
867 {
868 struct lsa_info *handle;
869 fstring name_asc;
870 const char *description;
871
872 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
873 return NT_STATUS_INVALID_HANDLE;
874
875 /* check if the user have enough rights */
876
877 /*
878 * I don't know if it's the right one. not documented.
879 */
880 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
881 return NT_STATUS_ACCESS_DENIED;
882
883 unistr2_to_ascii(name_asc, &q_u->name, sizeof(name_asc));
884
885 DEBUG(10,("_lsa_priv_get_dispname: name = %s\n", name_asc));
886
887 description = get_privilege_dispname( name_asc );
888
889 if ( description ) {
890 DEBUG(10,("_lsa_priv_get_dispname: display name = %s\n", description));
891
892 init_unistr2(&r_u->desc, description, UNI_FLAGS_NONE);
893 init_uni_hdr(&r_u->hdr_desc, &r_u->desc);
894
895 r_u->ptr_info = 0xdeadbeef;
896 r_u->lang_id = q_u->lang_id;
897
898 return NT_STATUS_OK;
899 } else {
900 DEBUG(10,("_lsa_priv_get_dispname: doesn't exist\n"));
901
902 r_u->ptr_info = 0;
903
904 return NT_STATUS_NO_SUCH_PRIVILEGE;
905 }
906 }
907
908 /***************************************************************************
909 _lsa_enum_accounts.
910 ***************************************************************************/
911
912 NTSTATUS _lsa_enum_accounts(pipes_struct *p, LSA_Q_ENUM_ACCOUNTS *q_u, LSA_R_ENUM_ACCOUNTS *r_u)
913 {
914 struct lsa_info *handle;
915 DOM_SID *sid_list;
916 int i, j, num_entries;
917 LSA_SID_ENUM *sids=&r_u->sids;
918 NTSTATUS ret;
919
920 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
921 return NT_STATUS_INVALID_HANDLE;
922
923 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
924 return NT_STATUS_ACCESS_DENIED;
925
926 sid_list = NULL;
927 num_entries = 0;
928
929 /* The only way we can currently find out all the SIDs that have been
930 privileged is to scan all privileges */
931
932 if (!NT_STATUS_IS_OK(ret = privilege_enumerate_accounts(&sid_list, &num_entries))) {
933 return ret;
934 }
935
936 if (q_u->enum_context >= num_entries)
937 return NT_STATUS_NO_MORE_ENTRIES;
938
939 sids->ptr_sid = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_entries-q_u->enum_context);
940 sids->sid = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_SID2, num_entries-q_u->enum_context);
941
942 if (sids->ptr_sid==NULL || sids->sid==NULL) {
943 SAFE_FREE(sid_list);
944 return NT_STATUS_NO_MEMORY;
945 }
946
947 for (i = q_u->enum_context, j = 0; i < num_entries; i++, j++) {
948 init_dom_sid2(&(*sids).sid[j], &sid_list[i]);
949 (*sids).ptr_sid[j] = 1;
950 }
951
952 SAFE_FREE(sid_list);
953
954 init_lsa_r_enum_accounts(r_u, num_entries);
955
956 return NT_STATUS_OK;
957 }
958
959
960 NTSTATUS _lsa_unk_get_connuser(pipes_struct *p, LSA_Q_UNK_GET_CONNUSER *q_u, LSA_R_UNK_GET_CONNUSER *r_u)
961 {
962 fstring username, domname;
963 user_struct *vuser = get_valid_user_struct(p->vuid);
964
965 if (vuser == NULL)
966 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
967
968 fstrcpy(username, vuser->user.smb_name);
969 fstrcpy(domname, vuser->user.domain);
970
971 r_u->ptr_user_name = 1;
972 init_unistr2(&r_u->uni2_user_name, username, UNI_STR_TERMINATE);
973 init_uni_hdr(&r_u->hdr_user_name, &r_u->uni2_user_name);
974
975 r_u->unk1 = 1;
976
977 r_u->ptr_dom_name = 1;
978 init_unistr2(&r_u->uni2_dom_name, domname, UNI_STR_TERMINATE);
979 init_uni_hdr(&r_u->hdr_dom_name, &r_u->uni2_dom_name);
980
981 r_u->status = NT_STATUS_OK;
982
983 return r_u->status;
984 }
985
986 /***************************************************************************
987 Lsa Create Account
988 ***************************************************************************/
989
990 NTSTATUS _lsa_create_account(pipes_struct *p, LSA_Q_CREATEACCOUNT *q_u, LSA_R_CREATEACCOUNT *r_u)
991 {
992 struct lsa_info *handle;
993 struct lsa_info *info;
994
995 /* find the connection policy handle. */
996 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
997 return NT_STATUS_INVALID_HANDLE;
998
999 /* check if the user have enough rights */
1000
1001 /*
1002 * I don't know if it's the right one. not documented.
