?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r10391: * setting version to 3.0.20a
[Samba.git] / source / rpc_server / srv_samr_nt.c
blob2a3d351f67e762535b7bc2960964096e06f4b38f
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Marc Jacobsen 1999,
8 * Copyright (C) Jeremy Allison 2001-2002,
9 * Copyright (C) Jean François Micouleau 1998-2001,
10 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
11 * Copyright (C) Gerald (Jerry) Carter 2003-2004,
12 * Copyright (C) Simo Sorce 2003.
13 *
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * (at your option) any later version.
18 *
19 * This program is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
23 *
24 * You should have received a copy of the GNU General Public License
25 * along with this program; if not, write to the Free Software
26 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 */
28
29 /*
30 * This is the implementation of the SAMR code.
31 */
32
33 #include "includes.h"
34
35 #undef DBGC_CLASS
36 #define DBGC_CLASS DBGC_RPC_SRV
37
38 #define SAMR_USR_RIGHTS_WRITE_PW \
39 ( READ_CONTROL_ACCESS | \
40 SA_RIGHT_USER_CHANGE_PASSWORD | \
41 SA_RIGHT_USER_SET_LOC_COM )
42
43 extern rid_name domain_group_rids[];
44 extern rid_name domain_alias_rids[];
45 extern rid_name builtin_alias_rids[];
46
47 typedef struct disp_info {
48 struct pdb_search *users; /* querydispinfo 1 and 4 */
49 struct pdb_search *machines; /* querydispinfo 2 */
50 struct pdb_search *groups; /* querydispinfo 3 and 5, enumgroups */
51 struct pdb_search *aliases; /* enumaliases */
52 struct pdb_search *builtins; /* enumaliases */
53
54 uint16 enum_acb_mask;
55 struct pdb_search *enum_users; /* enumusers with a mask */
56 } DISP_INFO;
57
58 struct samr_info {
59 /* for use by the \PIPE\samr policy */
60 DOM_SID sid;
61 uint32 status; /* some sort of flag. best to record it. comes from opnum 0x39 */
62 uint32 acc_granted;
63 uint16 acb_mask;
64 BOOL only_machines;
65 DISP_INFO disp_info;
66
67 TALLOC_CTX *mem_ctx;
68 };
69
70 struct generic_mapping sam_generic_mapping = {GENERIC_RIGHTS_SAM_READ, GENERIC_RIGHTS_SAM_WRITE, GENERIC_RIGHTS_SAM_EXECUTE, GENERIC_RIGHTS_SAM_ALL_ACCESS};
71 struct generic_mapping dom_generic_mapping = {GENERIC_RIGHTS_DOMAIN_READ, GENERIC_RIGHTS_DOMAIN_WRITE, GENERIC_RIGHTS_DOMAIN_EXECUTE, GENERIC_RIGHTS_DOMAIN_ALL_ACCESS};
72 struct generic_mapping usr_generic_mapping = {GENERIC_RIGHTS_USER_READ, GENERIC_RIGHTS_USER_WRITE, GENERIC_RIGHTS_USER_EXECUTE, GENERIC_RIGHTS_USER_ALL_ACCESS};
73 struct generic_mapping grp_generic_mapping = {GENERIC_RIGHTS_GROUP_READ, GENERIC_RIGHTS_GROUP_WRITE, GENERIC_RIGHTS_GROUP_EXECUTE, GENERIC_RIGHTS_GROUP_ALL_ACCESS};
74 struct generic_mapping ali_generic_mapping = {GENERIC_RIGHTS_ALIAS_READ, GENERIC_RIGHTS_ALIAS_WRITE, GENERIC_RIGHTS_ALIAS_EXECUTE, GENERIC_RIGHTS_ALIAS_ALL_ACCESS};
75
76 /*******************************************************************
77 *******************************************************************/
78
79 static NTSTATUS make_samr_object_sd( TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size,
80 struct generic_mapping *map,
81 DOM_SID *sid, uint32 sid_access )
82 {
83 DOM_SID domadmin_sid;
84 SEC_ACE ace[5]; /* at most 5 entries */
85 SEC_ACCESS mask;
86 size_t i = 0;
87
88 SEC_ACL *psa = NULL;
89
90 /* basic access for Everyone */
91
92 init_sec_access(&mask, map->generic_execute | map->generic_read );
93 init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
94
95 /* add Full Access 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
96
97 init_sec_access(&mask, map->generic_all);
98
99 init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
100 init_sec_ace(&ace[i++], &global_sid_Builtin_Account_Operators, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
101
102 /* Add Full Access for Domain Admins if we are a DC */
103
104 if ( IS_DC ) {
105 sid_copy( &domadmin_sid, get_global_sam_sid() );
106 sid_append_rid( &domadmin_sid, DOMAIN_GROUP_RID_ADMINS );
107 init_sec_ace(&ace[i++], &domadmin_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
108 }
109
110 /* if we have a sid, give it some special access */
111
112 if ( sid ) {
113 init_sec_access( &mask, sid_access );
114 init_sec_ace(&ace[i++], sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
115 }
116
117 /* create the security descriptor */
118
119 if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, i, ace)) == NULL)
120 return NT_STATUS_NO_MEMORY;
121
122 if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, psa, sd_size)) == NULL)
123 return NT_STATUS_NO_MEMORY;
124
125 return NT_STATUS_OK;
126 }
127
128 /*******************************************************************
129 Checks if access to an object should be granted, and returns that
130 level of access for further checks.
131 ********************************************************************/
132
133 static NTSTATUS access_check_samr_object( SEC_DESC *psd, NT_USER_TOKEN *token,
134 SE_PRIV *rights, uint32 rights_mask,
135 uint32 des_access, uint32 *acc_granted,
136 const char *debug )
137 {
138 NTSTATUS status = NT_STATUS_ACCESS_DENIED;
139 uint32 saved_mask = 0;
140
141 /* check privileges; certain SAM access bits should be overridden
142 by privileges (mostly having to do with creating/modifying/deleting
143 users and groups) */
144
145 if ( rights && user_has_any_privilege( token, rights ) ) {
146
147 saved_mask = (des_access & rights_mask);
148 des_access &= ~saved_mask;
149
150 DEBUG(4,("access_check_samr_object: user rights access mask [0x%x]\n",
151 rights_mask));
152 }
153
154
155 /* check the security descriptor first */
156
157 if ( se_access_check(psd, token, des_access, acc_granted, &status) )
158 goto done;
159
160 /* give root a free pass */
161
162 if ( geteuid() == sec_initial_uid() ) {
163
164 DEBUG(4,("%s: ACCESS should be DENIED (requested: %#010x)\n", debug, des_access));
165 DEBUGADD(4,("but overritten by euid == sec_initial_uid()\n"));
166
167 *acc_granted = des_access;
168
169 status = NT_STATUS_OK;
170 goto done;
171 }
172
173
174 done:
175 /* add in any bits saved during the privilege check (only
176 matters is status is ok) */
177
178 *acc_granted |= rights_mask;
179
180 DEBUG(4,("%s: access %s (requested: 0x%08x, granted: 0x%08x)\n",
181 debug, NT_STATUS_IS_OK(status) ? "GRANTED" : "DENIED",
182 des_access, *acc_granted));
183
184 return status;
185 }
186
187 /*******************************************************************
188 Checks if access to a function can be granted
189 ********************************************************************/
190
191 static NTSTATUS access_check_samr_function(uint32 acc_granted, uint32 acc_required, const char *debug)
192 {
193 DEBUG(5,("%s: access check ((granted: %#010x; required: %#010x)\n",
194 debug, acc_granted, acc_required));
195
196 /* check the security descriptor first */
197
198 if ( (acc_granted&acc_required) == acc_required )
199 return NT_STATUS_OK;
200
201 /* give root a free pass */
202
203 if (geteuid() == sec_initial_uid()) {
204
205 DEBUG(4,("%s: ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
206 debug, acc_granted, acc_required));
207 DEBUGADD(4,("but overwritten by euid == 0\n"));
208
209 return NT_STATUS_OK;
210 }
211
212 DEBUG(2,("%s: ACCESS DENIED (granted: %#010x; required: %#010x)\n",
213 debug, acc_granted, acc_required));
214
215 return NT_STATUS_ACCESS_DENIED;
216 }
217
218
219 /*******************************************************************
220 Create a samr_info struct.
221 ********************************************************************/
222
223 static struct samr_info *get_samr_info_by_sid(DOM_SID *psid)
224 {
225 struct samr_info *info;
226 fstring sid_str;
227 TALLOC_CTX *mem_ctx;
228
229 if (psid) {
230 sid_to_string(sid_str, psid);
231 } else {
232 fstrcpy(sid_str,"(NULL)");
233 }
234
235 mem_ctx = talloc_init("samr_info for domain sid %s", sid_str);
236
237 if ((info = TALLOC_ZERO_P(mem_ctx, struct samr_info)) == NULL)
238 return NULL;
239
240 DEBUG(10,("get_samr_info_by_sid: created new info for sid %s\n", sid_str));
241 if (psid) {
242 sid_copy( &info->sid, psid);
243 } else {
244 DEBUG(10,("get_samr_info_by_sid: created new info for NULL sid.\n"));
245 }
246 info->mem_ctx = mem_ctx;
247 return info;
248 }
249
250 /*******************************************************************
251 Function to free the per handle data.
252 ********************************************************************/
253
254 /*******************************************************************
255 Function to free the per handle data.
256 ********************************************************************/
257
258 static void free_samr_db(struct samr_info *info)
259 {
260 pdb_search_destroy(info->disp_info.users);
261 info->disp_info.users = NULL;
262 pdb_search_destroy(info->disp_info.machines);
263 info->disp_info.machines = NULL;
264 pdb_search_destroy(info->disp_info.groups);
265 info->disp_info.groups = NULL;
266 pdb_search_destroy(info->disp_info.aliases);
267 info->disp_info.aliases = NULL;
268 pdb_search_destroy(info->disp_info.builtins);
269 info->disp_info.builtins = NULL;
270 pdb_search_destroy(info->disp_info.enum_users);
271 info->disp_info.enum_users = NULL;
272 }
273
274 static void free_samr_info(void *ptr)
275 {
276 struct samr_info *info=(struct samr_info *) ptr;
277
278 free_samr_db(info);
279 talloc_destroy(info->mem_ctx);
280 }
281
282 /*******************************************************************
283 Ensure password info is never given out. Paranioa... JRA.
284 ********************************************************************/
285
286 static void samr_clear_sam_passwd(SAM_ACCOUNT *sam_pass)
287 {
288
289 if (!sam_pass)
290 return;
291
292 /* These now zero out the old password */
293
294 pdb_set_lanman_passwd(sam_pass, NULL, PDB_DEFAULT);
295 pdb_set_nt_passwd(sam_pass, NULL, PDB_DEFAULT);
296 }
297
298 static uint32 count_sam_users(struct disp_info *info, uint16 acct_flags)
299 {
300 struct samr_displayentry *entry;
301 if (info->users == NULL)
302 info->users = pdb_search_users(acct_flags);
303 if (info->users == NULL)
304 return 0;
305 /* Fetch the last possible entry, thus trigger an enumeration */
306 pdb_search_entries(info->users, 0xffffffff, 1, &entry);
307 return info->users->num_entries;
308 }
309
310 static uint32 count_sam_groups(struct disp_info *info)
311 {
312 struct samr_displayentry *entry;
313 if (info->groups == NULL)
314 info->groups = pdb_search_groups();
315 if (info->groups == NULL)
316 return 0;
317 /* Fetch the last possible entry, thus trigger an enumeration */
318 pdb_search_entries(info->groups, 0xffffffff, 1, &entry);
319 return info->groups->num_entries;
320 }
321
322 /*******************************************************************
323 _samr_close_hnd
324 ********************************************************************/
325
326 NTSTATUS _samr_close_hnd(pipes_struct *p, SAMR_Q_CLOSE_HND *q_u, SAMR_R_CLOSE_HND *r_u)
327 {
328 r_u->status = NT_STATUS_OK;
329
330 /* close the policy handle */
331 if (!close_policy_hnd(p, &q_u->pol))
332 return NT_STATUS_OBJECT_NAME_INVALID;
333
334 DEBUG(5,("samr_reply_close_hnd: %d\n", __LINE__));
335
336 return r_u->status;
337 }
338
339 /*******************************************************************
340 samr_reply_open_domain
341 ********************************************************************/
342
343 NTSTATUS _samr_open_domain(pipes_struct *p, SAMR_Q_OPEN_DOMAIN *q_u, SAMR_R_OPEN_DOMAIN *r_u)
344 {
345 struct samr_info *info;
346 SEC_DESC *psd = NULL;
347 uint32 acc_granted;
348 uint32 des_access = q_u->flags;
349 NTSTATUS status;
350 size_t sd_size;
351 SE_PRIV se_rights;
352
353 r_u->status = NT_STATUS_OK;
354
355 /* find the connection policy handle. */
356
357 if ( !find_policy_by_hnd(p, &q_u->pol, (void**)&info) )
358 return NT_STATUS_INVALID_HANDLE;
359
360 status = access_check_samr_function( info->acc_granted,
361 SA_RIGHT_SAM_OPEN_DOMAIN, "_samr_open_domain" );
362
363 if ( !NT_STATUS_IS_OK(status) )
364 return status;
365
366 /*check if access can be granted as requested by client. */
367
368 make_samr_object_sd( p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0 );
369 se_map_generic( &des_access, &dom_generic_mapping );
370
371 se_priv_copy( &se_rights, &se_machine_account );
372 se_priv_add( &se_rights, &se_add_users );
373
374 status = access_check_samr_object( psd, p->pipe_user.nt_user_token,
375 &se_rights, GENERIC_RIGHTS_DOMAIN_WRITE, des_access,
376 &acc_granted, "_samr_open_domain" );
377
378 if ( !NT_STATUS_IS_OK(status) )
379 return status;
380
381 /* associate the domain SID with the (unique) handle. */
382 if ((info = get_samr_info_by_sid(&q_u->dom_sid.sid))==NULL)
383 return NT_STATUS_NO_MEMORY;
384 info->acc_granted = acc_granted;
385
386 /* get a (unique) handle. open a policy on it. */
387 if (!create_policy_hnd(p, &r_u->domain_pol, free_samr_info, (void *)info))
388 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
389
390 DEBUG(5,("samr_open_domain: %d\n", __LINE__));
391
392 return r_u->status;
393 }
394
395 /*******************************************************************
396 _samr_get_usrdom_pwinfo
397 ********************************************************************/
398
399 NTSTATUS _samr_get_usrdom_pwinfo(pipes_struct *p, SAMR_Q_GET_USRDOM_PWINFO *q_u, SAMR_R_GET_USRDOM_PWINFO *r_u)
400 {
401 struct samr_info *info = NULL;
402
403 r_u->status = NT_STATUS_OK;
404
405 /* find the policy handle. open a policy on it. */
406 if (!find_policy_by_hnd(p, &q_u->user_pol, (void **)&info))
407 return NT_STATUS_INVALID_HANDLE;
408
409 if (!sid_check_is_in_our_domain(&info->sid))
410 return NT_STATUS_OBJECT_TYPE_MISMATCH;
411
412 init_samr_r_get_usrdom_pwinfo(r_u, NT_STATUS_OK);
413
414 DEBUG(5,("_samr_get_usrdom_pwinfo: %d\n", __LINE__));
415
416 /*
417 * NT sometimes return NT_STATUS_ACCESS_DENIED
418 * I don't know yet why.
419 */
420
421 return r_u->status;
422 }
423
424
425 /*******************************************************************
426 _samr_set_sec_obj
427 ********************************************************************/
428
429 NTSTATUS _samr_set_sec_obj(pipes_struct *p, SAMR_Q_SET_SEC_OBJ *q_u, SAMR_R_SET_SEC_OBJ *r_u)
430 {
431 DEBUG(0,("_samr_set_sec_obj: Not yet implemented!\n"));
432 return NT_STATUS_NOT_IMPLEMENTED;
433 }
434
435
436 /*******************************************************************
437 ********************************************************************/
438
439 static BOOL get_lsa_policy_samr_sid( pipes_struct *p, POLICY_HND *pol,
440 DOM_SID *sid, uint32 *acc_granted)
441 {
442 struct samr_info *info = NULL;
443
444 /* find the policy handle. open a policy on it. */
445 if (!find_policy_by_hnd(p, pol, (void **)&info))
446 return False;
447
448 if (!info)
449 return False;
450
451 *sid = info->sid;
452 *acc_granted = info->acc_granted;
453 return True;
454 }
455
456 /*******************************************************************
457 _samr_query_sec_obj
458 ********************************************************************/
459
460 NTSTATUS _samr_query_sec_obj(pipes_struct *p, SAMR_Q_QUERY_SEC_OBJ *q_u, SAMR_R_QUERY_SEC_OBJ *r_u)
461 {
462 DOM_SID pol_sid;
463 fstring str_sid;
464 SEC_DESC * psd = NULL;
465 uint32 acc_granted;
466 size_t sd_size;
467
468 r_u->status = NT_STATUS_OK;
469
470 /* Get the SID. */
471 if (!get_lsa_policy_samr_sid(p, &q_u->user_pol, &pol_sid, &acc_granted))
472 return NT_STATUS_INVALID_HANDLE;
473
474
475
476 DEBUG(10,("_samr_query_sec_obj: querying security on SID: %s\n", sid_to_string(str_sid, &pol_sid)));
477
478 /* Check what typ of SID is beeing queried (e.g Domain SID, User SID, Group SID) */
479
480 /* To query the security of the SAM it self an invalid SID with S-0-0 is passed to this function */
481 if (pol_sid.sid_rev_num == 0)
482 {
483 DEBUG(5,("_samr_query_sec_obj: querying security on SAM\n"));
484 r_u->status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
485 }
486 else if (sid_equal(&pol_sid,get_global_sam_sid())) /* check if it is our domain SID */
487
488 {
489 DEBUG(5,("_samr_query_sec_obj: querying security on Domain with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
490 r_u->status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0);
491 }
492 else if (sid_equal(&pol_sid,&global_sid_Builtin)) /* check if it is the Builtin Domain */
493 {
494 /* TODO: Builtin probably needs a different SD with restricted write access*/
495 DEBUG(5,("_samr_query_sec_obj: querying security on Builtin Domain with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
496 r_u->status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0);
497 }
498 else if (sid_check_is_in_our_domain(&pol_sid) ||
499 sid_check_is_in_builtin(&pol_sid))
500 {
501 /* TODO: different SDs have to be generated for aliases groups and users.
502 Currently all three get a default user SD */
503 DEBUG(10,("_samr_query_sec_obj: querying security on Object with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
504 r_u->status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping, &pol_sid, SAMR_USR_RIGHTS_WRITE_PW);
505 }
506 else return NT_STATUS_OBJECT_TYPE_MISMATCH;
507
508 if ((r_u->buf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
509 return NT_STATUS_NO_MEMORY;
510
511 if (NT_STATUS_IS_OK(r_u->status))
512 r_u->ptr = 1;
513
514 return r_u->status;
515 }
516
517 /*******************************************************************
518 makes a SAM_ENTRY / UNISTR2* structure from a user list.
