2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Jeremy Allison 2001, 2006.
8 * Copyright (C) Rafal Szczesniak 2002,
9 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
10 * Copyright (C) Simo Sorce 2003.
11 * Copyright (C) Gerald (Jerry) Carter 2005.
12 * Copyright (C) Volker Lendecke 2005.
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * (at your option) any later version.
19 * This program is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
24 * You should have received a copy of the GNU General Public License
25 * along with this program; if not, write to the Free Software
26 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
29 /* This is the implementation of the lsa server code. */
34 #define DBGC_CLASS DBGC_RPC_SRV
43 struct generic_mapping lsa_generic_mapping
= {
50 /*******************************************************************
51 Function to free the per handle data.
52 ********************************************************************/
54 static void free_lsa_info(void *ptr
)
56 struct lsa_info
*lsa
= (struct lsa_info
*)ptr
;
61 /***************************************************************************
63 ***************************************************************************/
65 static void init_dom_query_3(DOM_QUERY_3
*d_q
, const char *dom_name
, DOM_SID
*dom_sid
)
67 d_q
->buffer_dom_name
= (dom_name
!= NULL
) ? 1 : 0; /* domain buffer pointer */
68 d_q
->buffer_dom_sid
= (dom_sid
!= NULL
) ? 1 : 0; /* domain sid pointer */
70 /* this string is supposed to be non-null terminated. */
71 /* But the maxlen in this UNISTR2 must include the terminating null. */
72 init_unistr2(&d_q
->uni_domain_name
, dom_name
, UNI_BROKEN_NON_NULL
);
75 * I'm not sure why this really odd combination of length
76 * values works, but it does appear to. I need to look at
77 * this *much* more closely - but at the moment leave alone
78 * until it's understood. This allows a W2k client to join
79 * a domain with both odd and even length names... JRA.
84 * The two fields below probably are reversed in meaning, ie.
85 * the first field is probably the str_len, the second the max
86 * len. Both are measured in bytes anyway.
89 d_q
->uni_dom_str_len
= d_q
->uni_domain_name
.uni_max_len
* 2;
90 d_q
->uni_dom_max_len
= d_q
->uni_domain_name
.uni_str_len
* 2;
93 init_dom_sid2(&d_q
->dom_sid
, dom_sid
);
96 /***************************************************************************
98 ***************************************************************************/
100 static void init_dom_query_5(DOM_QUERY_5
*d_q
, const char *dom_name
, DOM_SID
*dom_sid
)
102 init_dom_query_3(d_q
, dom_name
, dom_sid
);
105 /***************************************************************************
106 init_dom_ref - adds a domain if it's not already in, returns the index.
107 ***************************************************************************/
109 static int init_dom_ref(DOM_R_REF
*ref
, const char *dom_name
, DOM_SID
*dom_sid
)
113 if (dom_name
!= NULL
) {
114 for (num
= 0; num
< ref
->num_ref_doms_1
; num
++) {
115 if (sid_equal(dom_sid
, &ref
->ref_dom
[num
].ref_dom
.sid
))
119 num
= ref
->num_ref_doms_1
;
122 if (num
>= MAX_REF_DOMAINS
) {
123 /* index not found, already at maximum domain limit */
127 ref
->num_ref_doms_1
= num
+1;
128 ref
->ptr_ref_dom
= 1;
129 ref
->max_entries
= MAX_REF_DOMAINS
;
130 ref
->num_ref_doms_2
= num
+1;
132 ref
->hdr_ref_dom
[num
].ptr_dom_sid
= 1; /* dom sid cannot be NULL. */
134 init_unistr2(&ref
->ref_dom
[num
].uni_dom_name
, dom_name
, UNI_FLAGS_NONE
);
135 init_uni_hdr(&ref
->hdr_ref_dom
[num
].hdr_dom_name
, &ref
->ref_dom
[num
].uni_dom_name
);
137 init_dom_sid2(&ref
->ref_dom
[num
].ref_dom
, dom_sid
);
142 /***************************************************************************
143 lookup_lsa_rids. Must be called as root for lookup_name to work.