1003 * but guessed with rpcclient.
1004 */
1005 if (!(handle->access & POLICY_GET_PRIVATE_INFORMATION))
1006 return NT_STATUS_ACCESS_DENIED;
1007
1008 /* check to see if the pipe_user is a Domain Admin since
1009 account_pol.tdb was already opened as root, this is all we have */
1010
1011 if ( !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1012 return NT_STATUS_ACCESS_DENIED;
1013
1014 if ( is_privileged_sid( &q_u->sid.sid ) )
1015 return NT_STATUS_OBJECT_NAME_COLLISION;
1016
1017 /* associate the user/group SID with the (unique) handle. */
1018
1019 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
1020 return NT_STATUS_NO_MEMORY;
1021
1022 ZERO_STRUCTP(info);
1023 info->sid = q_u->sid.sid;
1024 info->access = q_u->access;
1025
1026 /* get a (unique) handle. open a policy on it. */
1027 if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
1028 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1029
1030 return privilege_create_account( &info->sid );
1031 }
1032
1033
1034 /***************************************************************************
1035 Lsa Open Account
1036 ***************************************************************************/
1037
1038 NTSTATUS _lsa_open_account(pipes_struct *p, LSA_Q_OPENACCOUNT *q_u, LSA_R_OPENACCOUNT *r_u)
1039 {
1040 struct lsa_info *handle;
1041 struct lsa_info *info;
1042
1043 /* find the connection policy handle. */
1044 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
1045 return NT_STATUS_INVALID_HANDLE;
1046
1047 /* check if the user have enough rights */
1048
1049 /*
1050 * I don't know if it's the right one. not documented.
1051 * but guessed with rpcclient.
1052 */
1053 if (!(handle->access & POLICY_GET_PRIVATE_INFORMATION))
1054 return NT_STATUS_ACCESS_DENIED;
1055
1056 /* TODO: Fis the parsing routine before reenabling this check! */
1057 #if 0
1058 if (!lookup_sid(&handle->sid, dom_name, name, &type))
1059 return NT_STATUS_ACCESS_DENIED;
1060 #endif
1061 /* associate the user/group SID with the (unique) handle. */
1062 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
1063 return NT_STATUS_NO_MEMORY;
1064
1065 ZERO_STRUCTP(info);
1066 info->sid = q_u->sid.sid;
1067 info->access = q_u->access;
1068
1069 /* get a (unique) handle. open a policy on it. */
1070 if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
1071 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1072
1073 return NT_STATUS_OK;
1074 }
1075
1076 /***************************************************************************