519 ********************************************************************/
520
521 static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp,
522 UNISTR2 **uni_name_pp,
523 uint32 num_entries, uint32 start_idx,
524 struct samr_displayentry *entries)
525 {
526 uint32 i;
527 SAM_ENTRY *sam;
528 UNISTR2 *uni_name;
529
530 *sam_pp = NULL;
531 *uni_name_pp = NULL;
532
533 if (num_entries == 0)
534 return NT_STATUS_OK;
535
536 sam = TALLOC_ZERO_ARRAY(ctx, SAM_ENTRY, num_entries);
537
538 uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_entries);
539
540 if (sam == NULL || uni_name == NULL) {
541 DEBUG(0, ("make_user_sam_entry_list: talloc_zero failed!\n"));
542 return NT_STATUS_NO_MEMORY;
543 }
544
545 for (i = 0; i < num_entries; i++) {
546 UNISTR2 uni_temp_name;
547 /*
548 * usrmgr expects a non-NULL terminated string with
549 * trust relationships
550 */
551 if (entries[i].acct_flags & ACB_DOMTRUST) {
552 init_unistr2(&uni_temp_name, entries[i].account_name,
553 UNI_FLAGS_NONE);
554 } else {
555 init_unistr2(&uni_temp_name, entries[i].account_name,
556 UNI_STR_TERMINATE);
557 }
558
559 init_sam_entry(&sam[i], &uni_temp_name, entries[i].rid);
560 copy_unistr2(&uni_name[i], &uni_temp_name);
561 }
562
563 *sam_pp = sam;
564 *uni_name_pp = uni_name;
565 return NT_STATUS_OK;
566 }
567
568 /*******************************************************************
569 samr_reply_enum_dom_users
570 ********************************************************************/
571
572 NTSTATUS _samr_enum_dom_users(pipes_struct *p, SAMR_Q_ENUM_DOM_USERS *q_u,
573 SAMR_R_ENUM_DOM_USERS *r_u)
574 {
575 struct samr_info *info = NULL;
576 int num_account;
577 uint32 enum_context=q_u->start_idx;
578 enum remote_arch_types ra_type = get_remote_arch();
579 int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
580 uint32 max_entries = max_sam_entries;
581 struct samr_displayentry *entries = NULL;
582
583 r_u->status = NT_STATUS_OK;
584
585 /* find the policy handle. open a policy on it. */
586 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
587 return NT_STATUS_INVALID_HANDLE;
588
589 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted,
590 SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
591 "_samr_enum_dom_users"))) {
592 return r_u->status;
593 }
594
595 DEBUG(5,("_samr_enum_dom_users: %d\n", __LINE__));
596
597 become_root();
598 if ((info->disp_info.enum_users != NULL) &&
599 (info->disp_info.enum_acb_mask != q_u->acb_mask)) {
600 pdb_search_destroy(info->disp_info.enum_users);
601 info->disp_info.enum_users = NULL;
602 }
603
604 if (info->disp_info.enum_users == NULL) {
605 info->disp_info.enum_users = pdb_search_users(q_u->acb_mask);
606 info->disp_info.enum_acb_mask = q_u->acb_mask;
607 }
608 if (info->disp_info.enum_users == NULL)
609 return NT_STATUS_ACCESS_DENIED;
610 num_account = pdb_search_entries(info->disp_info.enum_users,
611 enum_context, max_entries,
612 &entries);
613 unbecome_root();
614
615 if (num_account == 0) {
616 DEBUG(5, ("_samr_enum_dom_users: enumeration handle over "
617 "total entries\n"));
618 return NT_STATUS_OK;
619 }
620
621 r_u->status = make_user_sam_entry_list(p->mem_ctx, &r_u->sam,
622 &r_u->uni_acct_name,
623 num_account, enum_context,
624 entries);
625
626 if (!NT_STATUS_IS_OK(r_u->status))
627 return r_u->status;
628
629 if (max_entries <= num_account)
630 r_u->status = STATUS_MORE_ENTRIES;
631
632 DEBUG(5, ("_samr_enum_dom_users: %d\n", __LINE__));
633
634 init_samr_r_enum_dom_users(r_u, q_u->start_idx + num_account,
635 num_account);
636
637 DEBUG(5,("_samr_enum_dom_users: %d\n", __LINE__));
638
639 return r_u->status;
640 }
641
642 /*******************************************************************
643 makes a SAM_ENTRY / UNISTR2* structure from a group list.
644 ********************************************************************/
645
646 static void make_group_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp,
647 UNISTR2 **uni_name_pp,
648 uint32 num_sam_entries,
649 struct samr_displayentry *entries)
650 {
651 uint32 i;
652 SAM_ENTRY *sam;
653 UNISTR2 *uni_name;
654
655 *sam_pp = NULL;
656 *uni_name_pp = NULL;
657
658 if (num_sam_entries == 0)
659 return;
660
661 sam = TALLOC_ZERO_ARRAY(ctx, SAM_ENTRY, num_sam_entries);
662 uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_sam_entries);
663
664 if (sam == NULL || uni_name == NULL) {
665 DEBUG(0, ("NULL pointers in SAMR_R_QUERY_DISPINFO\n"));
666 return;
667 }
668
669 for (i = 0; i < num_sam_entries; i++) {
670 /*
671 * JRA. I think this should include the null. TNG does not.
672 */
673 init_unistr2(&uni_name[i], entries[i].account_name,
674 UNI_STR_TERMINATE);
675 init_sam_entry(&sam[i], &uni_name[i], entries[i].rid);
676 }
677
678 *sam_pp = sam;
679 *uni_name_pp = uni_name;
680 }
681
682 /*******************************************************************
683 samr_reply_enum_dom_groups
684 ********************************************************************/
685
686 NTSTATUS _samr_enum_dom_groups(pipes_struct *p, SAMR_Q_ENUM_DOM_GROUPS *q_u, SAMR_R_ENUM_DOM_GROUPS *r_u)
687 {
688 struct samr_info *info = NULL;
689 struct samr_displayentry *groups;
690 uint32 num_groups;
691
692 r_u->status = NT_STATUS_OK;
693
694 /* find the policy handle. open a policy on it. */
695 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
696 return NT_STATUS_INVALID_HANDLE;
697
698 r_u->status = access_check_samr_function(info->acc_granted,
699 SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
700 "_samr_enum_dom_groups");
701 if (!NT_STATUS_IS_OK(r_u->status))
702 return r_u->status;
703
704 DEBUG(5,("samr_reply_enum_dom_groups: %d\n", __LINE__));
705
706 /* the domain group array is being allocated in the function below */
707
708 become_root();
709 if (info->disp_info.groups == NULL)
710 info->disp_info.groups = pdb_search_groups();
711 unbecome_root();
712
713 if (info->disp_info.groups == NULL)
714 return NT_STATUS_ACCESS_DENIED;
715
716 become_root();
717 num_groups = pdb_search_entries(info->disp_info.groups, q_u->start_idx,
718 MAX_SAM_ENTRIES, &groups);
719 unbecome_root();
720
721 make_group_sam_entry_list(p->mem_ctx, &r_u->sam, &r_u->uni_grp_name,
722 num_groups, groups);
723
724 init_samr_r_enum_dom_groups(r_u, q_u->start_idx, num_groups);
725
726 DEBUG(5,("samr_enum_dom_groups: %d\n", __LINE__));
727
728 return r_u->status;
729 }
730
731 /*******************************************************************
732 samr_reply_enum_dom_aliases
733 ********************************************************************/
734
735 NTSTATUS _samr_enum_dom_aliases(pipes_struct *p, SAMR_Q_ENUM_DOM_ALIASES *q_u, SAMR_R_ENUM_DOM_ALIASES *r_u)
736 {
737 struct samr_info *info;
738 struct samr_displayentry *aliases;
739 struct pdb_search **search = NULL;
740 uint32 num_aliases = 0;
741
742 /* find the policy handle. open a policy on it. */
743 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
744 return NT_STATUS_INVALID_HANDLE;
745
746 r_u->status = access_check_samr_function(info->acc_granted,
747 SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
748 "_samr_enum_dom_aliases");
749 if (!NT_STATUS_IS_OK(r_u->status))
750 return r_u->status;
751
752 DEBUG(5,("samr_reply_enum_dom_aliases: sid %s\n",
753 sid_string_static(&info->sid)));
754
755 if (sid_check_is_domain(&info->sid))
756 search = &info->disp_info.aliases;
757 if (sid_check_is_builtin(&info->sid))
758 search = &info->disp_info.builtins;
759
760 if (search == NULL)
761 return NT_STATUS_INVALID_HANDLE;
762
763 become_root();
764 if (*search == NULL)
765 *search = pdb_search_aliases(&info->sid);
766 unbecome_root();
767
768 if (*search == NULL)
769 return NT_STATUS_ACCESS_DENIED;
770
771 become_root();
772 num_aliases = pdb_search_entries(*search, q_u->start_idx,
773 MAX_SAM_ENTRIES, &aliases);
774 unbecome_root();
775
776 make_group_sam_entry_list(p->mem_ctx, &r_u->sam, &r_u->uni_grp_name,
777 num_aliases, aliases);
778
779 init_samr_r_enum_dom_aliases(r_u, q_u->start_idx + num_aliases,
780 num_aliases);
781
782 DEBUG(5,("samr_enum_dom_aliases: %d\n", __LINE__));
783
784 return r_u->status;
785 }
786
787 /*******************************************************************
788 samr_reply_query_dispinfo
789 ********************************************************************/
790
791 NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u,
792 SAMR_R_QUERY_DISPINFO *r_u)
793 {
794 struct samr_info *info = NULL;
795 uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
796
797 uint32 max_entries=q_u->max_entries;
798 uint32 enum_context=q_u->start_idx;
799 uint32 max_size=q_u->max_size;
800
801 SAM_DISPINFO_CTR *ctr;
802 uint32 temp_size=0, total_data_size=0;
803 NTSTATUS disp_ret;
804 uint32 num_account = 0;
805 enum remote_arch_types ra_type = get_remote_arch();
806 int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
807 DOM_SID domain_sid;
808 struct samr_displayentry *entries = NULL;
809
810 DEBUG(5, ("samr_reply_query_dispinfo: %d\n", __LINE__));
811 r_u->status = NT_STATUS_UNSUCCESSFUL;
812
813 /* find the policy handle. open a policy on it. */
814 if (!find_policy_by_hnd(p, &q_u->domain_pol, (void **)&info))
815 return NT_STATUS_INVALID_HANDLE;
816
817 domain_sid = info->sid;
818
819 /*
820 * calculate how many entries we will return.
821 * based on
822 * - the number of entries the client asked
823 * - our limit on that
824 * - the starting point (enumeration context)
825 * - the buffer size the client will accept
826 */
827
828 /*
829 * We are a lot more like W2K. Instead of reading the SAM
830 * each time to find the records we need to send back,
831 * we read it once and link that copy to the sam handle.
832 * For large user list (over the MAX_SAM_ENTRIES)
833 * it's a definitive win.
834 * second point to notice: between enumerations
835 * our sam is now the same as it's a snapshoot.
836 * third point: got rid of the static SAM_USER_21 struct
837 * no more intermediate.
838 * con: it uses much more memory, as a full copy is stored
839 * in memory.
840 *
841 * If you want to change it, think twice and think
842 * of the second point , that's really important.
843 *
844 * JFM, 12/20/2001
845 */
846
847 if ((q_u->switch_level < 1) || (q_u->switch_level > 5)) {
848 DEBUG(0,("_samr_query_dispinfo: Unknown info level (%u)\n",
849 (unsigned int)q_u->switch_level ));
850 return NT_STATUS_INVALID_INFO_CLASS;
851 }
852
853 /* first limit the number of entries we will return */
854 if(max_entries > max_sam_entries) {
855 DEBUG(5, ("samr_reply_query_dispinfo: client requested %d "
856 "entries, limiting to %d\n", max_entries,
857 max_sam_entries));
858 max_entries = max_sam_entries;
859 }
860
861 /* calculate the size and limit on the number of entries we will
862 * return */
863
864 temp_size=max_entries*struct_size;
865
866 if (temp_size>max_size) {
867 max_entries=MIN((max_size/struct_size),max_entries);;
868 DEBUG(5, ("samr_reply_query_dispinfo: buffer size limits to "
869 "only %d entries\n", max_entries));
870 }
871
872 if (!(ctr = TALLOC_ZERO_P(p->mem_ctx,SAM_DISPINFO_CTR)))
873 return NT_STATUS_NO_MEMORY;
874
875 ZERO_STRUCTP(ctr);
876
877 become_root();
878
879 switch (q_u->switch_level) {
880 case 0x1:
881 case 0x4:
882 if (info->disp_info.users == NULL)
883 info->disp_info.users = pdb_search_users(ACB_NORMAL);
884 if (info->disp_info.users == NULL)
885 return NT_STATUS_ACCESS_DENIED;
886 num_account = pdb_search_entries(info->disp_info.users,
887 enum_context, max_entries,
888 &entries);
889 break;
890 case 0x2:
891 if (info->disp_info.machines == NULL)
892 info->disp_info.machines =
893 pdb_search_users(ACB_WSTRUST|ACB_SVRTRUST);
894 if (info->disp_info.machines == NULL)
895 return NT_STATUS_ACCESS_DENIED;
896 num_account = pdb_search_entries(info->disp_info.machines,
897 enum_context, max_entries,
898 &entries);
899 break;
900 case 0x3:
901 case 0x5:
902 if (info->disp_info.groups == NULL)
903 info->disp_info.groups = pdb_search_groups();
904 if (info->disp_info.groups == NULL)
905 return NT_STATUS_ACCESS_DENIED;
906 num_account = pdb_search_entries(info->disp_info.groups,
907 enum_context, max_entries,
908 &entries);
909 break;
910 default:
911 smb_panic("info class changed");
912 break;
913 }
914 unbecome_root();
915
916 /* Now create reply structure */
917 switch (q_u->switch_level) {
918 case 0x1:
919 disp_ret = init_sam_dispinfo_1(p->mem_ctx, &ctr->sam.info1,
920 num_account, enum_context,
921 entries);
922 break;
923 case 0x2:
924 disp_ret = init_sam_dispinfo_2(p->mem_ctx, &ctr->sam.info2,
925 num_account, enum_context,
926 entries);
927 break;
928 case 0x3:
929 disp_ret = init_sam_dispinfo_3(p->mem_ctx, &ctr->sam.info3,
930 num_account, enum_context,
931 entries);
932 break;
933 case 0x4:
934 disp_ret = init_sam_dispinfo_4(p->mem_ctx, &ctr->sam.info4,
935 num_account, enum_context,
936 entries);
937 break;
938 case 0x5:
939 disp_ret = init_sam_dispinfo_5(p->mem_ctx, &ctr->sam.info5,
940 num_account, enum_context,
941 entries);
942 break;
943 default:
944 smb_panic("info class changed");
945 break;
946 }
947
948 if (!NT_STATUS_IS_OK(disp_ret))
949 return disp_ret;
950
951 /* calculate the total size */
952 total_data_size=num_account*struct_size;
953
954 if (num_account)
955 r_u->status = STATUS_MORE_ENTRIES;
956 else
957 r_u->status = NT_STATUS_OK;
958
959 DEBUG(5, ("_samr_query_dispinfo: %d\n", __LINE__));
960
961 init_samr_r_query_dispinfo(r_u, num_account, total_data_size,
962 temp_size, q_u->switch_level, ctr,
963 r_u->status);
964
965 return r_u->status;
966
967 }
968
969 /*******************************************************************
970 samr_reply_query_aliasinfo
971 ********************************************************************/
972
973 NTSTATUS _samr_query_aliasinfo(pipes_struct *p, SAMR_Q_QUERY_ALIASINFO *q_u, SAMR_R_QUERY_ALIASINFO *r_u)
974 {
975 DOM_SID sid;
976 struct acct_info info;
977 uint32 acc_granted;
978 BOOL ret;
979
980 r_u->status = NT_STATUS_OK;
981
982 DEBUG(5,("_samr_query_aliasinfo: %d\n", __LINE__));
983
984 /* find the policy handle. open a policy on it. */
985 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
986 return NT_STATUS_INVALID_HANDLE;
987 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_LOOKUP_INFO, "_samr_query_aliasinfo"))) {
988 return r_u->status;
989 }
990
991 become_root();
992 ret = pdb_get_aliasinfo(&sid, &info);
993 unbecome_root();
994
995 if ( !ret )
996 return NT_STATUS_NO_SUCH_ALIAS;
997
998 if ( !(r_u->ctr = TALLOC_ZERO_P( p->mem_ctx, ALIAS_INFO_CTR )) )
999 return NT_STATUS_NO_MEMORY;
1000
1001
1002 switch (q_u->level ) {
1003 case 1:
1004 r_u->ctr->level = 1;
1005 init_samr_alias_info1(&r_u->ctr->alias.info1, info.acct_name, 1, info.acct_desc);
1006 break;
1007 case 3:
1008 r_u->ctr->level = 3;
1009 init_samr_alias_info3(&r_u->ctr->alias.info3, info.acct_desc);
1010 break;
1011 default:
1012 return NT_STATUS_INVALID_INFO_CLASS;
1013 }
1014
1015 DEBUG(5,("_samr_query_aliasinfo: %d\n", __LINE__));
1016
1017 return r_u->status;
1018 }
1019
1020 #if 0
1021 /*******************************************************************
1022 samr_reply_lookup_ids
1023 ********************************************************************/
1024
1025 uint32 _samr_lookup_ids(pipes_struct *p, SAMR_Q_LOOKUP_IDS *q_u, SAMR_R_LOOKUP_IDS *r_u)
1026 {
1027 uint32 rid[MAX_SAM_ENTRIES];
1028 int num_rids = q_u->num_sids1;
1029
1030 r_u->status = NT_STATUS_OK;
1031
1032 DEBUG(5,("_samr_lookup_ids: %d\n", __LINE__));
1033
1034 if (num_rids > MAX_SAM_ENTRIES) {
1035 num_rids = MAX_SAM_ENTRIES;
1036 DEBUG(5,("_samr_lookup_ids: truncating entries to %d\n", num_rids));
1037 }
1038
1039 #if 0
1040 int i;
1041 SMB_ASSERT_ARRAY(q_u->uni_user_name, num_rids);
1042
1043 for (i = 0; i < num_rids && status == 0; i++)
1044 {
1045 struct sam_passwd *sam_pass;
1046 fstring user_name;
1047
1048
1049 fstrcpy(user_name, unistrn2(q_u->uni_user_name[i].buffer,
1050 q_u->uni_user_name[i].uni_str_len));
1051
1052 /* find the user account */
1053 become_root();
1054 sam_pass = get_smb21pwd_entry(user_name, 0);
1055 unbecome_root();
1056
1057 if (sam_pass == NULL)
1058 {
1059 status = 0xC0000000 | NT_STATUS_NO_SUCH_USER;
1060 rid[i] = 0;
1061 }
1062 else
1063 {
1064 rid[i] = sam_pass->user_rid;
1065 }
1066 }
1067 #endif
1068
1069 num_rids = 1;
1070 rid[0] = BUILTIN_ALIAS_RID_USERS;
1071
1072 init_samr_r_lookup_ids(&r_u, num_rids, rid, NT_STATUS_OK);
1073
1074 DEBUG(5,("_samr_lookup_ids: %d\n", __LINE__));
1075
1076 return r_u->status;
1077 }
1078 #endif
1079
1080 /*******************************************************************
1081 _samr_lookup_names
1082 ********************************************************************/
1083
1084 NTSTATUS _samr_lookup_names(pipes_struct *p, SAMR_Q_LOOKUP_NAMES *q_u, SAMR_R_LOOKUP_NAMES *r_u)
1085 {
1086 uint32 rid[MAX_SAM_ENTRIES];
1087 uint32 local_rid;
1088 enum SID_NAME_USE type[MAX_SAM_ENTRIES];
1089 enum SID_NAME_USE local_type;
1090 int i;
1091 int num_rids = q_u->num_names2;
1092 DOM_SID pol_sid;
1093 fstring sid_str;
1094 uint32 acc_granted;
1095
1096 r_u->status = NT_STATUS_OK;
1097
1098 DEBUG(5,("_samr_lookup_names: %d\n", __LINE__));
1099
1100 ZERO_ARRAY(rid);
1101 ZERO_ARRAY(type);
1102
1103 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &pol_sid, &acc_granted)) {
1104 init_samr_r_lookup_names(p->mem_ctx, r_u, 0, NULL, NULL, NT_STATUS_OBJECT_TYPE_MISMATCH);
1105 return r_u->status;
1106 }
1107
1108 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, 0, "_samr_lookup_names"))) { /* Don't know the acc_bits yet */
1109 return r_u->status;
1110 }
1111
1112 if (num_rids > MAX_SAM_ENTRIES) {
1113 num_rids = MAX_SAM_ENTRIES;
1114 DEBUG(5,("_samr_lookup_names: truncating entries to %d\n", num_rids));
1115 }
1116
1117 DEBUG(5,("_samr_lookup_names: looking name on SID %s\n", sid_to_string(sid_str, &pol_sid)));
1118
1119 for (i = 0; i < num_rids; i++) {
1120 fstring name;
1121 DOM_SID sid;
1122 int ret;
1123
1124 r_u->status = NT_STATUS_NONE_MAPPED;
1125
1126 rid [i] = 0xffffffff;
1127 type[i] = SID_NAME_UNKNOWN;
1128
1129 ret = rpcstr_pull(name, q_u->uni_name[i].buffer, sizeof(name), q_u->uni_name[i].uni_str_len*2, 0);
1130
1131 /*
1132 * we are only looking for a name
1133 * the SID we get back can be outside
1134 * the scope of the pol_sid
1135 *
1136 * in clear: it prevents to reply to domain\group: yes
1137 * when only builtin\group exists.