144 ***************************************************************************/
146 static NTSTATUS
lookup_lsa_rids(TALLOC_CTX
*mem_ctx
,
152 uint32
*pmapped_count
)
154 uint32 mapped_count
, i
;
156 SMB_ASSERT(num_entries
<= MAX_LOOKUP_SIDS
);
161 for (i
= 0; i
< num_entries
; i
++) {
167 enum SID_NAME_USE type
= SID_NAME_UNKNOWN
;
169 /* Split name into domain and user component */
171 full_name
= rpcstr_pull_unistr2_talloc(mem_ctx
, &name
[i
]);
172 if (full_name
== NULL
) {
173 DEBUG(0, ("pull_ucs2_talloc failed\n"));
174 return NT_STATUS_NO_MEMORY
;
177 DEBUG(5, ("lookup_lsa_rids: looking up name %s\n", full_name
));
179 /* We can ignore the result of lookup_name, it will not touch
180 "type" if it's not successful */
182 lookup_name(mem_ctx
, full_name
, flags
, &domain
, NULL
,
187 case SID_NAME_DOM_GRP
:
188 case SID_NAME_DOMAIN
:
190 case SID_NAME_WKN_GRP
:
191 DEBUG(5, ("init_lsa_rids: %s found\n", full_name
));
192 /* Leave these unchanged */
195 /* Don't hand out anything but the list above */
196 DEBUG(5, ("init_lsa_rids: %s not found\n", full_name
));
197 type
= SID_NAME_UNKNOWN
;
204 if (type
!= SID_NAME_UNKNOWN
) {
205 sid_split_rid(&sid
, &rid
);
206 dom_idx
= init_dom_ref(ref
, domain
, &sid
);
210 init_dom_rid(&prid
[i
], rid
, type
, dom_idx
);
213 *pmapped_count
= mapped_count
;
217 /***************************************************************************
218 lookup_lsa_sids. Must be called as root for lookup_name to work.
219 ***************************************************************************/
221 static NTSTATUS
lookup_lsa_sids(TALLOC_CTX
*mem_ctx
,
223 LSA_TRANSLATED_SID3
*trans_sids
,
227 uint32
*pmapped_count
)
229 uint32 mapped_count
, i
;
231 SMB_ASSERT(num_entries
<= MAX_LOOKUP_SIDS
);
236 for (i
= 0; i
< num_entries
; i
++) {
242 enum SID_NAME_USE type
= SID_NAME_UNKNOWN
;
244 /* Split name into domain and user component */
246 full_name
= rpcstr_pull_unistr2_talloc(mem_ctx
, &name
[i
]);
247 if (full_name
== NULL
) {
248 DEBUG(0, ("pull_ucs2_talloc failed\n"));
249 return NT_STATUS_NO_MEMORY
;
252 DEBUG(5, ("init_lsa_sids: looking up name %s\n", full_name
));
254 /* We can ignore the result of lookup_name, it will not touch
255 "type" if it's not successful */
257 lookup_name(mem_ctx
, full_name
, flags
, &domain
, NULL
,
262 case SID_NAME_DOM_GRP
:
263 case SID_NAME_DOMAIN
:
265 case SID_NAME_WKN_GRP
:
266 DEBUG(5, ("init_lsa_sids: %s found\n", full_name
));
267 /* Leave these unchanged */
270 /* Don't hand out anything but the list above */
271 DEBUG(5, ("init_lsa_sids: %s not found\n", full_name
));
272 type
= SID_NAME_UNKNOWN
;
279 if (type
!= SID_NAME_UNKNOWN
) {
281 sid_copy(&domain_sid
, &sid
);
282 sid_split_rid(&domain_sid
, &rid
);
283 dom_idx
= init_dom_ref(ref
, domain
, &domain_sid
);
287 /* Initialize the LSA_TRANSLATED_SID3 return. */
288 trans_sids
[i
].sid_type
= type
;
289 trans_sids
[i
].sid2
= TALLOC_P(mem_ctx
, DOM_SID2
);
290 if (trans_sids
[i
].sid2
== NULL
) {
291 return NT_STATUS_NO_MEMORY
;
293 init_dom_sid2(trans_sids
[i
].sid2
, &sid
);
294 trans_sids
[i
].sid_idx
= dom_idx
;
297 *pmapped_count
= mapped_count
;
301 /***************************************************************************