1077 For a given SID, enumerate all the privilege this account has.
1078 ***************************************************************************/
1079
1080 NTSTATUS _lsa_enum_privsaccount(pipes_struct *p, prs_struct *ps, LSA_Q_ENUMPRIVSACCOUNT *q_u, LSA_R_ENUMPRIVSACCOUNT *r_u)
1081 {
1082 struct lsa_info *info=NULL;
1083 SE_PRIV mask;
1084 PRIVILEGE_SET privileges;
1085
1086 /* find the connection policy handle. */
1087 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1088 return NT_STATUS_INVALID_HANDLE;
1089
1090 if ( !get_privileges_for_sids( &mask, &info->sid, 1 ) )
1091 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1092
1093 privilege_set_init( &privileges );
1094
1095 if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
1096
1097 DEBUG(10,("_lsa_enum_privsaccount: %s has %d privileges\n",
1098 sid_string_static(&info->sid), privileges.count));
1099
1100 r_u->status = init_lsa_r_enum_privsaccount(ps->mem_ctx, r_u, privileges.set, privileges.count, 0);
1101 }
1102 else
1103 r_u->status = NT_STATUS_NO_SUCH_PRIVILEGE;
1104
1105 privilege_set_free( &privileges );
1106
1107 return r_u->status;
1108 }
1109
1110 /***************************************************************************
1111
1112 ***************************************************************************/
1113
1114 NTSTATUS _lsa_getsystemaccount(pipes_struct *p, LSA_Q_GETSYSTEMACCOUNT *q_u, LSA_R_GETSYSTEMACCOUNT *r_u)
1115 {
1116 struct lsa_info *info=NULL;
1117 fstring name, dom_name;
1118 enum SID_NAME_USE type;
1119
1120 /* find the connection policy handle. */
1121
1122 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1123 return NT_STATUS_INVALID_HANDLE;
1124
1125 if (!lookup_sid(&info->sid, dom_name, name, &type))
1126 return NT_STATUS_ACCESS_DENIED;
1127
1128 /*
1129 0x01 -> Log on locally
1130 0x02 -> Access this computer from network
1131 0x04 -> Log on as a batch job
1132 0x10 -> Log on as a service
1133
1134 they can be ORed together
1135 */
1136
1137 r_u->access = PR_LOG_ON_LOCALLY | PR_ACCESS_FROM_NETWORK;
1138
1139 return NT_STATUS_OK;
1140 }
1141
1142 /***************************************************************************
1143 update the systemaccount information
1144 ***************************************************************************/
1145
1146 NTSTATUS _lsa_setsystemaccount(pipes_struct *p, LSA_Q_SETSYSTEMACCOUNT *q_u, LSA_R_SETSYSTEMACCOUNT *r_u)
1147 {
1148 struct lsa_info *info=NULL;
1149 GROUP_MAP map;
1150 r_u->status = NT_STATUS_OK;
1151
1152 /* find the connection policy handle. */
1153 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1154 return NT_STATUS_INVALID_HANDLE;
1155
1156 /* check to see if the pipe_user is a Domain Admin since
1157 account_pol.tdb was already opened as root, this is all we have */
1158
1159 if ( !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1160 return NT_STATUS_ACCESS_DENIED;
1161
1162 if (!pdb_getgrsid(&map, info->sid))
1163 return NT_STATUS_NO_SUCH_GROUP;
1164
1165 if(!pdb_update_group_mapping_entry(&map))
1166 return NT_STATUS_NO_SUCH_GROUP;
1167
1168 return r_u->status;
1169 }
1170
1171 /***************************************************************************
1172 For a given SID, add some privileges.
1173 ***************************************************************************/
1174
1175 NTSTATUS _lsa_addprivs(pipes_struct *p, LSA_Q_ADDPRIVS *q_u, LSA_R_ADDPRIVS *r_u)
1176 {
1177 struct lsa_info *info = NULL;
1178 SE_PRIV mask;
1179 PRIVILEGE_SET *set = NULL;
1180 struct current_user user;
1181
1182 /* find the connection policy handle. */
1183 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1184 return NT_STATUS_INVALID_HANDLE;
1185
1186 /* check to see if the pipe_user is root or a Domain Admin since
1187 account_pol.tdb was already opened as root, this is all we have */
1188
1189 get_current_user( &user, p );
1190 if ( user.uid != sec_initial_uid()
1191 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1192 {
1193 return NT_STATUS_ACCESS_DENIED;
1194 }
1195
1196 set = &q_u->set;
1197
1198 if ( !privilege_set_to_se_priv( &mask, set ) )
1199 return NT_STATUS_NO_SUCH_PRIVILEGE;
1200
1201 if ( !grant_privilege( &info->sid, &mask ) ) {
1202 DEBUG(3,("_lsa_addprivs: grant_privilege(%s) failed!\n",
1203 sid_string_static(&info->sid) ));
1204 DEBUG(3,("Privilege mask:\n"));
1205 dump_se_priv( DBGC_ALL, 3, &mask );
1206 return NT_STATUS_NO_SUCH_PRIVILEGE;
1207 }
1208
1209 return NT_STATUS_OK;
1210 }
1211
1212 /***************************************************************************