1138 *
1139 * a cleaner code is to add the sid of the domain we're looking in
1140 * to the local_lookup_name function.
1141 */
1142
1143 if ((ret > 0) && local_lookup_name(name, &sid, &local_type)) {
1144 sid_split_rid(&sid, &local_rid);
1145
1146 if (sid_equal(&sid, &pol_sid)) {
1147 rid[i]=local_rid;
1148
1149 /* Windows does not return WKN_GRP here, even
1150 * on lookups in builtin */
1151 type[i] = (local_type == SID_NAME_WKN_GRP) ?
1152 SID_NAME_ALIAS : local_type;
1153
1154 r_u->status = NT_STATUS_OK;
1155 }
1156 }
1157 }
1158
1159 init_samr_r_lookup_names(p->mem_ctx, r_u, num_rids, rid, (uint32 *)type, r_u->status);
1160
1161 DEBUG(5,("_samr_lookup_names: %d\n", __LINE__));
1162
1163 return r_u->status;
1164 }
1165
1166 /*******************************************************************
1167 _samr_chgpasswd_user
1168 ********************************************************************/
1169
1170 NTSTATUS _samr_chgpasswd_user(pipes_struct *p, SAMR_Q_CHGPASSWD_USER *q_u, SAMR_R_CHGPASSWD_USER *r_u)
1171 {
1172 fstring user_name;
1173 fstring wks;
1174
1175 DEBUG(5,("_samr_chgpasswd_user: %d\n", __LINE__));
1176
1177 r_u->status = NT_STATUS_OK;
1178
1179 rpcstr_pull(user_name, q_u->uni_user_name.buffer, sizeof(user_name), q_u->uni_user_name.uni_str_len*2, 0);
1180 rpcstr_pull(wks, q_u->uni_dest_host.buffer, sizeof(wks), q_u->uni_dest_host.uni_str_len*2,0);
1181
1182 DEBUG(5,("samr_chgpasswd_user: user: %s wks: %s\n", user_name, wks));
1183
1184 /*
1185 * Pass the user through the NT -> unix user mapping
1186 * function.
1187 */
1188
1189 (void)map_username(user_name);
1190
1191 /*
1192 * UNIX username case mangling not required, pass_oem_change
1193 * is case insensitive.
1194 */
1195
1196 r_u->status = pass_oem_change(user_name, q_u->lm_newpass.pass, q_u->lm_oldhash.hash,
1197 q_u->nt_newpass.pass, q_u->nt_oldhash.hash);
1198
1199 init_samr_r_chgpasswd_user(r_u, r_u->status);
1200
1201 DEBUG(5,("_samr_chgpasswd_user: %d\n", __LINE__));
1202
1203 return r_u->status;
1204 }
1205
1206 /*******************************************************************
1207 makes a SAMR_R_LOOKUP_RIDS structure.
1208 ********************************************************************/
1209
1210 static BOOL make_samr_lookup_rids(TALLOC_CTX *ctx, uint32 num_names,
1211 const char **names, UNIHDR **pp_hdr_name,
1212 UNISTR2 **pp_uni_name)
1213 {
1214 uint32 i;
1215 UNIHDR *hdr_name=NULL;
1216 UNISTR2 *uni_name=NULL;
1217
1218 *pp_uni_name = NULL;
1219 *pp_hdr_name = NULL;
1220
1221 if (num_names != 0) {
1222 hdr_name = TALLOC_ZERO_ARRAY(ctx, UNIHDR, num_names);
1223 if (hdr_name == NULL)
1224 return False;
1225
1226 uni_name = TALLOC_ZERO_ARRAY(ctx,UNISTR2, num_names);
1227 if (uni_name == NULL)
1228 return False;
1229 }
1230
1231 for (i = 0; i < num_names; i++) {
1232 DEBUG(10, ("names[%d]:%s\n", i, names[i] && *names[i] ? names[i] : ""));
1233 init_unistr2(&uni_name[i], names[i], UNI_FLAGS_NONE);
1234 init_uni_hdr(&hdr_name[i], &uni_name[i]);
1235 }
1236
1237 *pp_uni_name = uni_name;
1238 *pp_hdr_name = hdr_name;
1239
1240 return True;
1241 }
1242
1243 /*******************************************************************
1244 _samr_lookup_rids
1245 ********************************************************************/
1246
1247 NTSTATUS _samr_lookup_rids(pipes_struct *p, SAMR_Q_LOOKUP_RIDS *q_u, SAMR_R_LOOKUP_RIDS *r_u)
1248 {
1249 const char **names;
1250 uint32 *attrs = NULL;
1251 UNIHDR *hdr_name = NULL;
1252 UNISTR2 *uni_name = NULL;
1253 DOM_SID pol_sid;
1254 int num_rids = q_u->num_rids1;
1255 uint32 acc_granted;
1256
1257 r_u->status = NT_STATUS_OK;
1258
1259 DEBUG(5,("_samr_lookup_rids: %d\n", __LINE__));
1260
1261 /* find the policy handle. open a policy on it. */
1262 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &pol_sid, &acc_granted))
1263 return NT_STATUS_INVALID_HANDLE;
1264
1265 if (num_rids > 1000) {
1266 DEBUG(0, ("Got asked for %d rids (more than 1000) -- according "
1267 "to samba4 idl this is not possible\n", num_rids));
1268 return NT_STATUS_UNSUCCESSFUL;
1269 }
1270
1271 names = TALLOC_ZERO_ARRAY(p->mem_ctx, const char *, num_rids);
1272 attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_rids);
1273
1274 if ((num_rids != 0) && ((names == NULL) || (attrs == NULL)))
1275 return NT_STATUS_NO_MEMORY;
1276
1277 if (!sid_equal(&pol_sid, get_global_sam_sid())) {
1278 /* TODO: Sooner or later we need to look up BUILTIN rids as
1279 * well. -- vl */
1280 goto done;
1281 }
1282
1283 become_root(); /* lookup_sid can require root privs */
1284 r_u->status = pdb_lookup_rids(p->mem_ctx, &pol_sid, num_rids, q_u->rid,
1285 &names, &attrs);
1286 unbecome_root();
1287
1288 done:
1289
1290 if(!make_samr_lookup_rids(p->mem_ctx, num_rids, names,
1291 &hdr_name, &uni_name))
1292 return NT_STATUS_NO_MEMORY;
1293
1294 init_samr_r_lookup_rids(r_u, num_rids, hdr_name, uni_name, attrs);
1295
1296 DEBUG(5,("_samr_lookup_rids: %d\n", __LINE__));
1297
1298 return r_u->status;
1299 }
1300
1301 /*******************************************************************
1302 _samr_open_user. Safe - gives out no passwd info.
1303 ********************************************************************/
1304
1305 NTSTATUS _samr_open_user(pipes_struct *p, SAMR_Q_OPEN_USER *q_u, SAMR_R_OPEN_USER *r_u)
1306 {
1307 SAM_ACCOUNT *sampass=NULL;
1308 DOM_SID sid;
1309 POLICY_HND domain_pol = q_u->domain_pol;
1310 POLICY_HND *user_pol = &r_u->user_pol;
1311 struct samr_info *info = NULL;
1312 SEC_DESC *psd = NULL;
1313 uint32 acc_granted;
1314 uint32 des_access = q_u->access_mask;
1315 size_t sd_size;
1316 BOOL ret;
1317 NTSTATUS nt_status;
1318 SE_PRIV se_rights;
1319
1320 r_u->status = NT_STATUS_OK;
1321
1322 /* find the domain policy handle and get domain SID / access bits in the domain policy. */
1323
1324 if ( !get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted) )
1325 return NT_STATUS_INVALID_HANDLE;
1326
1327 nt_status = access_check_samr_function( acc_granted,
1328 SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_open_user" );
1329
1330 if ( !NT_STATUS_IS_OK(nt_status) )
1331 return nt_status;
1332
1333 nt_status = pdb_init_sam_talloc(p->mem_ctx, &sampass);
1334
1335 if (!NT_STATUS_IS_OK(nt_status))
1336 return nt_status;
1337
1338 /* append the user's RID to it */
1339
1340 if (!sid_append_rid(&sid, q_u->user_rid))
1341 return NT_STATUS_NO_SUCH_USER;
1342
1343 /* check if access can be granted as requested by client. */
1344
1345 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping, &sid, SAMR_USR_RIGHTS_WRITE_PW);
1346 se_map_generic(&des_access, &usr_generic_mapping);
1347
1348 se_priv_copy( &se_rights, &se_machine_account );
1349 se_priv_add( &se_rights, &se_add_users );
1350
1351 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
1352 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
1353 &acc_granted, "_samr_open_user");
1354
1355 if ( !NT_STATUS_IS_OK(nt_status) )
1356 return nt_status;
1357
1358 become_root();
1359 ret=pdb_getsampwsid(sampass, &sid);
1360 unbecome_root();
1361
1362 /* check that the SID exists in our domain. */
1363 if (ret == False) {
1364 return NT_STATUS_NO_SUCH_USER;
1365 }
1366
1367 pdb_free_sam(&sampass);
1368
1369 /* associate the user's SID and access bits with the new handle. */
1370 if ((info = get_samr_info_by_sid(&sid)) == NULL)
1371 return NT_STATUS_NO_MEMORY;
1372 info->acc_granted = acc_granted;
1373
1374 /* get a (unique) handle. open a policy on it. */
1375 if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info))
1376 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1377
1378 return r_u->status;
1379 }
1380
1381 /*************************************************************************
1382 get_user_info_7. Safe. Only gives out account_name.
1383 *************************************************************************/
1384
1385 static NTSTATUS get_user_info_7(TALLOC_CTX *mem_ctx, SAM_USER_INFO_7 *id7, DOM_SID *user_sid)
1386 {
1387 SAM_ACCOUNT *smbpass=NULL;
1388 BOOL ret;
1389 NTSTATUS nt_status;
1390
1391 nt_status = pdb_init_sam_talloc(mem_ctx, &smbpass);
1392
1393 if (!NT_STATUS_IS_OK(nt_status)) {
1394 return nt_status;
1395 }
1396
1397 become_root();
1398 ret = pdb_getsampwsid(smbpass, user_sid);
1399 unbecome_root();
1400
1401 if (ret==False) {
1402 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
1403 return NT_STATUS_NO_SUCH_USER;
1404 }
1405
1406 DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass) ));
1407
1408 ZERO_STRUCTP(id7);
1409 init_sam_user_info7(id7, pdb_get_username(smbpass) );
1410
1411 pdb_free_sam(&smbpass);
1412
1413 return NT_STATUS_OK;
1414 }
1415 /*************************************************************************
1416 get_user_info_16. Safe. Only gives out acb bits.
1417 *************************************************************************/
1418
1419 static NTSTATUS get_user_info_16(TALLOC_CTX *mem_ctx, SAM_USER_INFO_16 *id16, DOM_SID *user_sid)
1420 {
1421 SAM_ACCOUNT *smbpass=NULL;
1422 BOOL ret;
1423 NTSTATUS nt_status;
1424
1425 nt_status = pdb_init_sam_talloc(mem_ctx, &smbpass);
1426
1427 if (!NT_STATUS_IS_OK(nt_status)) {
1428 return nt_status;
1429 }
1430
1431 become_root();
1432 ret = pdb_getsampwsid(smbpass, user_sid);
1433 unbecome_root();
1434
1435 if (ret==False) {
1436 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
1437 return NT_STATUS_NO_SUCH_USER;
1438 }
1439
1440 DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass) ));
1441
1442 ZERO_STRUCTP(id16);
1443 init_sam_user_info16(id16, pdb_get_acct_ctrl(smbpass) );
1444
1445 pdb_free_sam(&smbpass);
1446
1447 return NT_STATUS_OK;
1448 }
1449
1450 /*************************************************************************
1451 get_user_info_18. OK - this is the killer as it gives out password info.
1452 Ensure that this is only allowed on an encrypted connection with a root
1453 user. JRA.
1454 *************************************************************************/
1455
1456 static NTSTATUS get_user_info_18(pipes_struct *p, TALLOC_CTX *mem_ctx, SAM_USER_INFO_18 * id18, DOM_SID *user_sid)
1457 {
1458 SAM_ACCOUNT *smbpass=NULL;
1459 BOOL ret;
1460 NTSTATUS nt_status;
1461
1462 if (!p->ntlmssp_auth_validated)
1463 return NT_STATUS_ACCESS_DENIED;
1464
1465 if (!(p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) || !(p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL))
1466 return NT_STATUS_ACCESS_DENIED;
1467
1468 /*
1469 * Do *NOT* do become_root()/unbecome_root() here ! JRA.
1470 */
1471
1472 nt_status = pdb_init_sam_talloc(mem_ctx, &smbpass);
1473
1474 if (!NT_STATUS_IS_OK(nt_status)) {
1475 return nt_status;
1476 }
1477
1478 ret = pdb_getsampwsid(smbpass, user_sid);
1479
1480 if (ret == False) {
1481 DEBUG(4, ("User %s not found\n", sid_string_static(user_sid)));
1482 pdb_free_sam(&smbpass);
1483 return (geteuid() == (uid_t)0) ? NT_STATUS_NO_SUCH_USER : NT_STATUS_ACCESS_DENIED;
1484 }
1485
1486 DEBUG(3,("User:[%s] 0x%x\n", pdb_get_username(smbpass), pdb_get_acct_ctrl(smbpass) ));
1487
1488 if ( pdb_get_acct_ctrl(smbpass) & ACB_DISABLED) {
1489 pdb_free_sam(&smbpass);
1490 return NT_STATUS_ACCOUNT_DISABLED;
1491 }
1492
1493 ZERO_STRUCTP(id18);
1494 init_sam_user_info18(id18, pdb_get_lanman_passwd(smbpass), pdb_get_nt_passwd(smbpass));
1495
1496 pdb_free_sam(&smbpass);
1497
1498 return NT_STATUS_OK;
1499 }
1500
1501 /*************************************************************************
1502 get_user_info_20
1503 *************************************************************************/
1504
1505 static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx, SAM_USER_INFO_20 *id20, DOM_SID *user_sid)
1506 {
1507 SAM_ACCOUNT *sampass=NULL;
1508 BOOL ret;
1509
1510 pdb_init_sam_talloc(mem_ctx, &sampass);
1511
1512 become_root();
1513 ret = pdb_getsampwsid(sampass, user_sid);
1514 unbecome_root();
1515
1516 if (ret == False) {
1517 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
1518 return NT_STATUS_NO_SUCH_USER;
1519 }
1520
1521 samr_clear_sam_passwd(sampass);
1522
1523 DEBUG(3,("User:[%s]\n", pdb_get_username(sampass) ));
1524
1525 ZERO_STRUCTP(id20);
1526 init_sam_user_info20A(id20, sampass);
1527
1528 pdb_free_sam(&sampass);
1529
1530 return NT_STATUS_OK;
1531 }
1532
1533 /*************************************************************************
1534 get_user_info_21
1535 *************************************************************************/
1536
1537 static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx, SAM_USER_INFO_21 *id21,
1538 DOM_SID *user_sid, DOM_SID *domain_sid)
1539 {
1540 SAM_ACCOUNT *sampass=NULL;
1541 BOOL ret;
1542 NTSTATUS nt_status;
1543
1544 nt_status = pdb_init_sam_talloc(mem_ctx, &sampass);
1545 if (!NT_STATUS_IS_OK(nt_status)) {
1546 return nt_status;
1547 }
1548
1549 become_root();
1550 ret = pdb_getsampwsid(sampass, user_sid);
1551 unbecome_root();
1552
1553 if (ret == False) {
1554 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
1555 return NT_STATUS_NO_SUCH_USER;
1556 }
1557
1558 samr_clear_sam_passwd(sampass);
1559
1560 DEBUG(3,("User:[%s]\n", pdb_get_username(sampass) ));
1561
1562 ZERO_STRUCTP(id21);
1563 nt_status = init_sam_user_info21A(id21, sampass, domain_sid);
1564
1565 pdb_free_sam(&sampass);
1566
1567 return NT_STATUS_OK;
1568 }
1569
1570 /*******************************************************************
1571 _samr_query_userinfo
1572 ********************************************************************/
1573
1574 NTSTATUS _samr_query_userinfo(pipes_struct *p, SAMR_Q_QUERY_USERINFO *q_u, SAMR_R_QUERY_USERINFO *r_u)
1575 {
1576 SAM_USERINFO_CTR *ctr;
1577 struct samr_info *info = NULL;
1578 DOM_SID domain_sid;
1579 uint32 rid;
1580
1581 r_u->status=NT_STATUS_OK;
1582
1583 /* search for the handle */
1584 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1585 return NT_STATUS_INVALID_HANDLE;
1586
1587 domain_sid = info->sid;
1588
1589 sid_split_rid(&domain_sid, &rid);
1590
1591 if (!sid_check_is_in_our_domain(&info->sid))
1592 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1593
1594 DEBUG(5,("_samr_query_userinfo: sid:%s\n", sid_string_static(&info->sid)));
1595
1596 ctr = TALLOC_ZERO_P(p->mem_ctx, SAM_USERINFO_CTR);
1597 if (!ctr)
1598 return NT_STATUS_NO_MEMORY;
1599
1600 ZERO_STRUCTP(ctr);
1601
1602 /* ok! user info levels (lots: see MSDEV help), off we go... */
1603 ctr->switch_value = q_u->switch_value;
1604
1605 switch (q_u->switch_value) {
1606 case 7:
1607 ctr->info.id7 = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_7);
1608 if (ctr->info.id7 == NULL)
1609 return NT_STATUS_NO_MEMORY;
1610
1611 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_7(p->mem_ctx, ctr->info.id7, &info->sid)))
1612 return r_u->status;
1613 break;
1614 case 16:
1615 ctr->info.id16 = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_16);
1616 if (ctr->info.id16 == NULL)
1617 return NT_STATUS_NO_MEMORY;
1618
1619 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_16(p->mem_ctx, ctr->info.id16, &info->sid)))
1620 return r_u->status;
1621 break;
1622
1623 #if 0
1624 /* whoops - got this wrong. i think. or don't understand what's happening. */
1625 case 17:
1626 {
1627 NTTIME expire;
1628 info = (void *)&id11;
1629
1630 expire.low = 0xffffffff;
1631 expire.high = 0x7fffffff;
1632
1633 ctr->info.id = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_17));
1634 ZERO_STRUCTP(ctr->info.id17);
1635 init_sam_user_info17(ctr->info.id17, &expire,
1636 "BROOKFIELDS$", /* name */
1637 0x03ef, /* user rid */
1638 0x201, /* group rid */
1639 0x0080); /* acb info */
1640
1641 break;
1642 }
1643 #endif
1644
1645 case 18:
1646 ctr->info.id18 = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_18);
1647 if (ctr->info.id18 == NULL)
1648 return NT_STATUS_NO_MEMORY;
1649
1650 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_18(p, p->mem_ctx, ctr->info.id18, &info->sid)))
1651 return r_u->status;
1652 break;
1653
1654 case 20:
1655 ctr->info.id20 = TALLOC_ZERO_P(p->mem_ctx,SAM_USER_INFO_20);
1656 if (ctr->info.id20 == NULL)
1657 return NT_STATUS_NO_MEMORY;
1658 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_20(p->mem_ctx, ctr->info.id20, &info->sid)))
1659 return r_u->status;
1660 break;
1661
1662 case 21:
1663 ctr->info.id21 = TALLOC_ZERO_P(p->mem_ctx,SAM_USER_INFO_21);
1664 if (ctr->info.id21 == NULL)
1665 return NT_STATUS_NO_MEMORY;
1666 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_21(p->mem_ctx, ctr->info.id21,
1667 &info->sid, &domain_sid)))
1668 return r_u->status;
1669 break;
1670
1671 default:
1672 return NT_STATUS_INVALID_INFO_CLASS;
1673 }
1674
1675 init_samr_r_query_userinfo(r_u, ctr, r_u->status);
1676
1677 DEBUG(5,("_samr_query_userinfo: %d\n", __LINE__));
1678
1679 return r_u->status;
1680 }
1681
1682 /*******************************************************************
1683 samr_reply_query_usergroups
1684 ********************************************************************/
1685
1686 NTSTATUS _samr_query_usergroups(pipes_struct *p, SAMR_Q_QUERY_USERGROUPS *q_u, SAMR_R_QUERY_USERGROUPS *r_u)
1687 {
1688 SAM_ACCOUNT *sam_pass=NULL;
1689 struct passwd *passwd;
1690 DOM_SID sid;
1691 DOM_SID *sids;
1692 DOM_GID *gids = NULL;
1693 int num_groups = 0;
1694 gid_t *unix_gids;
1695 int i, num_gids;
1696 uint32 acc_granted;
1697 BOOL ret;
1698 NTSTATUS result;
1699
1700 /*
1701 * from the SID in the request:
1702 * we should send back the list of DOMAIN GROUPS
1703 * the user is a member of
1704 *
1705 * and only the DOMAIN GROUPS
1706 * no ALIASES !!! neither aliases of the domain
1707 * nor aliases of the builtin SID
1708 *
1709 * JFM, 12/2/2001
1710 */
1711
1712 r_u->status = NT_STATUS_OK;
1713
1714 DEBUG(5,("_samr_query_usergroups: %d\n", __LINE__));
1715
1716 /* find the policy handle. open a policy on it. */
1717 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
1718 return NT_STATUS_INVALID_HANDLE;
1719
1720 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_USER_GET_GROUPS, "_samr_query_usergroups"))) {
1721 return r_u->status;
1722 }
1723
1724 if (!sid_check_is_in_our_domain(&sid))
1725 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1726
1727 pdb_init_sam(&sam_pass);
1728
1729 become_root();
1730 ret = pdb_getsampwsid(sam_pass, &sid);
1731 unbecome_root();
1732
1733 if (ret == False) {
1734 pdb_free_sam(&sam_pass);
1735 return NT_STATUS_NO_SUCH_USER;
1736 }
1737
1738 passwd = getpwnam_alloc(pdb_get_username(sam_pass));
1739 if (passwd == NULL) {
1740 pdb_free_sam(&sam_pass);
1741 return NT_STATUS_NO_SUCH_USER;
1742 }
1743
1744 sids = NULL;
1745
1746 become_root();
1747 result = pdb_enum_group_memberships(pdb_get_username(sam_pass),
1748 passwd->pw_gid,
1749 &sids, &unix_gids, &num_groups);
1750 unbecome_root();
1751
1752 pdb_free_sam(&sam_pass);
1753 passwd_free(&passwd);
1754
1755 if (!NT_STATUS_IS_OK(result))
1756 return result;
1757
1758 SAFE_FREE(unix_gids);
1759
1760 gids = NULL;
1761 num_gids = 0;
1762
1763 for (i=0; i<num_groups; i++) {
1764 uint32 rid;
1765
1766 if (!sid_peek_check_rid(get_global_sam_sid(),
1767 &(sids[i]), &rid))
1768 continue;
1769
1770 gids = TALLOC_REALLOC_ARRAY(p->mem_ctx, gids, DOM_GID, num_gids+1);
1771 gids[num_gids].attr=7;
1772 gids[num_gids].g_rid = rid;
1773 num_gids += 1;
1774 }
1775 SAFE_FREE(sids);
1776
1777 /* construct the response. lkclXXXX: gids are not copied! */
1778 init_samr_r_query_usergroups(r_u, num_groups, gids, r_u->status);
1779
1780 DEBUG(5,("_samr_query_usergroups: %d\n", __LINE__));
1781
1782 return r_u->status;
1783 }
1784
1785 /*******************************************************************
1786 _samr_query_dom_info
1787 ********************************************************************/
1788
1789 NTSTATUS _samr_query_dom_info(pipes_struct *p, SAMR_Q_QUERY_DOMAIN_INFO *q_u, SAMR_R_QUERY_DOMAIN_INFO *r_u)
1790 {
1791 struct samr_info *info = NULL;
1792 SAM_UNK_CTR *ctr;
1793 uint32 min_pass_len,pass_hist,flag;
1794 time_t u_expire, u_min_age;
1795 NTTIME nt_expire, nt_min_age;
1796
1797 time_t u_lock_duration, u_reset_time;
1798 NTTIME nt_lock_duration, nt_reset_time;
1799 uint32 lockout;
1800
1801 time_t u_logout;
1802 NTTIME nt_logout;
1803
1804 uint32 account_policy_temp;
1805 uint32 server_role;
1806
1807 uint32 num_users=0, num_groups=0, num_aliases=0;
1808
1809 if ((ctr = TALLOC_ZERO_P(p->mem_ctx, SAM_UNK_CTR)) == NULL)
1810 return NT_STATUS_NO_MEMORY;
1811
1812 ZERO_STRUCTP(ctr);
1813
1814 r_u->status = NT_STATUS_OK;
1815
1816 DEBUG(5,("_samr_query_dom_info: %d\n", __LINE__));
1817
1818 /* find the policy handle. open a policy on it. */
1819 if (!find_policy_by_hnd(p, &q_u->domain_pol, (void **)&info))
1820 return NT_STATUS_INVALID_HANDLE;
1821
1822 switch (q_u->switch_value) {
1823 case 0x01:
1824
1825 account_policy_get(AP_MIN_PASSWORD_LEN, &account_policy_temp);
1826 min_pass_len = account_policy_temp;
1827
1828 account_policy_get(AP_PASSWORD_HISTORY, &account_policy_temp);
1829 pass_hist = account_policy_temp;
1830
1831 account_policy_get(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp);
1832 flag = account_policy_temp;
1833
1834 account_policy_get(AP_MAX_PASSWORD_AGE, &account_policy_temp);
1835 u_expire = account_policy_temp;
1836
1837 account_policy_get(AP_MIN_PASSWORD_AGE, &account_policy_temp);
1838 u_min_age = account_policy_temp;
1839
1840 unix_to_nt_time_abs(&nt_expire, u_expire);
1841 unix_to_nt_time_abs(&nt_min_age, u_min_age);
1842
1843 init_unk_info1(&ctr->info.inf1, (uint16)min_pass_len, (uint16)pass_hist,
1844 flag, nt_expire, nt_min_age);
1845 break;
1846 case 0x02:
1847 become_root();
1848 num_users=count_sam_users(&info->disp_info,
1849 ACB_NORMAL);
1850 num_groups=count_sam_groups(&info->disp_info);
1851 unbecome_root();
1852
1853 account_policy_get(AP_TIME_TO_LOGOUT, &account_policy_temp);
1854 u_logout = account_policy_temp;
1855
1856 unix_to_nt_time_abs(&nt_logout, u_logout);
1857
1858 server_role = ROLE_DOMAIN_PDC;
1859 if (lp_server_role() == ROLE_DOMAIN_BDC)
1860 server_role = ROLE_DOMAIN_BDC;
1861
1862 /* The time call below is to get a sequence number for the sam. FIXME !!! JRA. */
1863 init_unk_info2(&ctr->info.inf2, lp_serverstring(), lp_workgroup(), global_myname(), time(NULL),
1864 num_users, num_groups, num_aliases, nt_logout, server_role);
1865 break;
1866 case 0x03:
1867 account_policy_get(AP_TIME_TO_LOGOUT, (unsigned int *)&u_logout);
1868 unix_to_nt_time_abs(&nt_logout, u_logout);
1869
1870 init_unk_info3(&ctr->info.inf3, nt_logout);
1871 break;
1872 case 0x05:
1873 init_unk_info5(&ctr->info.inf5, global_myname());
1874 break;
1875 case 0x06:
1876 init_unk_info6(&ctr->info.inf6);
1877 break;
1878 case 0x07:
1879 server_role = ROLE_DOMAIN_PDC;
1880 if (lp_server_role() == ROLE_DOMAIN_BDC)
1881 server_role = ROLE_DOMAIN_BDC;
1882
1883 init_unk_info7(&ctr->info.inf7, server_role);
1884 break;
1885 case 0x08:
1886 init_unk_info8(&ctr->info.inf8, (uint32) time(NULL));
1887 break;
1888 case 0x0c:
1889 account_policy_get(AP_LOCK_ACCOUNT_DURATION, &account_policy_temp);
1890 u_lock_duration = account_policy_temp;
1891 if (u_lock_duration != -1)
1892 u_lock_duration *= 60;
1893
1894 account_policy_get(AP_RESET_COUNT_TIME, &account_policy_temp);
1895 u_reset_time = account_policy_temp * 60;
1896
1897 account_policy_get(AP_BAD_ATTEMPT_LOCKOUT, &account_policy_temp);
1898 lockout = account_policy_temp;
1899
1900 unix_to_nt_time_abs(&nt_lock_duration, u_lock_duration);
1901 unix_to_nt_time_abs(&nt_reset_time, u_reset_time);
1902
1903 init_unk_info12(&ctr->info.inf12, nt_lock_duration, nt_reset_time, (uint16)lockout);
1904 break;
1905 default:
1906 return NT_STATUS_INVALID_INFO_CLASS;
1907 }
1908
1909 init_samr_r_query_dom_info(r_u, q_u->switch_value, ctr, NT_STATUS_OK);
1910
1911 DEBUG(5,("_samr_query_dom_info: %d\n", __LINE__));
1912
1913 return r_u->status;
1914 }
1915
1916 /*******************************************************************
1917 _samr_create_user
1918 Create an account, can be either a normal user or a machine.
1919 This funcion will need to be updated for bdc/domain trusts.
1920 ********************************************************************/
1921
1922 NTSTATUS _samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_CREATE_USER *r_u)
1923 {
1924 SAM_ACCOUNT *sam_pass=NULL;
1925 fstring account;
1926 DOM_SID sid;
1927 pstring add_script;
1928 POLICY_HND dom_pol = q_u->domain_pol;
1929 UNISTR2 user_account = q_u->uni_name;
1930 uint16 acb_info = q_u->acb_info;
1931 POLICY_HND *user_pol = &r_u->user_pol;
1932 struct samr_info *info = NULL;
1933 BOOL ret;
1934 NTSTATUS nt_status;
1935 struct passwd *pw;
1936 uint32 acc_granted;
1937 SEC_DESC *psd;
1938 size_t sd_size;
1939 uint32 new_rid = 0;
1940 /* check this, when giving away 'add computer to domain' privs */
1941 uint32 des_access = GENERIC_RIGHTS_USER_ALL_ACCESS;
1942 BOOL can_add_account = False;
1943 SE_PRIV se_rights;
1944
1945 /* Get the domain SID stored in the domain policy */
1946 if (!get_lsa_policy_samr_sid(p, &dom_pol, &sid, &acc_granted))
1947 return NT_STATUS_INVALID_HANDLE;
1948
1949 if (!NT_STATUS_IS_OK(nt_status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_CREATE_USER, "_samr_create_user"))) {
1950 return nt_status;
1951 }
1952
1953 if (!(acb_info == ACB_NORMAL || acb_info == ACB_DOMTRUST || acb_info == ACB_WSTRUST || acb_info == ACB_SVRTRUST)) {
1954 /* Match Win2k, and return NT_STATUS_INVALID_PARAMETER if
1955 this parameter is not an account type */
1956 return NT_STATUS_INVALID_PARAMETER;
1957 }
1958
1959 rpcstr_pull(account, user_account.buffer, sizeof(account), user_account.uni_str_len*2, 0);
1960 strlower_m(account);
1961
1962 pdb_init_sam(&sam_pass);
1963
1964 become_root();
1965 ret = pdb_getsampwnam(sam_pass, account);
1966 unbecome_root();
1967 if (ret == True) {
1968 /* this account exists: say so */
1969 pdb_free_sam(&sam_pass);
1970 return NT_STATUS_USER_EXISTS;
1971 }
1972
1973 pdb_free_sam(&sam_pass);
1974
1975 /*********************************************************************
1976 * HEADS UP! If we have to create a new user account, we have to get
1977 * a new RID from somewhere. This used to be done by the passdb
1978 * backend. It has been moved into idmap now. Since idmap is now
1979 * wrapped up behind winbind, this means you have to run winbindd if you
1980 * want new accounts to get a new RID when "enable rid algorithm = no".
1981 * Tough. We now have a uniform way of allocating RIDs regardless
1982 * of what ever passdb backend people may use.
1983 * --jerry (2003-07-10)
1984 *********************************************************************/
1985
1986 pw = Get_Pwnam(account);
1987
1988 /* determine which user right we need to check based on the acb_info */
1989
1990 if ( acb_info & ACB_WSTRUST )
1991 {
1992 pstrcpy(add_script, lp_addmachine_script());
1993 se_priv_copy( &se_rights, &se_machine_account );
1994 can_add_account = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
1995 }
1996 /* usrmgr.exe (and net rpc trustdom grant) creates a normal user
1997 account for domain trusts and changes the ACB flags later */
1998 else if ( acb_info & ACB_NORMAL && (account[strlen(account)-1] != '$') )
1999 {
2000 pstrcpy(add_script, lp_adduser_script());
2001 se_priv_copy( &se_rights, &se_add_users );
2002 can_add_account = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
2003 }
2004 else /* implicit assumption of a BDC or domain trust account here (we already check the flags earlier) */
2005 {
2006 pstrcpy(add_script, lp_addmachine_script());
2007 if ( lp_enable_privileges() ) {
2008 /* only Domain Admins can add a BDC or domain trust */
2009 se_priv_copy( &se_rights, &se_priv_none );
2010 can_add_account = nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS );
2011 }
2012 }
2013
2014 DEBUG(5, ("_samr_create_user: %s can add this account : %s\n",
2015 p->pipe_user_name, can_add_account ? "True":"False" ));
2016
2017 /********** BEGIN Admin BLOCK **********/
2018
2019 if ( can_add_account )
2020 become_root();
2021
2022 if ( !pw ) {
2023 if (*add_script) {
2024 int add_ret;
2025
2026 all_string_sub(add_script, "%u", account, sizeof(add_script));
2027 add_ret = smbrun(add_script,NULL);
2028 DEBUG(add_ret ? 0 : 3,("_samr_create_user: Running the command `%s' gave %d\n", add_script, add_ret));
2029 }
2030 }
2031
2032 /* implicit call to getpwnam() next. we have a valid SID coming out of this call */
2033
2034 flush_pwnam_cache();
2035 nt_status = pdb_init_sam_new(&sam_pass, account, new_rid);
2036
2037 /* this code is order such that we have no unnecessary retuns
2038 out of the admin block of code */
2039
2040 if ( NT_STATUS_IS_OK(nt_status) ) {
2041 pdb_set_acct_ctrl(sam_pass, acb_info, PDB_CHANGED);
2042
2043 if ( !(ret = pdb_add_sam_account(sam_pass)) ) {
2044 pdb_free_sam(&sam_pass);
2045 DEBUG(0, ("could not add user/computer %s to passdb. Check permissions?\n",
2046 account));
2047 nt_status = NT_STATUS_ACCESS_DENIED;
2048 }
2049 }
2050
2051 if ( can_add_account )
2052 unbecome_root();
2053
2054 /********** END Admin BLOCK **********/
2055
2056 /* now check for failure */
2057
2058 if ( !NT_STATUS_IS_OK(nt_status) )
2059 return nt_status;
2060
2061 /* Get the user's SID */
2062
2063 sid_copy(&sid, pdb_get_user_sid(sam_pass));
2064
2065 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping, &sid, SAMR_USR_RIGHTS_WRITE_PW);
2066 se_map_generic(&des_access, &usr_generic_mapping);
2067
2068 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
2069 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
2070 &acc_granted, "_samr_create_user");
2071
2072 if ( !NT_STATUS_IS_OK(nt_status) ) {
2073 return nt_status;
2074 }
2075
2076 /* associate the user's SID with the new handle. */
2077 if ((info = get_samr_info_by_sid(&sid)) == NULL) {
2078 pdb_free_sam(&sam_pass);
2079 return NT_STATUS_NO_MEMORY;
2080 }
2081
2082 ZERO_STRUCTP(info);
2083 info->sid = sid;
2084 info->acc_granted = acc_granted;
2085
2086 /* get a (unique) handle. open a policy on it. */
2087 if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info)) {
2088 pdb_free_sam(&sam_pass);
2089 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2090 }
2091
2092 r_u->user_rid=pdb_get_user_rid(sam_pass);
2093
2094 r_u->access_granted = acc_granted;
2095
2096 pdb_free_sam(&sam_pass);
2097
2098 return NT_STATUS_OK;
2099 }
2100
2101 /*******************************************************************
2102 samr_reply_connect_anon
2103 ********************************************************************/
2104
2105 NTSTATUS _samr_connect_anon(pipes_struct *p, SAMR_Q_CONNECT_ANON *q_u, SAMR_R_CONNECT_ANON *r_u)
2106 {
2107 struct samr_info *info = NULL;
2108 uint32 des_access = q_u->access_mask;
2109
2110 /* Access check */
2111
2112 if (!pipe_access_check(p)) {
2113 DEBUG(3, ("access denied to samr_connect_anon\n"));
2114 r_u->status = NT_STATUS_ACCESS_DENIED;
2115 return r_u->status;
2116 }
2117
2118 /* set up the SAMR connect_anon response */
2119
2120 r_u->status = NT_STATUS_OK;
2121
2122 /* associate the user's SID with the new handle. */
2123 if ((info = get_samr_info_by_sid(NULL)) == NULL)
2124 return NT_STATUS_NO_MEMORY;
2125
2126 /* don't give away the farm but this is probably ok. The SA_RIGHT_SAM_ENUM_DOMAINS
2127 was observed from a win98 client trying to enumerate users (when configured
2128 user level access control on shares) --jerry */
2129
2130 se_map_generic( &des_access, &sam_generic_mapping );
2131 info->acc_granted = des_access & (SA_RIGHT_SAM_ENUM_DOMAINS|SA_RIGHT_SAM_OPEN_DOMAIN);
2132
2133 info->status = q_u->unknown_0;
2134
2135 /* get a (unique) handle. open a policy on it. */
2136 if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
2137 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2138
2139 return r_u->status;
2140 }
2141
2142 /*******************************************************************
2143 samr_reply_connect
2144 ********************************************************************/
2145
2146 NTSTATUS _samr_connect(pipes_struct *p, SAMR_Q_CONNECT *q_u, SAMR_R_CONNECT *r_u)
2147 {
2148 struct samr_info *info = NULL;
2149 SEC_DESC *psd = NULL;
2150 uint32 acc_granted;
2151 uint32 des_access = q_u->access_mask;
2152 NTSTATUS nt_status;
2153 size_t sd_size;
2154
2155
2156 DEBUG(5,("_samr_connect: %d\n", __LINE__));
2157
2158 /* Access check */
2159
2160 if (!pipe_access_check(p)) {
2161 DEBUG(3, ("access denied to samr_connect\n"));
2162 r_u->status = NT_STATUS_ACCESS_DENIED;
2163 return r_u->status;
2164 }
2165
2166 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
2167 se_map_generic(&des_access, &sam_generic_mapping);
2168
2169 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
2170 NULL, 0, des_access, &acc_granted, "_samr_connect");
2171
2172 if ( !NT_STATUS_IS_OK(nt_status) )
2173 return nt_status;
2174
2175 r_u->status = NT_STATUS_OK;
2176
2177 /* associate the user's SID and access granted with the new handle. */
2178 if ((info = get_samr_info_by_sid(NULL)) == NULL)
2179 return NT_STATUS_NO_MEMORY;
2180
2181 info->acc_granted = acc_granted;
2182 info->status = q_u->access_mask;
2183
2184 /* get a (unique) handle. open a policy on it. */
2185 if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
2186 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2187
2188 DEBUG(5,("_samr_connect: %d\n", __LINE__));
2189
2190 return r_u->status;
2191 }
2192
2193 /*******************************************************************
2194 samr_connect4
2195 ********************************************************************/
2196
2197 NTSTATUS _samr_connect4(pipes_struct *p, SAMR_Q_CONNECT4 *q_u, SAMR_R_CONNECT4 *r_u)
2198 {
2199 struct samr_info *info = NULL;
2200 SEC_DESC *psd = NULL;
2201 uint32 acc_granted;
2202 uint32 des_access = q_u->access_mask;
2203 NTSTATUS nt_status;
2204 size_t sd_size;
2205
2206
2207 DEBUG(5,("_samr_connect4: %d\n", __LINE__));
2208
2209 /* Access check */
2210
2211 if (!pipe_access_check(p)) {
2212 DEBUG(3, ("access denied to samr_connect4\n"));
2213 r_u->status = NT_STATUS_ACCESS_DENIED;
2214 return r_u->status;
2215 }
2216
2217 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
2218 se_map_generic(&des_access, &sam_generic_mapping);
2219
2220 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
2221 NULL, 0, des_access, &acc_granted, "_samr_connect4");
2222
2223 if ( !NT_STATUS_IS_OK(nt_status) )
2224 return nt_status;
2225
2226 r_u->status = NT_STATUS_OK;
2227
2228 /* associate the user's SID and access granted with the new handle. */
2229 if ((info = get_samr_info_by_sid(NULL)) == NULL)
2230 return NT_STATUS_NO_MEMORY;
2231
2232 info->acc_granted = acc_granted;
2233 info->status = q_u->access_mask;
2234
2235 /* get a (unique) handle. open a policy on it. */
2236 if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
2237 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2238
2239 DEBUG(5,("_samr_connect: %d\n", __LINE__));
2240
2241 return r_u->status;
2242 }
2243
2244 /**********************************************************************
2245 api_samr_lookup_domain
2246 **********************************************************************/
2247
2248 NTSTATUS _samr_lookup_domain(pipes_struct *p, SAMR_Q_LOOKUP_DOMAIN *q_u, SAMR_R_LOOKUP_DOMAIN *r_u)
2249 {
2250 struct samr_info *info;
2251 fstring domain_name;
2252 DOM_SID sid;
2253
2254 r_u->status = NT_STATUS_OK;
2255
2256 if (!find_policy_by_hnd(p, &q_u->connect_pol, (void**)&info))
2257 return NT_STATUS_INVALID_HANDLE;
2258
2259 /* win9x user manager likes to use SA_RIGHT_SAM_ENUM_DOMAINS here.