1213 For a given SID, remove some privileges.
1214 ***************************************************************************/
1215
1216 NTSTATUS _lsa_removeprivs(pipes_struct *p, LSA_Q_REMOVEPRIVS *q_u, LSA_R_REMOVEPRIVS *r_u)
1217 {
1218 struct lsa_info *info = NULL;
1219 SE_PRIV mask;
1220 PRIVILEGE_SET *set = NULL;
1221 struct current_user user;
1222
1223 /* find the connection policy handle. */
1224 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1225 return NT_STATUS_INVALID_HANDLE;
1226
1227 /* check to see if the pipe_user is root or a Domain Admin since
1228 account_pol.tdb was already opened as root, this is all we have */
1229
1230 get_current_user( &user, p );
1231 if ( user.uid != sec_initial_uid()
1232 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1233 {
1234 return NT_STATUS_ACCESS_DENIED;
1235 }
1236
1237 set = &q_u->set;
1238
1239 if ( !privilege_set_to_se_priv( &mask, set ) )
1240 return NT_STATUS_NO_SUCH_PRIVILEGE;
1241
1242 if ( !revoke_privilege( &info->sid, &mask ) ) {
1243 DEBUG(3,("_lsa_removeprivs: revoke_privilege(%s) failed!\n",
1244 sid_string_static(&info->sid) ));
1245 DEBUG(3,("Privilege mask:\n"));
1246 dump_se_priv( DBGC_ALL, 3, &mask );
1247 return NT_STATUS_NO_SUCH_PRIVILEGE;
1248 }
1249
1250 return NT_STATUS_OK;
1251 }
1252
1253 /***************************************************************************
1254 For a given SID, remove some privileges.
1255 ***************************************************************************/
1256
1257 NTSTATUS _lsa_query_secobj(pipes_struct *p, LSA_Q_QUERY_SEC_OBJ *q_u, LSA_R_QUERY_SEC_OBJ *r_u)
1258 {
1259 struct lsa_info *handle=NULL;
1260 SEC_DESC *psd = NULL;
1261 size_t sd_size;
1262 NTSTATUS status;
1263
1264 r_u->status = NT_STATUS_OK;
1265
1266 /* find the connection policy handle. */
1267 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
1268 return NT_STATUS_INVALID_HANDLE;
1269
1270 /* check if the user have enough rights */
1271 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
1272 return NT_STATUS_ACCESS_DENIED;
1273
1274
1275 switch (q_u->sec_info) {
1276 case 1:
1277 /* SD contains only the owner */
1278
1279 status=lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
1280 if(!NT_STATUS_IS_OK(status))
1281 return NT_STATUS_NO_MEMORY;
1282
1283
1284 if((r_u->buf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1285 return NT_STATUS_NO_MEMORY;
1286 break;
1287 case 4:
1288 /* SD contains only the ACL */
1289
1290 status=lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
1291 if(!NT_STATUS_IS_OK(status))
1292 return NT_STATUS_NO_MEMORY;
1293
1294 if((r_u->buf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1295 return NT_STATUS_NO_MEMORY;
1296 break;
1297 default:
1298 return NT_STATUS_INVALID_LEVEL;
1299 }
1300
1301 r_u->ptr=1;
1302
1303 return r_u->status;
1304 }
1305
1306 #if 0 /* AD DC work in ongoing in Samba 4 */
1307
1308 /***************************************************************************
1309 ***************************************************************************/
1310
1311 NTSTATUS _lsa_query_info2(pipes_struct *p, LSA_Q_QUERY_INFO2 *q_u, LSA_R_QUERY_INFO2 *r_u)
1312 {
1313 struct lsa_info *handle;
1314 const char *nb_name;
1315 char *dns_name = NULL;
1316 char *forest_name = NULL;
1317 DOM_SID *sid = NULL;
1318 struct uuid guid;
1319 fstring dnsdomname;
1320
1321 ZERO_STRUCT(guid);
1322 r_u->status = NT_STATUS_OK;
1323
1324 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
1325 return NT_STATUS_INVALID_HANDLE;
1326
1327 switch (q_u->info_class) {
1328 case 0x0c:
1329 /* check if the user have enough rights */