2260 Reverted that change so we will work with RAS servers again */
2261
2262 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted,
2263 SA_RIGHT_SAM_OPEN_DOMAIN, "_samr_lookup_domain")))
2264 {
2265 return r_u->status;
2266 }
2267
2268 rpcstr_pull(domain_name, q_u->uni_domain.buffer, sizeof(domain_name), q_u->uni_domain.uni_str_len*2, 0);
2269
2270 ZERO_STRUCT(sid);
2271
2272 if (!secrets_fetch_domain_sid(domain_name, &sid)) {
2273 r_u->status = NT_STATUS_NO_SUCH_DOMAIN;
2274 }
2275
2276 DEBUG(2,("Returning domain sid for domain %s -> %s\n", domain_name, sid_string_static(&sid)));
2277
2278 init_samr_r_lookup_domain(r_u, &sid, r_u->status);
2279
2280 return r_u->status;
2281 }
2282
2283 /******************************************************************
2284 makes a SAMR_R_ENUM_DOMAINS structure.
2285 ********************************************************************/
2286
2287 static BOOL make_enum_domains(TALLOC_CTX *ctx, SAM_ENTRY **pp_sam,
2288 UNISTR2 **pp_uni_name, uint32 num_sam_entries, fstring doms[])
2289 {
2290 uint32 i;
2291 SAM_ENTRY *sam;
2292 UNISTR2 *uni_name;
2293
2294 DEBUG(5, ("make_enum_domains\n"));
2295
2296 *pp_sam = NULL;
2297 *pp_uni_name = NULL;
2298
2299 if (num_sam_entries == 0)
2300 return True;
2301
2302 sam = TALLOC_ZERO_ARRAY(ctx, SAM_ENTRY, num_sam_entries);
2303 uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_sam_entries);
2304
2305 if (sam == NULL || uni_name == NULL)
2306 return False;
2307
2308 for (i = 0; i < num_sam_entries; i++) {
2309 init_unistr2(&uni_name[i], doms[i], UNI_FLAGS_NONE);
2310 init_sam_entry(&sam[i], &uni_name[i], 0);
2311 }
2312
2313 *pp_sam = sam;
2314 *pp_uni_name = uni_name;
2315
2316 return True;
2317 }
2318
2319 /**********************************************************************
2320 api_samr_enum_domains
2321 **********************************************************************/
2322
2323 NTSTATUS _samr_enum_domains(pipes_struct *p, SAMR_Q_ENUM_DOMAINS *q_u, SAMR_R_ENUM_DOMAINS *r_u)
2324 {
2325 struct samr_info *info;
2326 uint32 num_entries = 2;
2327 fstring dom[2];
2328 const char *name;
2329
2330 r_u->status = NT_STATUS_OK;
2331
2332 if (!find_policy_by_hnd(p, &q_u->pol, (void**)&info))
2333 return NT_STATUS_INVALID_HANDLE;
2334
2335 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted, SA_RIGHT_SAM_ENUM_DOMAINS, "_samr_enum_domains"))) {
2336 return r_u->status;
2337 }
2338
2339 name = get_global_sam_name();
2340
2341 fstrcpy(dom[0],name);
2342 strupper_m(dom[0]);
2343 fstrcpy(dom[1],"Builtin");
2344
2345 if (!make_enum_domains(p->mem_ctx, &r_u->sam, &r_u->uni_dom_name, num_entries, dom))
2346 return NT_STATUS_NO_MEMORY;
2347
2348 init_samr_r_enum_domains(r_u, q_u->start_idx + num_entries, num_entries);
2349
2350 return r_u->status;
2351 }
2352
2353 /*******************************************************************
2354 api_samr_open_alias
2355 ********************************************************************/
2356
2357 NTSTATUS _samr_open_alias(pipes_struct *p, SAMR_Q_OPEN_ALIAS *q_u, SAMR_R_OPEN_ALIAS *r_u)
2358 {
2359 DOM_SID sid;
2360 POLICY_HND domain_pol = q_u->dom_pol;
2361 uint32 alias_rid = q_u->rid_alias;
2362 POLICY_HND *alias_pol = &r_u->pol;
2363 struct samr_info *info = NULL;
2364 SEC_DESC *psd = NULL;
2365 uint32 acc_granted;
2366 uint32 des_access = q_u->access_mask;
2367 size_t sd_size;
2368 NTSTATUS status;
2369 SE_PRIV se_rights;
2370
2371 r_u->status = NT_STATUS_OK;
2372
2373 /* find the domain policy and get the SID / access bits stored in the domain policy */
2374
2375 if ( !get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted) )
2376 return NT_STATUS_INVALID_HANDLE;
2377
2378 status = access_check_samr_function(acc_granted,
2379 SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_open_alias");
2380
2381 if ( !NT_STATUS_IS_OK(status) )
2382 return status;
2383
2384 /* append the alias' RID to it */
2385
2386 if (!sid_append_rid(&sid, alias_rid))
2387 return NT_STATUS_NO_SUCH_USER;
2388
2389 /*check if access can be granted as requested by client. */
2390
2391 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &ali_generic_mapping, NULL, 0);
2392 se_map_generic(&des_access,&ali_generic_mapping);
2393
2394 se_priv_copy( &se_rights, &se_add_users );
2395
2396
2397 status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
2398 &se_rights, GENERIC_RIGHTS_ALIAS_WRITE, des_access,
2399 &acc_granted, "_samr_open_alias");
2400
2401 if ( !NT_STATUS_IS_OK(status) )
2402 return status;
2403
2404 /*
2405 * we should check if the rid really exist !!!
2406 * JFM.
2407 */
2408
2409 /* associate the user's SID with the new handle. */
2410 if ((info = get_samr_info_by_sid(&sid)) == NULL)
2411 return NT_STATUS_NO_MEMORY;
2412
2413 info->acc_granted = acc_granted;
2414
2415 /* get a (unique) handle. open a policy on it. */
2416 if (!create_policy_hnd(p, alias_pol, free_samr_info, (void *)info))
2417 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2418
2419 return r_u->status;
2420 }
2421
2422 /*******************************************************************
2423 set_user_info_16
2424 ********************************************************************/
2425
2426 static BOOL set_user_info_16(const SAM_USER_INFO_16 *id16, SAM_ACCOUNT *pwd)
2427 {
2428 if (id16 == NULL) {
2429 DEBUG(5, ("set_user_info_16: NULL id16\n"));
2430 pdb_free_sam(&pwd);
2431 return False;
2432 }
2433
2434 /* FIX ME: check if the value is really changed --metze */
2435 if (!pdb_set_acct_ctrl(pwd, id16->acb_info, PDB_CHANGED)) {
2436 pdb_free_sam(&pwd);
2437 return False;
2438 }
2439
2440 if(!pdb_update_sam_account(pwd)) {
2441 pdb_free_sam(&pwd);
2442 return False;
2443 }
2444
2445 pdb_free_sam(&pwd);
2446
2447 return True;
2448 }
2449
2450 /*******************************************************************
2451 set_user_info_18
2452 ********************************************************************/
2453
2454 static BOOL set_user_info_18(SAM_USER_INFO_18 *id18, SAM_ACCOUNT *pwd)
2455 {
2456
2457 if (id18 == NULL) {
2458 DEBUG(2, ("set_user_info_18: id18 is NULL\n"));
2459 pdb_free_sam(&pwd);
2460 return False;
2461 }
2462
2463 if (!pdb_set_lanman_passwd (pwd, id18->lm_pwd, PDB_CHANGED)) {
2464 pdb_free_sam(&pwd);
2465 return False;
2466 }
2467 if (!pdb_set_nt_passwd (pwd, id18->nt_pwd, PDB_CHANGED)) {
2468 pdb_free_sam(&pwd);
2469 return False;
2470 }
2471 if (!pdb_set_pass_changed_now (pwd)) {
2472 pdb_free_sam(&pwd);
2473 return False;
2474 }
2475
2476 if(!pdb_update_sam_account(pwd)) {
2477 pdb_free_sam(&pwd);
2478 return False;
2479 }
2480
2481 pdb_free_sam(&pwd);
2482 return True;
2483 }
2484
2485 /*******************************************************************
2486 The GROUPSID field in the SAM_ACCOUNT changed. Try to tell unix.
2487 ********************************************************************/
2488 static BOOL set_unix_primary_group(SAM_ACCOUNT *sampass)
2489 {
2490 struct group *grp;
2491 gid_t gid;
2492
2493 if (!NT_STATUS_IS_OK(sid_to_gid(pdb_get_group_sid(sampass),
2494 &gid))) {
2495 DEBUG(2,("Could not get gid for primary group of "
2496 "user %s\n", pdb_get_username(sampass)));
2497 return False;
2498 }
2499
2500 grp = getgrgid(gid);
2501
2502 if (grp == NULL) {
2503 DEBUG(2,("Could not find primary group %lu for "
2504 "user %s\n", (unsigned long)gid,
2505 pdb_get_username(sampass)));
2506 return False;
2507 }
2508
2509 if (smb_set_primary_group(grp->gr_name,
2510 pdb_get_username(sampass)) != 0) {
2511 DEBUG(2,("Could not set primary group for user %s to "
2512 "%s\n",
2513 pdb_get_username(sampass), grp->gr_name));
2514 return False;
2515 }
2516
2517 return True;
2518 }
2519
2520
2521 /*******************************************************************
2522 set_user_info_20
2523 ********************************************************************/
2524
2525 static BOOL set_user_info_20(SAM_USER_INFO_20 *id20, SAM_ACCOUNT *pwd)
2526 {
2527 if (id20 == NULL) {
2528 DEBUG(5, ("set_user_info_20: NULL id20\n"));
2529 return False;
2530 }
2531
2532 copy_id20_to_sam_passwd(pwd, id20);
2533
2534 /* write the change out */
2535 if(!pdb_update_sam_account(pwd)) {
2536 pdb_free_sam(&pwd);
2537 return False;
2538 }
2539
2540 pdb_free_sam(&pwd);
2541
2542 return True;
2543 }
2544 /*******************************************************************
2545 set_user_info_21
2546 ********************************************************************/
2547
2548 static BOOL set_user_info_21(SAM_USER_INFO_21 *id21, SAM_ACCOUNT *pwd)
2549 {
2550
2551 if (id21 == NULL) {
2552 DEBUG(5, ("set_user_info_21: NULL id21\n"));
2553 return False;
2554 }
2555
2556 copy_id21_to_sam_passwd(pwd, id21);
2557
2558 /*
2559 * The funny part about the previous two calls is
2560 * that pwd still has the password hashes from the
2561 * passdb entry. These have not been updated from
2562 * id21. I don't know if they need to be set. --jerry
2563 */
2564
2565 if (IS_SAM_CHANGED(pwd, PDB_GROUPSID))
2566 set_unix_primary_group(pwd);
2567
2568 /* write the change out */
2569 if(!pdb_update_sam_account(pwd)) {
2570 pdb_free_sam(&pwd);
2571 return False;
2572 }
2573
2574 pdb_free_sam(&pwd);
2575
2576 return True;
2577 }
2578
2579 /*******************************************************************
2580 set_user_info_23
2581 ********************************************************************/
2582
2583 static BOOL set_user_info_23(SAM_USER_INFO_23 *id23, SAM_ACCOUNT *pwd)
2584 {
2585 pstring plaintext_buf;
2586 uint32 len;
2587 uint16 acct_ctrl;
2588
2589 if (id23 == NULL) {
2590 DEBUG(5, ("set_user_info_23: NULL id23\n"));
2591 return False;
2592 }
2593
2594 DEBUG(5, ("Attempting administrator password change (level 23) for user %s\n",
2595 pdb_get_username(pwd)));
2596
2597 acct_ctrl = pdb_get_acct_ctrl(pwd);
2598
2599 if (!decode_pw_buffer(id23->pass, plaintext_buf, 256, &len, STR_UNICODE)) {
2600 pdb_free_sam(&pwd);
2601 return False;
2602 }
2603
2604 if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
2605 pdb_free_sam(&pwd);
2606 return False;
2607 }
2608
2609 copy_id23_to_sam_passwd(pwd, id23);
2610
2611 /* if it's a trust account, don't update /etc/passwd */
2612 if ( ( (acct_ctrl & ACB_DOMTRUST) == ACB_DOMTRUST ) ||
2613 ( (acct_ctrl & ACB_WSTRUST) == ACB_WSTRUST) ||
2614 ( (acct_ctrl & ACB_SVRTRUST) == ACB_SVRTRUST) ) {
2615 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
2616 } else {
2617 /* update the UNIX password */
2618 if (lp_unix_password_sync() ) {
2619 struct passwd *passwd = Get_Pwnam(pdb_get_username(pwd));
2620 if (!passwd) {
2621 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
2622 }
2623
2624 if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
2625 pdb_free_sam(&pwd);
2626 return False;
2627 }
2628 }
2629 }
2630
2631 ZERO_STRUCT(plaintext_buf);
2632
2633 if (IS_SAM_CHANGED(pwd, PDB_GROUPSID))
2634 set_unix_primary_group(pwd);
2635
2636 if(!pdb_update_sam_account(pwd)) {
2637 pdb_free_sam(&pwd);
2638 return False;
2639 }
2640
2641 pdb_free_sam(&pwd);
2642
2643 return True;
2644 }
2645
2646 /*******************************************************************
2647 set_user_info_pw
2648 ********************************************************************/
2649
2650 static BOOL set_user_info_pw(uint8 *pass, SAM_ACCOUNT *pwd)
2651 {
2652 uint32 len;
2653 pstring plaintext_buf;
2654 uint16 acct_ctrl;
2655
2656 DEBUG(5, ("Attempting administrator password change for user %s\n",
2657 pdb_get_username(pwd)));
2658
2659 acct_ctrl = pdb_get_acct_ctrl(pwd);
2660
2661 ZERO_STRUCT(plaintext_buf);
2662
2663 if (!decode_pw_buffer(pass, plaintext_buf, 256, &len, STR_UNICODE)) {
2664 pdb_free_sam(&pwd);
2665 return False;
2666 }
2667
2668 if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
2669 pdb_free_sam(&pwd);
2670 return False;
2671 }
2672
2673 /* if it's a trust account, don't update /etc/passwd */
2674 if ( ( (acct_ctrl & ACB_DOMTRUST) == ACB_DOMTRUST ) ||
2675 ( (acct_ctrl & ACB_WSTRUST) == ACB_WSTRUST) ||
2676 ( (acct_ctrl & ACB_SVRTRUST) == ACB_SVRTRUST) ) {
2677 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
2678 } else {
2679 /* update the UNIX password */
2680 if (lp_unix_password_sync()) {
2681 struct passwd *passwd = Get_Pwnam(pdb_get_username(pwd));
2682 if (!passwd) {
2683 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
2684 }
2685
2686 if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
2687 pdb_free_sam(&pwd);
2688 return False;
2689 }
2690 }
2691 }
2692
2693 ZERO_STRUCT(plaintext_buf);
2694
2695 DEBUG(5,("set_user_info_pw: pdb_update_pwd()\n"));
2696
2697 /* update the SAMBA password */
2698 if(!pdb_update_sam_account(pwd)) {
2699 pdb_free_sam(&pwd);
2700 return False;
2701 }
2702
2703 pdb_free_sam(&pwd);
2704
2705 return True;
2706 }
2707
2708 /*******************************************************************
2709 samr_reply_set_userinfo
2710 ********************************************************************/
2711
2712 NTSTATUS _samr_set_userinfo(pipes_struct *p, SAMR_Q_SET_USERINFO *q_u, SAMR_R_SET_USERINFO *r_u)
2713 {
2714 SAM_ACCOUNT *pwd = NULL;
2715 DOM_SID sid;
2716 POLICY_HND *pol = &q_u->pol;
2717 uint16 switch_value = q_u->switch_value;
2718 SAM_USERINFO_CTR *ctr = q_u->ctr;
2719 uint32 acc_granted;
2720 uint32 acc_required;
2721 BOOL ret;
2722 BOOL has_enough_rights = False;
2723 uint32 acb_info;
2724
2725 DEBUG(5, ("_samr_set_userinfo: %d\n", __LINE__));
2726
2727 r_u->status = NT_STATUS_OK;
2728
2729 /* find the policy handle. open a policy on it. */
2730 if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted))
2731 return NT_STATUS_INVALID_HANDLE;
2732
2733 /* observed when joining an XP client to a Samba domain */
2734
2735 acc_required = SA_RIGHT_USER_SET_PASSWORD | SA_RIGHT_USER_SET_ATTRIBUTES | SA_RIGHT_USER_ACCT_FLAGS_EXPIRY;
2736
2737 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, acc_required, "_samr_set_userinfo"))) {
2738 return r_u->status;
2739 }
2740
2741 DEBUG(5, ("_samr_set_userinfo: sid:%s, level:%d\n", sid_string_static(&sid), switch_value));
2742
2743 if (ctr == NULL) {
2744 DEBUG(5, ("_samr_set_userinfo: NULL info level\n"));
2745 return NT_STATUS_INVALID_INFO_CLASS;
2746 }
2747
2748 pdb_init_sam(&pwd);
2749
2750 become_root();
2751 ret = pdb_getsampwsid(pwd, &sid);
2752 unbecome_root();
2753
2754 if ( !ret ) {
2755 pdb_free_sam(&pwd);
2756 return NT_STATUS_NO_SUCH_USER;
2757 }
2758
2759 /* deal with machine password changes differently from userinfo changes */
2760 /* check to see if we have the sufficient rights */
2761
2762 acb_info = pdb_get_acct_ctrl(pwd);
2763 if ( acb_info & ACB_WSTRUST )
2764 has_enough_rights = user_has_privileges( p->pipe_user.nt_user_token, &se_machine_account);
2765 else if ( acb_info & ACB_NORMAL )
2766 has_enough_rights = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
2767 else if ( acb_info & (ACB_SVRTRUST|ACB_DOMTRUST) ) {
2768 if ( lp_enable_privileges() )
2769 has_enough_rights = nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS );
2770 }
2771
2772 DEBUG(5, ("_samr_set_userinfo: %s does%s possess sufficient rights\n",
2773 p->pipe_user_name, has_enough_rights ? "" : " not"));
2774
2775 /* ================ BEGIN SeMachineAccountPrivilege BLOCK ================ */
2776
2777 if ( has_enough_rights )
2778 become_root();
2779
2780 /* ok! user info levels (lots: see MSDEV help), off we go... */
2781
2782 switch (switch_value) {
2783 case 18:
2784 if (!set_user_info_18(ctr->info.id18, pwd))
2785 r_u->status = NT_STATUS_ACCESS_DENIED;
2786 break;
2787
2788 case 24:
2789 if (!p->session_key.length) {
2790 r_u->status = NT_STATUS_NO_USER_SESSION_KEY;
2791 }
2792 SamOEMhashBlob(ctr->info.id24->pass, 516, &p->session_key);
2793
2794 dump_data(100, (char *)ctr->info.id24->pass, 516);
2795
2796 if (!set_user_info_pw(ctr->info.id24->pass, pwd))
2797 r_u->status = NT_STATUS_ACCESS_DENIED;
2798 break;
2799
2800 case 25:
2801 #if 0
2802 /*
2803 * Currently we don't really know how to unmarshall
2804 * the level 25 struct, and the password encryption
2805 * is different. This is a placeholder for when we
2806 * do understand it. In the meantime just return INVALID
2807 * info level and W2K SP2 drops down to level 23... JRA.
2808 */
2809
2810 if (!p->session_key.length) {
2811 r_u->status = NT_STATUS_NO_USER_SESSION_KEY;
2812 }
2813 SamOEMhashBlob(ctr->info.id25->pass, 532, &p->session_key);
2814
2815 dump_data(100, (char *)ctr->info.id25->pass, 532);
2816
2817 if (!set_user_info_pw(ctr->info.id25->pass, &sid))
2818 r_u->status = NT_STATUS_ACCESS_DENIED;
2819 break;
2820 #endif
2821 r_u->status = NT_STATUS_INVALID_INFO_CLASS;
2822 break;
2823
2824 case 23:
2825 if (!p->session_key.length) {
2826 r_u->status = NT_STATUS_NO_USER_SESSION_KEY;
2827 }
2828 SamOEMhashBlob(ctr->info.id23->pass, 516, &p->session_key);
2829
2830 dump_data(100, (char *)ctr->info.id23->pass, 516);
2831
2832 if (!set_user_info_23(ctr->info.id23, pwd))
2833 r_u->status = NT_STATUS_ACCESS_DENIED;
2834 break;
2835
2836 default:
2837 r_u->status = NT_STATUS_INVALID_INFO_CLASS;
2838 }
2839
2840
2841 if ( has_enough_rights )
2842 unbecome_root();
2843
2844 /* ================ END SeMachineAccountPrivilege BLOCK ================ */
2845
2846 return r_u->status;
2847 }
2848
2849 /*******************************************************************
2850 samr_reply_set_userinfo2
2851 ********************************************************************/
2852
2853 NTSTATUS _samr_set_userinfo2(pipes_struct *p, SAMR_Q_SET_USERINFO2 *q_u, SAMR_R_SET_USERINFO2 *r_u)
2854 {
2855 SAM_ACCOUNT *pwd = NULL;
2856 DOM_SID sid;
2857 SAM_USERINFO_CTR *ctr = q_u->ctr;
2858 POLICY_HND *pol = &q_u->pol;
2859 uint16 switch_value = q_u->switch_value;
2860 uint32 acc_granted;
2861 uint32 acc_required;
2862 BOOL ret;
2863 BOOL has_enough_rights = False;
2864 uint32 acb_info;
2865
2866 DEBUG(5, ("samr_reply_set_userinfo2: %d\n", __LINE__));
2867
2868 r_u->status = NT_STATUS_OK;
2869
2870 /* find the policy handle. open a policy on it. */
2871 if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted))
2872 return NT_STATUS_INVALID_HANDLE;
2873
2874 /* observed when joining XP client to Samba domain */
2875
2876 acc_required = SA_RIGHT_USER_SET_PASSWORD | SA_RIGHT_USER_SET_ATTRIBUTES | SA_RIGHT_USER_ACCT_FLAGS_EXPIRY;
2877
2878 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, acc_required, "_samr_set_userinfo2"))) {
2879 return r_u->status;
2880 }
2881
2882 DEBUG(5, ("samr_reply_set_userinfo2: sid:%s\n", sid_string_static(&sid)));
2883
2884 if (ctr == NULL) {
2885 DEBUG(5, ("samr_reply_set_userinfo2: NULL info level\n"));
2886 return NT_STATUS_INVALID_INFO_CLASS;
2887 }
2888
2889 switch_value=ctr->switch_value;
2890
2891 pdb_init_sam(&pwd);
2892
2893 become_root();
2894 ret = pdb_getsampwsid(pwd, &sid);
2895 unbecome_root();
2896
2897 if ( !ret ) {
2898 pdb_free_sam(&pwd);
2899 return NT_STATUS_NO_SUCH_USER;
2900 }
2901
2902 acb_info = pdb_get_acct_ctrl(pwd);
2903 if ( acb_info & ACB_WSTRUST )
2904 has_enough_rights = user_has_privileges( p->pipe_user.nt_user_token, &se_machine_account);
2905 else if ( acb_info & ACB_NORMAL )
2906 has_enough_rights = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
2907 else if ( acb_info & (ACB_SVRTRUST|ACB_DOMTRUST) ) {
2908 if ( lp_enable_privileges() )
2909 has_enough_rights = nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS );
2910 }
2911
2912 DEBUG(5, ("_samr_set_userinfo: %s does%s possess sufficient rights\n",
2913 p->pipe_user_name, has_enough_rights ? "" : " not"));
2914
2915 /* ================ BEGIN SeMachineAccountPrivilege BLOCK ================ */
2916
2917 if ( has_enough_rights )
2918 become_root();
2919
2920 /* ok! user info levels (lots: see MSDEV help), off we go... */
2921
2922 switch (switch_value) {
2923 case 16:
2924 if (!set_user_info_16(ctr->info.id16, pwd))
2925 r_u->status = NT_STATUS_ACCESS_DENIED;
2926 break;
2927 case 18:
2928 /* Used by AS/U JRA. */
2929 if (!set_user_info_18(ctr->info.id18, pwd))
2930 r_u->status = NT_STATUS_ACCESS_DENIED;
2931 break;
2932 case 20:
2933 if (!set_user_info_20(ctr->info.id20, pwd))
2934 r_u->status = NT_STATUS_ACCESS_DENIED;
2935 break;
2936 case 21:
2937 if (!set_user_info_21(ctr->info.id21, pwd))
2938 return NT_STATUS_ACCESS_DENIED;
2939 break;
2940 default:
2941 r_u->status = NT_STATUS_INVALID_INFO_CLASS;
2942 }
2943
2944 if ( has_enough_rights )
2945 unbecome_root();
2946
2947 /* ================ END SeMachineAccountPrivilege BLOCK ================ */
2948
2949 return r_u->status;
2950 }
2951
2952 /*********************************************************************
2953 _samr_query_aliasmem
2954 *********************************************************************/
2955
2956 NTSTATUS _samr_query_useraliases(pipes_struct *p, SAMR_Q_QUERY_USERALIASES *q_u, SAMR_R_QUERY_USERALIASES *r_u)
2957 {
2958 int num_alias_rids;
2959 uint32 *alias_rids;
2960 struct samr_info *info = NULL;
2961 int i;
2962
2963 NTSTATUS ntstatus1;
2964 NTSTATUS ntstatus2;
2965
2966 DOM_SID *members;
2967 BOOL res;
2968
2969 r_u->status = NT_STATUS_OK;
2970
2971 DEBUG(5,("_samr_query_useraliases: %d\n", __LINE__));
2972
2973 /* find the policy handle. open a policy on it. */
2974 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
2975 return NT_STATUS_INVALID_HANDLE;
2976
2977 ntstatus1 = access_check_samr_function(info->acc_granted, SA_RIGHT_DOMAIN_LOOKUP_ALIAS_BY_MEM, "_samr_query_useraliases");
2978 ntstatus2 = access_check_samr_function(info->acc_granted, SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_query_useraliases");
2979
2980 if (!NT_STATUS_IS_OK(ntstatus1) || !NT_STATUS_IS_OK(ntstatus2)) {
2981 if (!(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus2)) &&
2982 !(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus1))) {
2983 return (NT_STATUS_IS_OK(ntstatus1)) ? ntstatus2 : ntstatus1;
2984 }
2985 }
2986
2987 if (!sid_check_is_domain(&info->sid) &&
2988 !sid_check_is_builtin(&info->sid))
2989 return NT_STATUS_OBJECT_TYPE_MISMATCH;
2990
2991 members = TALLOC_ARRAY(p->mem_ctx, DOM_SID, q_u->num_sids1);
2992
2993 if (members == NULL)
2994 return NT_STATUS_NO_MEMORY;
2995
2996 for (i=0; i<q_u->num_sids1; i++)
2997 sid_copy(&members[i], &q_u->sid[i].sid);
2998
2999 alias_rids = NULL;
3000 num_alias_rids = 0;
3001
3002 become_root();
3003 res = pdb_enum_alias_memberships(p->mem_ctx, &info->sid, members,
3004 q_u->num_sids1,
3005 &alias_rids, &num_alias_rids);
3006 unbecome_root();
3007
3008 if (!res)
3009 return NT_STATUS_UNSUCCESSFUL;
3010
3011 init_samr_r_query_useraliases(r_u, num_alias_rids, alias_rids,
3012 NT_STATUS_OK);
3013 return NT_STATUS_OK;
3014 }
3015
3016 /*********************************************************************
3017 _samr_query_aliasmem
3018 *********************************************************************/
3019
3020 NTSTATUS _samr_query_aliasmem(pipes_struct *p, SAMR_Q_QUERY_ALIASMEM *q_u, SAMR_R_QUERY_ALIASMEM *r_u)
3021 {
3022 int i;
3023
3024 int num_sids = 0;
3025 DOM_SID2 *sid;
3026 DOM_SID *sids=NULL;
3027
3028 DOM_SID alias_sid;
3029
3030 uint32 acc_granted;
3031
3032 /* find the policy handle. open a policy on it. */
3033 if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
3034 return NT_STATUS_INVALID_HANDLE;
3035
3036 if (!NT_STATUS_IS_OK(r_u->status =
3037 access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_GET_MEMBERS, "_samr_query_aliasmem"))) {
3038 return r_u->status;
3039 }
3040
3041 DEBUG(10, ("sid is %s\n", sid_string_static(&alias_sid)));
3042
3043 if (!pdb_enum_aliasmem(&alias_sid, &sids, &num_sids))
3044 return NT_STATUS_NO_SUCH_ALIAS;
3045
3046 sid = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_SID2, num_sids);
3047 if (num_sids!=0 && sid == NULL) {
3048 SAFE_FREE(sids);
3049 return NT_STATUS_NO_MEMORY;
3050 }
3051
3052 for (i = 0; i < num_sids; i++) {
3053 init_dom_sid2(&sid[i], &sids[i]);
3054 }
3055
3056 init_samr_r_query_aliasmem(r_u, num_sids, sid, NT_STATUS_OK);
3057
3058 SAFE_FREE(sids);
3059
3060 return NT_STATUS_OK;
3061 }
3062
3063 static void add_uid_to_array_unique(uid_t uid, uid_t **uids, int *num)
3064 {
3065 int i;
3066
3067 for (i=0; i<*num; i++) {
3068 if ((*uids)[i] == uid)
3069 return;
3070 }
3071
3072 *uids = SMB_REALLOC_ARRAY(*uids, uid_t, *num+1);
3073
3074 if (*uids == NULL)
3075 return;
3076
3077 (*uids)[*num] = uid;
3078 *num += 1;
3079 }
3080
3081
3082 static BOOL get_memberuids(gid_t gid, uid_t **uids, int *num)
3083 {
3084 struct group *grp;
3085 char **gr;
3086 struct sys_pwent *userlist, *user;
3087
3088 *uids = NULL;
3089 *num = 0;
3090
3091 /* We only look at our own sam, so don't care about imported stuff */
3092
3093 winbind_off();
3094
3095 if ((grp = getgrgid(gid)) == NULL) {
3096 winbind_on();
3097 return False;
3098 }
3099
3100 /* Primary group members */
3101
3102 userlist = getpwent_list();
3103
3104 for (user = userlist; user != NULL; user = user->next) {
3105 if (user->pw_gid != gid)
3106 continue;
3107 add_uid_to_array_unique(user->pw_uid, uids, num);
3108 }
3109
3110 pwent_free(userlist);
3111
3112 /* Secondary group members */
3113
3114 for (gr = grp->gr_mem; (*gr != NULL) && ((*gr)[0] != '\0'); gr += 1) {
3115 struct passwd *pw = getpwnam(*gr);
3116
3117 if (pw == NULL)
3118 continue;
3119 add_uid_to_array_unique(pw->pw_uid, uids, num);
3120 }
3121
3122 winbind_on();
3123
3124 return True;
3125 }
3126
3127 /*********************************************************************
3128 _samr_query_groupmem
3129 *********************************************************************/
3130
3131 NTSTATUS _samr_query_groupmem(pipes_struct *p, SAMR_Q_QUERY_GROUPMEM *q_u, SAMR_R_QUERY_GROUPMEM *r_u)
3132 {
3133 DOM_SID group_sid;
3134 fstring group_sid_str;
3135 int i, num_members;
3136
3137 uint32 *rid=NULL;
3138 uint32 *attr=NULL;
3139
3140 uint32 acc_granted;
3141
3142 NTSTATUS result;
3143
3144 /* find the policy handle. open a policy on it. */
3145 if (!get_lsa_policy_samr_sid(p, &q_u->group_pol, &group_sid, &acc_granted))
3146 return NT_STATUS_INVALID_HANDLE;
3147
3148 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_GET_MEMBERS, "_samr_query_groupmem"))) {
3149 return r_u->status;
3150 }
3151
3152 sid_to_string(group_sid_str, &group_sid);
3153 DEBUG(10, ("sid is %s\n", group_sid_str));
3154
3155 if (!sid_check_is_in_our_domain(&group_sid)) {
3156 DEBUG(3, ("sid %s is not in our domain\n", group_sid_str));
3157 return NT_STATUS_NO_SUCH_GROUP;
3158 }
3159
3160 DEBUG(10, ("lookup on Domain SID\n"));
3161
3162 become_root();
3163 result = pdb_enum_group_members(p->mem_ctx, &group_sid,
3164 &rid, &num_members);
3165 unbecome_root();
3166
3167 if (!NT_STATUS_IS_OK(result))
3168 return result;
3169
3170 attr=TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_members);
3171
3172 if ((num_members!=0) && (rid==NULL))
3173 return NT_STATUS_NO_MEMORY;
3174
3175 for (i=0; i<num_members; i++)
3176 attr[i] = SID_NAME_USER;
3177
3178 init_samr_r_query_groupmem(r_u, num_members, rid, attr, NT_STATUS_OK);
3179
3180 return NT_STATUS_OK;
3181 }
3182
3183 /*********************************************************************
3184 _samr_add_aliasmem
3185 *********************************************************************/
3186
3187 NTSTATUS _samr_add_aliasmem(pipes_struct *p, SAMR_Q_ADD_ALIASMEM *q_u, SAMR_R_ADD_ALIASMEM *r_u)
3188 {
3189 DOM_SID alias_sid;
3190 uint32 acc_granted;
3191 SE_PRIV se_rights;
3192 BOOL can_add_accounts;
3193 BOOL ret;
3194
3195
3196 /* Find the policy handle. Open a policy on it. */
3197 if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
3198 return NT_STATUS_INVALID_HANDLE;
3199
3200 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_ADD_MEMBER, "_samr_add_aliasmem"))) {
3201 return r_u->status;
3202 }
3203
3204 DEBUG(10, ("sid is %s\n", sid_string_static(&alias_sid)));
3205
3206 se_priv_copy( &se_rights, &se_add_users );
3207 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
3208
3209 /******** BEGIN SeAddUsers BLOCK *********/
3210
3211 if ( can_add_accounts )
3212 become_root();
3213
3214 ret = pdb_add_aliasmem(&alias_sid, &q_u->sid.sid);
3215
3216 if ( can_add_accounts )
3217 unbecome_root();
3218
3219 /******** END SeAddUsers BLOCK *********/
3220
3221 return ret ? NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
3222 }
3223
3224 /*********************************************************************
3225 _samr_del_aliasmem
3226 *********************************************************************/
3227
3228 NTSTATUS _samr_del_aliasmem(pipes_struct *p, SAMR_Q_DEL_ALIASMEM *q_u, SAMR_R_DEL_ALIASMEM *r_u)
3229 {
3230 DOM_SID alias_sid;
3231 uint32 acc_granted;
3232 SE_PRIV se_rights;
3233 BOOL can_add_accounts;
3234 BOOL ret;
3235
3236 /* Find the policy handle. Open a policy on it. */
3237 if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
3238 return NT_STATUS_INVALID_HANDLE;
3239
3240 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_REMOVE_MEMBER, "_samr_del_aliasmem"))) {
3241 return r_u->status;
3242 }
3243
3244 DEBUG(10, ("_samr_del_aliasmem:sid is %s\n",
3245 sid_string_static(&alias_sid)));
3246
3247 se_priv_copy( &se_rights, &se_add_users );
3248 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
3249
3250 /******** BEGIN SeAddUsers BLOCK *********/
3251
3252 if ( can_add_accounts )
3253 become_root();
3254
3255 ret = pdb_del_aliasmem(&alias_sid, &q_u->sid.sid);
3256
3257 if ( can_add_accounts )
3258 unbecome_root();
3259
3260 /******** END SeAddUsers BLOCK *********/
3261
3262 return ret ? NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
3263 }
3264
3265 /*********************************************************************
3266 _samr_add_groupmem
3267 *********************************************************************/
3268
3269 NTSTATUS _samr_add_groupmem(pipes_struct *p, SAMR_Q_ADD_GROUPMEM *q_u, SAMR_R_ADD_GROUPMEM *r_u)
3270 {
3271 DOM_SID group_sid;
3272 DOM_SID user_sid;
3273 fstring group_sid_str;
3274 uid_t uid;
3275 struct passwd *pwd;
3276 struct group *grp;
3277 fstring grp_name;
3278 GROUP_MAP map;
3279 NTSTATUS ret;
3280 SAM_ACCOUNT *sam_user=NULL;
3281 BOOL check;
3282 uint32 acc_granted;
3283 SE_PRIV se_rights;
3284 BOOL can_add_accounts;
3285
3286 /* Find the policy handle. Open a policy on it. */
3287 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
3288 return NT_STATUS_INVALID_HANDLE;
3289
3290 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_ADD_MEMBER, "_samr_add_groupmem"))) {
3291 return r_u->status;
3292 }
3293
3294 sid_to_string(group_sid_str, &group_sid);
3295 DEBUG(10, ("sid is %s\n", group_sid_str));
3296
3297 if (sid_compare(&group_sid, get_global_sam_sid())<=0)
3298 return NT_STATUS_NO_SUCH_GROUP;
3299
3300 DEBUG(10, ("lookup on Domain SID\n"));
3301
3302 if(!get_domain_group_from_sid(group_sid, &map))
3303 return NT_STATUS_NO_SUCH_GROUP;
3304
3305 sid_copy(&user_sid, get_global_sam_sid());
3306 sid_append_rid(&user_sid, q_u->rid);
3307
3308 ret = pdb_init_sam(&sam_user);
3309 if (!NT_STATUS_IS_OK(ret))
3310 return ret;
3311
3312 check = pdb_getsampwsid(sam_user, &user_sid);
3313
3314 if (check != True) {
3315 pdb_free_sam(&sam_user);
3316 return NT_STATUS_NO_SUCH_USER;
3317 }
3318
3319 /* check a real user exist before we run the script to add a user to a group */
3320 if (!NT_STATUS_IS_OK(sid_to_uid(pdb_get_user_sid(sam_user), &uid))) {
3321 pdb_free_sam(&sam_user);
3322 return NT_STATUS_NO_SUCH_USER;
3323 }
3324
3325 pdb_free_sam(&sam_user);
3326
3327 if ((pwd=getpwuid_alloc(uid)) == NULL) {
3328 return NT_STATUS_NO_SUCH_USER;
3329 }
3330
3331 if ((grp=getgrgid(map.gid)) == NULL) {
3332 passwd_free(&pwd);
3333 return NT_STATUS_NO_SUCH_GROUP;
3334 }
3335
3336 /* we need to copy the name otherwise it's overloaded in user_in_unix_group_list */
3337 fstrcpy(grp_name, grp->gr_name);
3338
3339 /* if the user is already in the group */
3340 if(user_in_unix_group_list(pwd->pw_name, grp_name)) {
3341 passwd_free(&pwd);
3342 return NT_STATUS_MEMBER_IN_GROUP;
3343 }
3344
3345 se_priv_copy( &se_rights, &se_add_users );
3346 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
3347
3348 /******** BEGIN SeAddUsers BLOCK *********/
3349
3350 if ( can_add_accounts )
3351 become_root();
3352
3353 /*
3354 * ok, the group exist, the user exist, the user is not in the group,
3355 *
3356 * we can (finally) add it to the group !