1330 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
1331 return NT_STATUS_ACCESS_DENIED;
1332
1333 /* Request PolicyPrimaryDomainInformation. */
1334 switch (lp_server_role()) {
1335 case ROLE_DOMAIN_PDC:
1336 case ROLE_DOMAIN_BDC:
1337 nb_name = get_global_sam_name();
1338 /* ugly temp hack for these next two */
1339
1340 /* This should be a 'netbios domain -> DNS domain' mapping */
1341 dnsdomname[0] = '\0';
1342 get_mydnsdomname(dnsdomname);
1343 strlower_m(dnsdomname);
1344
1345 dns_name = dnsdomname;
1346 forest_name = dnsdomname;
1347
1348 sid = get_global_sam_sid();
1349 secrets_fetch_domain_guid(lp_workgroup(), &guid);
1350 break;
1351 default:
1352 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1353 }
1354 init_dns_dom_info(&r_u->info.dns_dom_info, nb_name, dns_name,
1355 forest_name,&guid,sid);
1356 break;
1357 default:
1358 DEBUG(0,("_lsa_query_info2: unknown info level in Lsa Query: %d\n", q_u->info_class));
1359 r_u->status = NT_STATUS_INVALID_INFO_CLASS;
1360 break;
1361 }
1362
1363 if (NT_STATUS_IS_OK(r_u->status)) {
1364 r_u->ptr = 0x1;
1365 r_u->info_class = q_u->info_class;
1366 }
1367
1368 return r_u->status;
1369 }
1370 #endif /* AD DC work in ongoing in Samba 4 */
1371
1372 /***************************************************************************
1373 ***************************************************************************/
1374
1375 NTSTATUS _lsa_add_acct_rights(pipes_struct *p, LSA_Q_ADD_ACCT_RIGHTS *q_u, LSA_R_ADD_ACCT_RIGHTS *r_u)
1376 {
1377 struct lsa_info *info = NULL;
1378 int i = 0;
1379 DOM_SID sid;
1380 fstring privname;
1381 UNISTR4_ARRAY *uni_privnames = q_u->rights;
1382 struct current_user user;
1383
1384
1385 /* find the connection policy handle. */
1386 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1387 return NT_STATUS_INVALID_HANDLE;
1388
1389 /* check to see if the pipe_user is a Domain Admin since
1390 account_pol.tdb was already opened as root, this is all we have */
1391
1392 get_current_user( &user, p );
1393 if ( user.uid != sec_initial_uid()
1394 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1395 {
1396 return NT_STATUS_ACCESS_DENIED;
1397 }
1398
1399 /* according to an NT4 PDC, you can add privileges to SIDs even without
1400 call_lsa_create_account() first. And you can use any arbitrary SID. */
1401
1402 sid_copy( &sid, &q_u->sid.sid );
1403
1404 /* just a little sanity check */
1405
1406 if ( q_u->count != uni_privnames->count ) {
1407 DEBUG(0,("_lsa_add_acct_rights: count != number of UNISTR2 elements!\n"));
1408 return NT_STATUS_INVALID_HANDLE;
1409 }
1410
1411 for ( i=0; i<q_u->count; i++ ) {
1412 UNISTR4 *uni4_str = &uni_privnames->strings[i];
1413
1414 /* only try to add non-null strings */
1415
1416 if ( !uni4_str->string )
1417 continue;
1418
1419 rpcstr_pull( privname, uni4_str->string->buffer, sizeof(privname), -1, STR_TERMINATE );
1420
1421 if ( !grant_privilege_by_name( &sid, privname ) ) {
1422 DEBUG(2,("_lsa_add_acct_rights: Failed to add privilege [%s]\n", privname ));
1423 return NT_STATUS_NO_SUCH_PRIVILEGE;
1424 }
1425 }
1426
1427 return NT_STATUS_OK;
1428 }
1429
1430 /***************************************************************************
1431 ***************************************************************************/
1432
1433 NTSTATUS _lsa_remove_acct_rights(pipes_struct *p, LSA_Q_REMOVE_ACCT_RIGHTS *q_u, LSA_R_REMOVE_ACCT_RIGHTS *r_u)
1434 {
1435 struct lsa_info *info = NULL;
1436 int i = 0;
1437 DOM_SID sid;
1438 fstring privname;
1439 UNISTR4_ARRAY *uni_privnames = q_u->rights;
1440 struct current_user user;
1441
1442
1443 /* find the connection policy handle. */