3357 */
3358
3359 smb_add_user_group(grp_name, pwd->pw_name);
3360
3361 if ( can_add_accounts )
3362 unbecome_root();
3363
3364 /******** END SeAddUsers BLOCK *********/
3365
3366 /* check if the user has been added then ... */
3367 if(!user_in_unix_group_list(pwd->pw_name, grp_name)) {
3368 passwd_free(&pwd);
3369 return NT_STATUS_MEMBER_NOT_IN_GROUP; /* don't know what to reply else */
3370 }
3371
3372 passwd_free(&pwd);
3373 return NT_STATUS_OK;
3374 }
3375
3376 /*********************************************************************
3377 _samr_del_groupmem
3378 *********************************************************************/
3379
3380 NTSTATUS _samr_del_groupmem(pipes_struct *p, SAMR_Q_DEL_GROUPMEM *q_u, SAMR_R_DEL_GROUPMEM *r_u)
3381 {
3382 DOM_SID group_sid;
3383 DOM_SID user_sid;
3384 SAM_ACCOUNT *sam_pass=NULL;
3385 GROUP_MAP map;
3386 fstring grp_name;
3387 struct group *grp;
3388 uint32 acc_granted;
3389 SE_PRIV se_rights;
3390 BOOL can_add_accounts;
3391
3392 /*
3393 * delete the group member named q_u->rid
3394 * who is a member of the sid associated with the handle
3395 * the rid is a user's rid as the group is a domain group.
3396 */
3397
3398 /* Find the policy handle. Open a policy on it. */
3399 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
3400 return NT_STATUS_INVALID_HANDLE;
3401
3402 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_REMOVE_MEMBER, "_samr_del_groupmem"))) {
3403 return r_u->status;
3404 }
3405
3406 if (!sid_check_is_in_our_domain(&group_sid))
3407 return NT_STATUS_NO_SUCH_GROUP;
3408
3409 sid_copy(&user_sid, get_global_sam_sid());
3410 sid_append_rid(&user_sid, q_u->rid);
3411
3412 if (!get_domain_group_from_sid(group_sid, &map))
3413 return NT_STATUS_NO_SUCH_GROUP;
3414
3415 if ((grp=getgrgid(map.gid)) == NULL)
3416 return NT_STATUS_NO_SUCH_GROUP;
3417
3418 /* we need to copy the name otherwise it's overloaded in user_in_group_list */
3419 fstrcpy(grp_name, grp->gr_name);
3420
3421 /* check if the user exists before trying to remove it from the group */
3422 pdb_init_sam(&sam_pass);
3423 if (!pdb_getsampwsid(sam_pass, &user_sid)) {
3424 DEBUG(5,("User %s doesn't exist.\n", pdb_get_username(sam_pass)));
3425 pdb_free_sam(&sam_pass);
3426 return NT_STATUS_NO_SUCH_USER;
3427 }
3428
3429 /* if the user is not in the group */
3430 if (!user_in_unix_group_list(pdb_get_username(sam_pass), grp_name)) {
3431 pdb_free_sam(&sam_pass);
3432 return NT_STATUS_MEMBER_NOT_IN_GROUP;
3433 }
3434
3435
3436 se_priv_copy( &se_rights, &se_add_users );
3437 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
3438
3439 /******** BEGIN SeAddUsers BLOCK *********/
3440
3441 if ( can_add_accounts )
3442 become_root();
3443
3444 smb_delete_user_group(grp_name, pdb_get_username(sam_pass));
3445
3446 if ( can_add_accounts )
3447 unbecome_root();
3448
3449 /******** END SeAddUsers BLOCK *********/
3450
3451 /* check if the user has been removed then ... */
3452 if (user_in_unix_group_list(pdb_get_username(sam_pass), grp_name)) {
3453 pdb_free_sam(&sam_pass);
3454 return NT_STATUS_ACCESS_DENIED; /* don't know what to reply else */
3455 }
3456
3457 pdb_free_sam(&sam_pass);
3458 return NT_STATUS_OK;
3459
3460 }
3461
3462 /****************************************************************************
3463 Delete a UNIX user on demand.
3464 ****************************************************************************/
3465
3466 static int smb_delete_user(const char *unix_user)
3467 {
3468 pstring del_script;
3469 int ret;
3470
3471 pstrcpy(del_script, lp_deluser_script());
3472 if (! *del_script)
3473 return -1;
3474 all_string_sub(del_script, "%u", unix_user, sizeof(del_script));
3475 ret = smbrun(del_script,NULL);
3476 flush_pwnam_cache();
3477 DEBUG(ret ? 0 : 3,("smb_delete_user: Running the command `%s' gave %d\n",del_script,ret));
3478
3479 return ret;
3480 }
3481
3482 /*********************************************************************
3483 _samr_delete_dom_user
3484 *********************************************************************/
3485
3486 NTSTATUS _samr_delete_dom_user(pipes_struct *p, SAMR_Q_DELETE_DOM_USER *q_u, SAMR_R_DELETE_DOM_USER *r_u )
3487 {
3488 DOM_SID user_sid;
3489 SAM_ACCOUNT *sam_pass=NULL;
3490 uint32 acc_granted;
3491 BOOL can_add_accounts;
3492 BOOL ret;
3493
3494 DEBUG(5, ("_samr_delete_dom_user: %d\n", __LINE__));
3495
3496 /* Find the policy handle. Open a policy on it. */
3497 if (!get_lsa_policy_samr_sid(p, &q_u->user_pol, &user_sid, &acc_granted))
3498 return NT_STATUS_INVALID_HANDLE;
3499
3500 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS, "_samr_delete_dom_user"))) {
3501 return r_u->status;
3502 }
3503
3504 if (!sid_check_is_in_our_domain(&user_sid))
3505 return NT_STATUS_CANNOT_DELETE;
3506
3507 /* check if the user exists before trying to delete */
3508 pdb_init_sam(&sam_pass);
3509 if(!pdb_getsampwsid(sam_pass, &user_sid)) {
3510 DEBUG(5,("_samr_delete_dom_user:User %s doesn't exist.\n",
3511 sid_string_static(&user_sid)));
3512 pdb_free_sam(&sam_pass);
3513 return NT_STATUS_NO_SUCH_USER;
3514 }
3515
3516 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
3517
3518 /******** BEGIN SeAddUsers BLOCK *********/
3519
3520 if ( can_add_accounts )
3521 become_root();
3522
3523 /* First delete the samba side....
3524 code is order to prevent unnecessary returns out of the admin
3525 block of code */
3526
3527 if ( (ret = pdb_delete_sam_account(sam_pass)) == True ) {
3528 /*
3529 * Now delete the unix side ....
3530 * note: we don't check if the delete really happened
3531 * as the script is not necessary present
3532 * and maybe the sysadmin doesn't want to delete the unix side
3533 */
3534 smb_delete_user( pdb_get_username(sam_pass) );
3535 }
3536
3537 if ( can_add_accounts )
3538 unbecome_root();
3539
3540 /******** END SeAddUsers BLOCK *********/
3541
3542 if ( !ret ) {
3543 DEBUG(5,("_samr_delete_dom_user:Failed to delete entry for user %s.\n", pdb_get_username(sam_pass)));
3544 pdb_free_sam(&sam_pass);
3545 return NT_STATUS_CANNOT_DELETE;
3546 }
3547
3548
3549 pdb_free_sam(&sam_pass);
3550
3551 if (!close_policy_hnd(p, &q_u->user_pol))
3552 return NT_STATUS_OBJECT_NAME_INVALID;
3553
3554 return NT_STATUS_OK;
3555 }
3556
3557 /*********************************************************************
3558 _samr_delete_dom_group
3559 *********************************************************************/
3560
3561 NTSTATUS _samr_delete_dom_group(pipes_struct *p, SAMR_Q_DELETE_DOM_GROUP *q_u, SAMR_R_DELETE_DOM_GROUP *r_u)
3562 {
3563 DOM_SID group_sid;
3564 DOM_SID dom_sid;
3565 uint32 group_rid;
3566 fstring group_sid_str;
3567 gid_t gid;
3568 struct group *grp;
3569 GROUP_MAP map;
3570 uint32 acc_granted;
3571 SE_PRIV se_rights;
3572 BOOL can_add_accounts;
3573 BOOL ret;
3574
3575 DEBUG(5, ("samr_delete_dom_group: %d\n", __LINE__));
3576
3577 /* Find the policy handle. Open a policy on it. */
3578 if (!get_lsa_policy_samr_sid(p, &q_u->group_pol, &group_sid, &acc_granted))
3579 return NT_STATUS_INVALID_HANDLE;
3580
3581 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS, "_samr_delete_dom_group"))) {
3582 return r_u->status;
3583 }
3584
3585 sid_copy(&dom_sid, &group_sid);
3586 sid_to_string(group_sid_str, &dom_sid);
3587 sid_split_rid(&dom_sid, &group_rid);
3588
3589 DEBUG(10, ("sid is %s\n", group_sid_str));
3590
3591 /* we check if it's our SID before deleting */
3592 if (!sid_equal(&dom_sid, get_global_sam_sid()))
3593 return NT_STATUS_NO_SUCH_GROUP;
3594
3595 DEBUG(10, ("lookup on Domain SID\n"));
3596
3597 if(!get_domain_group_from_sid(group_sid, &map))
3598 return NT_STATUS_NO_SUCH_GROUP;
3599
3600 gid=map.gid;
3601
3602 /* check if group really exists */
3603 if ( (grp=getgrgid(gid)) == NULL)
3604 return NT_STATUS_NO_SUCH_GROUP;
3605
3606 se_priv_copy( &se_rights, &se_add_users );
3607 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
3608
3609 /******** BEGIN SeAddUsers BLOCK *********/
3610
3611 if ( can_add_accounts )
3612 become_root();
3613
3614 /* delete mapping first */
3615
3616 if ( (ret = pdb_delete_group_mapping_entry(group_sid)) == True ) {
3617 smb_delete_group( grp->gr_name );
3618 }
3619
3620 if ( can_add_accounts )
3621 unbecome_root();
3622
3623 /******** END SeAddUsers BLOCK *********/
3624
3625 if ( !ret ) {
3626 DEBUG(5,("_samr_delete_dom_group: Failed to delete mapping entry for group %s.\n",
3627 group_sid_str));
3628 return NT_STATUS_ACCESS_DENIED;
3629 }
3630
3631 /* don't check that the unix group has been deleted. Work like
3632 _samr_delet_dom_user() */
3633
3634 if (!close_policy_hnd(p, &q_u->group_pol))
3635 return NT_STATUS_OBJECT_NAME_INVALID;
3636
3637 return NT_STATUS_OK;
3638 }
3639
3640 /*********************************************************************
3641 _samr_delete_dom_alias
3642 *********************************************************************/
3643
3644 NTSTATUS _samr_delete_dom_alias(pipes_struct *p, SAMR_Q_DELETE_DOM_ALIAS *q_u, SAMR_R_DELETE_DOM_ALIAS *r_u)
3645 {
3646 DOM_SID alias_sid;
3647 uint32 acc_granted;
3648 SE_PRIV se_rights;
3649 BOOL can_add_accounts;
3650 BOOL ret;
3651
3652 DEBUG(5, ("_samr_delete_dom_alias: %d\n", __LINE__));
3653
3654 /* Find the policy handle. Open a policy on it. */
3655 if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
3656 return NT_STATUS_INVALID_HANDLE;
3657
3658 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS, "_samr_delete_dom_alias"))) {
3659 return r_u->status;
3660 }
3661
3662 DEBUG(10, ("sid is %s\n", sid_string_static(&alias_sid)));
3663
3664 if (!sid_check_is_in_our_domain(&alias_sid))
3665 return NT_STATUS_NO_SUCH_ALIAS;
3666
3667 DEBUG(10, ("lookup on Local SID\n"));
3668
3669 se_priv_copy( &se_rights, &se_add_users );
3670 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
3671
3672 /******** BEGIN SeAddUsers BLOCK *********/
3673
3674 if ( can_add_accounts )
3675 become_root();
3676
3677 /* Have passdb delete the alias */
3678 ret = pdb_delete_alias(&alias_sid);
3679
3680 if ( can_add_accounts )
3681 unbecome_root();
3682
3683 /******** END SeAddUsers BLOCK *********/
3684
3685 if ( !ret )
3686 return NT_STATUS_ACCESS_DENIED;
3687
3688 if (!close_policy_hnd(p, &q_u->alias_pol))
3689 return NT_STATUS_OBJECT_NAME_INVALID;
3690
3691 return NT_STATUS_OK;
3692 }
3693
3694 /*********************************************************************
3695 _samr_create_dom_group
3696 *********************************************************************/
3697
3698 NTSTATUS _samr_create_dom_group(pipes_struct *p, SAMR_Q_CREATE_DOM_GROUP *q_u, SAMR_R_CREATE_DOM_GROUP *r_u)
3699 {
3700 DOM_SID dom_sid;
3701 DOM_SID info_sid;
3702 fstring name;
3703 fstring sid_string;
3704 struct group *grp;
3705 struct samr_info *info;
3706 uint32 acc_granted;
3707 gid_t gid;
3708 SE_PRIV se_rights;
3709 BOOL can_add_accounts;
3710 NTSTATUS result;
3711
3712 /* Find the policy handle. Open a policy on it. */
3713 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &dom_sid, &acc_granted))
3714 return NT_STATUS_INVALID_HANDLE;
3715
3716 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_CREATE_GROUP, "_samr_create_dom_group"))) {
3717 return r_u->status;
3718 }
3719
3720 if (!sid_equal(&dom_sid, get_global_sam_sid()))
3721 return NT_STATUS_ACCESS_DENIED;
3722
3723 unistr2_to_ascii(name, &q_u->uni_acct_desc, sizeof(name)-1);
3724
3725 /* check if group already exist */
3726 if ((grp=getgrnam(name)) != NULL)
3727 return NT_STATUS_GROUP_EXISTS;
3728
3729 se_priv_copy( &se_rights, &se_add_users );
3730 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
3731
3732 /******** BEGIN SeAddUsers BLOCK *********/
3733
3734 if ( can_add_accounts )
3735 become_root();
3736
3737 /* check that we successfully create the UNIX group */
3738
3739 result = NT_STATUS_ACCESS_DENIED;
3740 if ( (smb_create_group(name, &gid) == 0) && ((grp=getgrgid(gid)) != NULL) ) {
3741
3742 /* so far, so good */
3743
3744 result = NT_STATUS_OK;
3745
3746 r_u->rid = pdb_gid_to_group_rid( grp->gr_gid );
3747
3748 /* add the group to the mapping table */
3749
3750 sid_copy( &info_sid, get_global_sam_sid() );
3751 sid_append_rid( &info_sid, r_u->rid );
3752 sid_to_string( sid_string, &info_sid );
3753
3754 /* reset the error code if we fail to add the mapping entry */
3755
3756 if ( !add_initial_entry(grp->gr_gid, sid_string, SID_NAME_DOM_GRP, name, NULL) )
3757 result = NT_STATUS_ACCESS_DENIED;
3758 }
3759
3760 if ( can_add_accounts )
3761 unbecome_root();
3762
3763 /******** END SeAddUsers BLOCK *********/
3764
3765 /* check if we should bail out here */
3766
3767 if ( !NT_STATUS_IS_OK(result) )
3768 return result;
3769
3770 if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
3771 return NT_STATUS_NO_MEMORY;
3772
3773
3774 /* they created it; let the user do what he wants with it */
3775
3776 info->acc_granted = GENERIC_RIGHTS_GROUP_ALL_ACCESS;
3777
3778 /* get a (unique) handle. open a policy on it. */
3779 if (!create_policy_hnd(p, &r_u->pol, free_samr_info, (void *)info))
3780 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3781
3782 return NT_STATUS_OK;
3783 }
3784
3785 /*********************************************************************
3786 _samr_create_dom_alias
3787 *********************************************************************/
3788
3789 NTSTATUS _samr_create_dom_alias(pipes_struct *p, SAMR_Q_CREATE_DOM_ALIAS *q_u, SAMR_R_CREATE_DOM_ALIAS *r_u)
3790 {
3791 DOM_SID dom_sid;
3792 DOM_SID info_sid;
3793 fstring name;
3794 struct samr_info *info;
3795 uint32 acc_granted;
3796 gid_t gid;
3797 NTSTATUS result;
3798 SE_PRIV se_rights;
3799 BOOL can_add_accounts;
3800
3801 /* Find the policy handle. Open a policy on it. */
3802 if (!get_lsa_policy_samr_sid(p, &q_u->dom_pol, &dom_sid, &acc_granted))
3803 return NT_STATUS_INVALID_HANDLE;
3804
3805 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_CREATE_ALIAS, "_samr_create_alias"))) {
3806 return r_u->status;
3807 }
3808
3809 if (!sid_equal(&dom_sid, get_global_sam_sid()))
3810 return NT_STATUS_ACCESS_DENIED;
3811
3812 unistr2_to_ascii(name, &q_u->uni_acct_desc, sizeof(name)-1);
3813
3814 se_priv_copy( &se_rights, &se_add_users );
3815 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
3816
3817 /******** BEGIN SeAddUsers BLOCK *********/
3818
3819 if ( can_add_accounts )
3820 become_root();
3821
3822 /* Have passdb create the alias */
3823 result = pdb_create_alias(name, &r_u->rid);
3824
3825 if ( can_add_accounts )
3826 unbecome_root();
3827
3828 /******** END SeAddUsers BLOCK *********/
3829
3830 if (!NT_STATUS_IS_OK(result))
3831 return result;
3832
3833 sid_copy(&info_sid, get_global_sam_sid());
3834 sid_append_rid(&info_sid, r_u->rid);
3835
3836 if (!NT_STATUS_IS_OK(sid_to_gid(&info_sid, &gid)))
3837 return NT_STATUS_ACCESS_DENIED;
3838
3839 /* check if the group has been successfully created */
3840 if ( getgrgid(gid) == NULL )
3841 return NT_STATUS_ACCESS_DENIED;
3842
3843 if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
3844 return NT_STATUS_NO_MEMORY;
3845
3846 /* they created it; let the user do what he wants with it */
3847
3848 info->acc_granted = GENERIC_RIGHTS_ALIAS_ALL_ACCESS;
3849
3850 /* get a (unique) handle. open a policy on it. */
3851 if (!create_policy_hnd(p, &r_u->alias_pol, free_samr_info, (void *)info))
3852 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3853
3854 return NT_STATUS_OK;
3855 }
3856
3857 /*********************************************************************
3858 _samr_query_groupinfo
3859
3860 sends the name/comment pair of a domain group
3861 level 1 send also the number of users of that group
3862 *********************************************************************/
3863
3864 NTSTATUS _samr_query_groupinfo(pipes_struct *p, SAMR_Q_QUERY_GROUPINFO *q_u, SAMR_R_QUERY_GROUPINFO *r_u)
3865 {
3866 DOM_SID group_sid;
3867 GROUP_MAP map;
3868 DOM_SID *sids=NULL;
3869 uid_t *uids;
3870 int num=0;
3871 GROUP_INFO_CTR *ctr;
3872 uint32 acc_granted;
3873 BOOL ret;
3874
3875 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
3876 return NT_STATUS_INVALID_HANDLE;
3877
3878 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_LOOKUP_INFO, "_samr_query_groupinfo"))) {
3879 return r_u->status;
3880 }
3881
3882 become_root();
3883 ret = get_domain_group_from_sid(group_sid, &map);
3884 unbecome_root();
3885 if (!ret)
3886 return NT_STATUS_INVALID_HANDLE;
3887
3888 ctr=TALLOC_ZERO_P(p->mem_ctx, GROUP_INFO_CTR);
3889 if (ctr==NULL)
3890 return NT_STATUS_NO_MEMORY;
3891
3892 switch (q_u->switch_level) {
3893 case 1:
3894 ctr->switch_value1 = 1;
3895 if(!get_memberuids(map.gid, &uids, &num))
3896 return NT_STATUS_NO_SUCH_GROUP;
3897 SAFE_FREE(uids);
3898 init_samr_group_info1(&ctr->group.info1, map.nt_name, map.comment, num);
3899 SAFE_FREE(sids);
3900 break;
3901 case 3:
3902 ctr->switch_value1 = 3;
3903 init_samr_group_info3(&ctr->group.info3);
3904 break;
3905 case 4:
3906 ctr->switch_value1 = 4;
3907 init_samr_group_info4(&ctr->group.info4, map.comment);
3908 break;
3909 default:
3910 return NT_STATUS_INVALID_INFO_CLASS;
3911 }
3912
3913 init_samr_r_query_groupinfo(r_u, ctr, NT_STATUS_OK);
3914
3915 return NT_STATUS_OK;
3916 }
3917
3918 /*********************************************************************
3919 _samr_set_groupinfo
3920
3921 update a domain group's comment.