1444 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1445 return NT_STATUS_INVALID_HANDLE;
1446
1447 /* check to see if the pipe_user is a Domain Admin since
1448 account_pol.tdb was already opened as root, this is all we have */
1449
1450 get_current_user( &user, p );
1451 if ( user.uid != sec_initial_uid()
1452 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1453 {
1454 return NT_STATUS_ACCESS_DENIED;
1455 }
1456
1457 sid_copy( &sid, &q_u->sid.sid );
1458
1459 if ( q_u->removeall ) {
1460 if ( !revoke_all_privileges( &sid ) )
1461 return NT_STATUS_ACCESS_DENIED;
1462
1463 return NT_STATUS_OK;
1464 }
1465
1466 /* just a little sanity check */
1467
1468 if ( q_u->count != uni_privnames->count ) {
1469 DEBUG(0,("_lsa_add_acct_rights: count != number of UNISTR2 elements!\n"));
1470 return NT_STATUS_INVALID_HANDLE;
1471 }
1472
1473 for ( i=0; i<q_u->count; i++ ) {
1474 UNISTR4 *uni4_str = &uni_privnames->strings[i];
1475
1476 /* only try to add non-null strings */
1477
1478 if ( !uni4_str->string )
1479 continue;
1480
1481 rpcstr_pull( privname, uni4_str->string->buffer, sizeof(privname), -1, STR_TERMINATE );
1482
1483 if ( !revoke_privilege_by_name( &sid, privname ) ) {
1484 DEBUG(2,("_lsa_remove_acct_rights: Failed to revoke privilege [%s]\n", privname ));
1485 return NT_STATUS_NO_SUCH_PRIVILEGE;
1486 }
1487 }
1488
1489 return NT_STATUS_OK;
1490 }
1491
1492
1493 /***************************************************************************
1494 ***************************************************************************/
1495
1496 NTSTATUS _lsa_enum_acct_rights(pipes_struct *p, LSA_Q_ENUM_ACCT_RIGHTS *q_u, LSA_R_ENUM_ACCT_RIGHTS *r_u)
1497 {
1498 struct lsa_info *info = NULL;
1499 DOM_SID sid;
1500 PRIVILEGE_SET privileges;
1501 SE_PRIV mask;
1502
1503
1504 /* find the connection policy handle. */
1505
1506 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1507 return NT_STATUS_INVALID_HANDLE;
1508
1509 /* according to an NT4 PDC, you can add privileges to SIDs even without
1510 call_lsa_create_account() first. And you can use any arbitrary SID. */
1511
1512 sid_copy( &sid, &q_u->sid.sid );
1513
1514 if ( !get_privileges_for_sids( &mask, &sid, 1 ) )
1515 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1516
1517 privilege_set_init( &privileges );
1518
1519 if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
1520
1521 DEBUG(10,("_lsa_enum_acct_rights: %s has %d privileges\n",
1522 sid_string_static(&sid), privileges.count));
1523
1524 r_u->status = init_r_enum_acct_rights( r_u, &privileges );
1525 }
1526 else
1527 r_u->status = NT_STATUS_NO_SUCH_PRIVILEGE;
1528
1529 privilege_set_free( &privileges );
1530
1531 return r_u->status;
1532 }
1533
1534
1535 /***************************************************************************
1536 ***************************************************************************/
1537
1538 NTSTATUS _lsa_lookup_priv_value(pipes_struct *p, LSA_Q_LOOKUP_PRIV_VALUE *q_u, LSA_R_LOOKUP_PRIV_VALUE *r_u)
1539 {
1540 struct lsa_info *info = NULL;
1541 fstring name;
1542 LUID_ATTR priv_luid;
1543 SE_PRIV mask;
1544
1545 /* find the connection policy handle. */
1546
1547 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1548 return NT_STATUS_INVALID_HANDLE;
1549
1550 unistr2_to_ascii(name, &q_u->privname.unistring, sizeof(name));
1551
1552 DEBUG(10,("_lsa_lookup_priv_value: name = %s\n", name));
1553
1554 if ( !se_priv_from_name( name, &mask ) )
1555 return NT_STATUS_NO_SUCH_PRIVILEGE;
1556
1557 priv_luid = get_privilege_luid( &mask );
1558
1559 r_u->luid.low = priv_luid.luid.low;
1560 r_u->luid.high = priv_luid.luid.high;
1561
1562
1563 return NT_STATUS_OK;
1564 }
1565
Samba GIT mirror