3922 *********************************************************************/
3923
3924 NTSTATUS _samr_set_groupinfo(pipes_struct *p, SAMR_Q_SET_GROUPINFO *q_u, SAMR_R_SET_GROUPINFO *r_u)
3925 {
3926 DOM_SID group_sid;
3927 GROUP_MAP map;
3928 GROUP_INFO_CTR *ctr;
3929 uint32 acc_granted;
3930 BOOL ret;
3931 BOOL can_mod_accounts;
3932
3933 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
3934 return NT_STATUS_INVALID_HANDLE;
3935
3936 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_SET_INFO, "_samr_set_groupinfo"))) {
3937 return r_u->status;
3938 }
3939
3940 if (!get_domain_group_from_sid(group_sid, &map))
3941 return NT_STATUS_NO_SUCH_GROUP;
3942
3943 ctr=q_u->ctr;
3944
3945 switch (ctr->switch_value1) {
3946 case 1:
3947 unistr2_to_ascii(map.comment, &(ctr->group.info1.uni_acct_desc), sizeof(map.comment)-1);
3948 break;
3949 case 4:
3950 unistr2_to_ascii(map.comment, &(ctr->group.info4.uni_acct_desc), sizeof(map.comment)-1);
3951 break;
3952 default:
3953 return NT_STATUS_INVALID_INFO_CLASS;
3954 }
3955
3956 can_mod_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
3957
3958 /******** BEGIN SeAddUsers BLOCK *********/
3959
3960 if ( can_mod_accounts )
3961 become_root();
3962
3963 ret = pdb_update_group_mapping_entry(&map);
3964
3965 if ( can_mod_accounts )
3966 unbecome_root();
3967
3968 /******** End SeAddUsers BLOCK *********/
3969
3970 return ret ? NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
3971 }
3972
3973 /*********************************************************************
3974 _samr_set_aliasinfo
3975
3976 update an alias's comment.
3977 *********************************************************************/
3978
3979 NTSTATUS _samr_set_aliasinfo(pipes_struct *p, SAMR_Q_SET_ALIASINFO *q_u, SAMR_R_SET_ALIASINFO *r_u)
3980 {
3981 DOM_SID group_sid;
3982 struct acct_info info;
3983 ALIAS_INFO_CTR *ctr;
3984 uint32 acc_granted;
3985 BOOL ret;
3986 BOOL can_mod_accounts;
3987
3988 if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &group_sid, &acc_granted))
3989 return NT_STATUS_INVALID_HANDLE;
3990
3991 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_SET_INFO, "_samr_set_aliasinfo"))) {
3992 return r_u->status;
3993 }
3994
3995 ctr=&q_u->ctr;
3996
3997 switch (ctr->level) {
3998 case 3:
3999 if ( ctr->alias.info3.description.string ) {
4000 unistr2_to_ascii( info.acct_desc,
4001 ctr->alias.info3.description.string,
4002 sizeof(info.acct_desc)-1 );
4003 }
4004 break;
4005 default:
4006 return NT_STATUS_INVALID_INFO_CLASS;
4007 }
4008
4009 can_mod_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
4010
4011 /******** BEGIN SeAddUsers BLOCK *********/
4012
4013 if ( can_mod_accounts )
4014 become_root();
4015
4016 ret = pdb_set_aliasinfo( &group_sid, &info );
4017
4018 if ( can_mod_accounts )
4019 unbecome_root();
4020
4021 /******** End SeAddUsers BLOCK *********/
4022
4023 return ret ? NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
4024 }
4025
4026 /*********************************************************************
4027 _samr_get_dom_pwinfo
4028 *********************************************************************/
4029
4030 NTSTATUS _samr_get_dom_pwinfo(pipes_struct *p, SAMR_Q_GET_DOM_PWINFO *q_u, SAMR_R_GET_DOM_PWINFO *r_u)
4031 {
4032 /* Perform access check. Since this rpc does not require a
4033 policy handle it will not be caught by the access checks on
4034 SAMR_CONNECT or SAMR_CONNECT_ANON. */
4035
4036 if (!pipe_access_check(p)) {
4037 DEBUG(3, ("access denied to samr_get_dom_pwinfo\n"));
4038 r_u->status = NT_STATUS_ACCESS_DENIED;
4039 return r_u->status;
4040 }
4041
4042 /* Actually, returning zeros here works quite well :-). */
4043
4044 return NT_STATUS_OK;
4045 }
4046
4047 /*********************************************************************
4048 _samr_open_group
4049 *********************************************************************/
4050
4051 NTSTATUS _samr_open_group(pipes_struct *p, SAMR_Q_OPEN_GROUP *q_u, SAMR_R_OPEN_GROUP *r_u)
4052 {
4053 DOM_SID sid;
4054 DOM_SID info_sid;
4055 GROUP_MAP map;
4056 struct samr_info *info;
4057 SEC_DESC *psd = NULL;
4058 uint32 acc_granted;
4059 uint32 des_access = q_u->access_mask;
4060 size_t sd_size;
4061 NTSTATUS status;
4062 fstring sid_string;
4063 BOOL ret;
4064 SE_PRIV se_rights;
4065
4066 if (!get_lsa_policy_samr_sid(p, &q_u->domain_pol, &sid, &acc_granted))
4067 return NT_STATUS_INVALID_HANDLE;
4068
4069 status = access_check_samr_function(acc_granted,
4070 SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_open_group");
4071
4072 if ( !NT_STATUS_IS_OK(status) )
4073 return status;
4074
4075 /*check if access can be granted as requested by client. */
4076 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &grp_generic_mapping, NULL, 0);
4077 se_map_generic(&des_access,&grp_generic_mapping);
4078
4079 se_priv_copy( &se_rights, &se_add_users );
4080
4081 status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
4082 &se_rights, GENERIC_RIGHTS_GROUP_WRITE, des_access,
4083 &acc_granted, "_samr_open_group");
4084
4085 if ( !NT_STATUS_IS_OK(status) )
4086 return status;
4087
4088 /* this should not be hard-coded like this */
4089
4090 if (!sid_equal(&sid, get_global_sam_sid()))
4091 return NT_STATUS_ACCESS_DENIED;
4092
4093 sid_copy(&info_sid, get_global_sam_sid());
4094 sid_append_rid(&info_sid, q_u->rid_group);
4095 sid_to_string(sid_string, &info_sid);
4096
4097 if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
4098 return NT_STATUS_NO_MEMORY;
4099
4100 info->acc_granted = acc_granted;
4101
4102 DEBUG(10, ("_samr_open_group:Opening SID: %s\n", sid_string));
4103
4104 /* check if that group really exists */
4105 become_root();
4106 ret = get_domain_group_from_sid(info->sid, &map);
4107 unbecome_root();
4108 if (!ret)
4109 return NT_STATUS_NO_SUCH_GROUP;
4110
4111 /* get a (unique) handle. open a policy on it. */
4112 if (!create_policy_hnd(p, &r_u->pol, free_samr_info, (void *)info))
4113 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4114
4115 return NT_STATUS_OK;
4116 }
4117
4118 /*********************************************************************
4119 _samr_remove_sid_foreign_domain
4120 *********************************************************************/
4121
4122 NTSTATUS _samr_remove_sid_foreign_domain(pipes_struct *p,
4123 SAMR_Q_REMOVE_SID_FOREIGN_DOMAIN *q_u,
4124 SAMR_R_REMOVE_SID_FOREIGN_DOMAIN *r_u)
4125 {
4126 DOM_SID delete_sid, domain_sid;
4127 uint32 acc_granted;
4128 NTSTATUS result;
4129
4130 sid_copy( &delete_sid, &q_u->sid.sid );
4131
4132 DEBUG(5,("_samr_remove_sid_foreign_domain: removing SID [%s]\n",
4133 sid_string_static(&delete_sid)));
4134
4135 /* Find the policy handle. Open a policy on it. */
4136
4137 if (!get_lsa_policy_samr_sid(p, &q_u->dom_pol, &domain_sid,
4138 &acc_granted))
4139 return NT_STATUS_INVALID_HANDLE;
4140
4141 result = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS,
4142 "_samr_remove_sid_foreign_domain");
4143
4144 if (!NT_STATUS_IS_OK(result))
4145 return result;
4146
4147 DEBUG(8, ("_samr_remove_sid_foreign_domain:sid is %s\n",
4148 sid_string_static(&domain_sid)));
4149
4150 /* we can only delete a user from a group since we don't have
4151 nested groups anyways. So in the latter case, just say OK */
4152
4153 /* TODO: The above comment nowadays is bogus. Since we have nested
4154 * groups now, and aliases members are never reported out of the unix
4155 * group membership, the "just say OK" makes this call a no-op. For
4156 * us. This needs fixing however. */
4157
4158 /* I've only ever seen this in the wild when deleting a user from
4159 * usrmgr.exe. domain_sid is the builtin domain, and the sid to delete
4160 * is the user about to be deleted. I very much suspect this is the
4161 * only application of this call. To verify this, let people report
4162 * other cases. */
4163
4164 if (!sid_check_is_builtin(&domain_sid)) {
4165 DEBUG(1,("_samr_remove_sid_foreign_domain: domain_sid = %s, "
4166 "global_sam_sid() = %s\n",
4167 sid_string_static(&domain_sid),
4168 sid_string_static(get_global_sam_sid())));
4169 DEBUGADD(1,("please report to samba-technical@samba.org!\n"));
4170 return NT_STATUS_OK;
4171 }
4172
4173
4174 result = NT_STATUS_OK;
4175
4176 return result;
4177 }
4178
4179 /*******************************************************************
4180 _samr_unknown_2e
4181 ********************************************************************/
4182
4183 NTSTATUS _samr_unknown_2e(pipes_struct *p, SAMR_Q_UNKNOWN_2E *q_u, SAMR_R_UNKNOWN_2E *r_u)
4184 {
4185 struct samr_info *info = NULL;
4186 SAM_UNK_CTR *ctr;
4187 uint32 min_pass_len,pass_hist,flag;
4188 time_t u_expire, u_min_age;
4189 NTTIME nt_expire, nt_min_age;
4190
4191 time_t u_lock_duration, u_reset_time;
4192 NTTIME nt_lock_duration, nt_reset_time;
4193 uint32 lockout;
4194
4195 time_t u_logout;
4196 NTTIME nt_logout;
4197
4198 uint32 num_users=0, num_groups=0, num_aliases=0;
4199
4200 uint32 account_policy_temp;
4201 uint32 server_role;
4202
4203 if ((ctr = TALLOC_ZERO_P(p->mem_ctx, SAM_UNK_CTR)) == NULL)
4204 return NT_STATUS_NO_MEMORY;
4205
4206 ZERO_STRUCTP(ctr);
4207
4208 r_u->status = NT_STATUS_OK;
4209
4210 DEBUG(5,("_samr_unknown_2e: %d\n", __LINE__));
4211
4212 /* find the policy handle. open a policy on it. */
4213 if (!find_policy_by_hnd(p, &q_u->domain_pol, (void **)&info))
4214 return NT_STATUS_INVALID_HANDLE;
4215
4216 switch (q_u->switch_value) {
4217 case 0x01:
4218 account_policy_get(AP_MIN_PASSWORD_LEN, &account_policy_temp);
4219 min_pass_len = account_policy_temp;
4220
4221 account_policy_get(AP_PASSWORD_HISTORY, &account_policy_temp);
4222 pass_hist = account_policy_temp;
4223
4224 account_policy_get(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp);
4225 flag = account_policy_temp;
4226
4227 account_policy_get(AP_MAX_PASSWORD_AGE, &account_policy_temp);
4228 u_expire = account_policy_temp;
4229
4230 account_policy_get(AP_MIN_PASSWORD_AGE, &account_policy_temp);
4231 u_min_age = account_policy_temp;
4232
4233 unix_to_nt_time_abs(&nt_expire, u_expire);
4234 unix_to_nt_time_abs(&nt_min_age, u_min_age);
4235
4236 init_unk_info1(&ctr->info.inf1, (uint16)min_pass_len, (uint16)pass_hist,
4237 flag, nt_expire, nt_min_age);
4238 break;
4239 case 0x02:
4240 become_root();
4241 num_users = count_sam_users(&info->disp_info,
4242 ACB_NORMAL);
4243 num_groups = count_sam_groups(&info->disp_info);
4244 unbecome_root();
4245
4246 free_samr_db(info);
4247
4248 account_policy_get(AP_TIME_TO_LOGOUT, &account_policy_temp);
4249 u_logout = account_policy_temp;
4250
4251 unix_to_nt_time_abs(&nt_logout, u_logout);
4252
4253 server_role = ROLE_DOMAIN_PDC;
4254 if (lp_server_role() == ROLE_DOMAIN_BDC)
4255 server_role = ROLE_DOMAIN_BDC;
4256
4257 /* The time call below is to get a sequence number for the sam. FIXME !!! JRA. */
4258 init_unk_info2(&ctr->info.inf2, lp_serverstring(), lp_workgroup(), global_myname(), time(NULL),
4259 num_users, num_groups, num_aliases, nt_logout, server_role);
4260 break;
4261 case 0x03:
4262 account_policy_get(AP_TIME_TO_LOGOUT, &account_policy_temp);
4263 u_logout = account_policy_temp;
4264
4265 unix_to_nt_time_abs(&nt_logout, u_logout);
4266
4267 init_unk_info3(&ctr->info.inf3, nt_logout);
4268 break;
4269 case 0x05:
4270 init_unk_info5(&ctr->info.inf5, global_myname());
4271 break;
4272 case 0x06:
4273 init_unk_info6(&ctr->info.inf6);
4274 break;
4275 case 0x07:
4276 server_role = ROLE_DOMAIN_PDC;
4277 if (lp_server_role() == ROLE_DOMAIN_BDC)
4278 server_role = ROLE_DOMAIN_BDC;
4279 init_unk_info7(&ctr->info.inf7, server_role);
4280 break;
4281 case 0x08:
4282 init_unk_info8(&ctr->info.inf8, (uint32) time(NULL));
4283 break;
4284 case 0x0c:
4285 account_policy_get(AP_LOCK_ACCOUNT_DURATION, &account_policy_temp);
4286 u_lock_duration = account_policy_temp;
4287 if (u_lock_duration != -1)
4288 u_lock_duration *= 60;
4289
4290 account_policy_get(AP_RESET_COUNT_TIME, &account_policy_temp);
4291 u_reset_time = account_policy_temp * 60;
4292
4293 account_policy_get(AP_BAD_ATTEMPT_LOCKOUT, &account_policy_temp);
4294 lockout = account_policy_temp;
4295
4296 unix_to_nt_time_abs(&nt_lock_duration, u_lock_duration);
4297 unix_to_nt_time_abs(&nt_reset_time, u_reset_time);
4298
4299 init_unk_info12(&ctr->info.inf12, nt_lock_duration, nt_reset_time, (uint16)lockout);
4300 break;
4301 default:
4302 return NT_STATUS_INVALID_INFO_CLASS;
4303 }
4304
4305 init_samr_r_samr_unknown_2e(r_u, q_u->switch_value, ctr, NT_STATUS_OK);
4306
4307 DEBUG(5,("_samr_unknown_2e: %d\n", __LINE__));
4308
4309 return r_u->status;
4310 }
4311
4312 /*******************************************************************
4313 _samr_
4314 ********************************************************************/
4315
4316 NTSTATUS _samr_set_dom_info(pipes_struct *p, SAMR_Q_SET_DOMAIN_INFO *q_u, SAMR_R_SET_DOMAIN_INFO *r_u)
4317 {
4318 time_t u_expire, u_min_age;
4319 time_t u_logout;
4320 time_t u_lock_duration, u_reset_time;
4321
4322 r_u->status = NT_STATUS_OK;
4323
4324 DEBUG(5,("_samr_set_dom_info: %d\n", __LINE__));
4325
4326 /* find the policy handle. open a policy on it. */
4327 if (!find_policy_by_hnd(p, &q_u->domain_pol, NULL))
4328 return NT_STATUS_INVALID_HANDLE;
4329
4330 DEBUG(5,("_samr_set_dom_info: switch_value: %d\n", q_u->switch_value));
4331
4332 switch (q_u->switch_value) {
4333 case 0x01:
4334 u_expire=nt_time_to_unix_abs(&q_u->ctr->info.inf1.expire);
4335 u_min_age=nt_time_to_unix_abs(&q_u->ctr->info.inf1.min_passwordage);
4336
4337 account_policy_set(AP_MIN_PASSWORD_LEN, (uint32)q_u->ctr->info.inf1.min_length_password);
4338 account_policy_set(AP_PASSWORD_HISTORY, (uint32)q_u->ctr->info.inf1.password_history);
4339 account_policy_set(AP_USER_MUST_LOGON_TO_CHG_PASS, (uint32)q_u->ctr->info.inf1.flag);
4340 account_policy_set(AP_MAX_PASSWORD_AGE, (int)u_expire);
4341 account_policy_set(AP_MIN_PASSWORD_AGE, (int)u_min_age);
4342 break;
4343 case 0x02:
4344 break;
4345 case 0x03:
4346 u_logout=nt_time_to_unix_abs(&q_u->ctr->info.inf3.logout);
4347 account_policy_set(AP_TIME_TO_LOGOUT, (int)u_logout);
4348 break;
4349 case 0x05:
4350 break;
4351 case 0x06:
4352 break;
4353 case 0x07:
4354 break;
4355 case 0x0c:
4356 u_lock_duration=nt_time_to_unix_abs(&q_u->ctr->info.inf12.duration);
4357 if (u_lock_duration != -1)
4358 u_lock_duration /= 60;
4359
4360 u_reset_time=nt_time_to_unix_abs(&q_u->ctr->info.inf12.reset_count)/60;
4361
4362 account_policy_set(AP_LOCK_ACCOUNT_DURATION, (int)u_lock_duration);
4363 account_policy_set(AP_RESET_COUNT_TIME, (int)u_reset_time);
4364 account_policy_set(AP_BAD_ATTEMPT_LOCKOUT, (uint32)q_u->ctr->info.inf12.bad_attempt_lockout);
4365 break;
4366 default:
4367 return NT_STATUS_INVALID_INFO_CLASS;
4368 }
4369
4370 init_samr_r_set_domain_info(r_u, NT_STATUS_OK);
4371
4372 DEBUG(5,("_samr_set_dom_info: %d\n", __LINE__));
4373
4374 return r_u->status;
4375 }
Samba GIT mirror