302 init_reply_lookup_names
303 ***************************************************************************/
305 static void init_reply_lookup_names(LSA_R_LOOKUP_NAMES
*r_l
,
306 DOM_R_REF
*ref
, uint32 num_entries
,
307 DOM_RID
*rid
, uint32 mapped_count
)
309 r_l
->ptr_dom_ref
= 1;
312 r_l
->num_entries
= num_entries
;
313 r_l
->ptr_entries
= 1;
314 r_l
->num_entries2
= num_entries
;
317 r_l
->mapped_count
= mapped_count
;
320 /***************************************************************************
321 init_reply_lookup_names2
322 ***************************************************************************/
324 static void init_reply_lookup_names2(LSA_R_LOOKUP_NAMES2
*r_l
,
325 DOM_R_REF
*ref
, uint32 num_entries
,
326 DOM_RID2
*rid
, uint32 mapped_count
)
328 r_l
->ptr_dom_ref
= 1;
331 r_l
->num_entries
= num_entries
;
332 r_l
->ptr_entries
= 1;
333 r_l
->num_entries2
= num_entries
;
336 r_l
->mapped_count
= mapped_count
;
339 /***************************************************************************
340 init_reply_lookup_names3
341 ***************************************************************************/
343 static void init_reply_lookup_names3(LSA_R_LOOKUP_NAMES3
*r_l
,
344 DOM_R_REF
*ref
, uint32 num_entries
,
345 LSA_TRANSLATED_SID3
*trans_sids
, uint32 mapped_count
)
347 r_l
->ptr_dom_ref
= 1;
350 r_l
->num_entries
= num_entries
;
351 r_l
->ptr_entries
= 1;
352 r_l
->num_entries2
= num_entries
;
353 r_l
->trans_sids
= trans_sids
;
355 r_l
->mapped_count
= mapped_count
;
358 /***************************************************************************
359 init_reply_lookup_names4
360 ***************************************************************************/
362 static void init_reply_lookup_names4(LSA_R_LOOKUP_NAMES4
*r_l
,
363 DOM_R_REF
*ref
, uint32 num_entries
,
364 LSA_TRANSLATED_SID3
*trans_sids
, uint32 mapped_count
)
366 r_l
->ptr_dom_ref
= 1;
369 r_l
->num_entries
= num_entries
;
370 r_l
->ptr_entries
= 1;
371 r_l
->num_entries2
= num_entries
;
372 r_l
->trans_sids
= trans_sids
;
374 r_l
->mapped_count
= mapped_count
;
377 /***************************************************************************
378 Init_reply_lookup_sids.
379 ***************************************************************************/
381 static void init_reply_lookup_sids2(LSA_R_LOOKUP_SIDS2
*r_l
,
383 LSA_TRANS_NAME_ENUM2
*names
,
386 r_l
->ptr_dom_ref
= ref
? 1 : 0;
389 r_l
->mapped_count
= mapped_count
;
392 /***************************************************************************
393 Init_reply_lookup_sids.
394 ***************************************************************************/
396 static void init_reply_lookup_sids3(LSA_R_LOOKUP_SIDS3
*r_l
,
398 LSA_TRANS_NAME_ENUM2
*names
,
401 r_l
->ptr_dom_ref
= ref
? 1 : 0;
404 r_l
->mapped_count
= mapped_count
;
407 /***************************************************************************
408 Init_reply_lookup_sids.
409 ***************************************************************************/
411 static NTSTATUS
init_reply_lookup_sids(TALLOC_CTX
*mem_ctx
,
412 LSA_R_LOOKUP_SIDS
*r_l
,
414 LSA_TRANS_NAME_ENUM2
*names
,
417 LSA_TRANS_NAME_ENUM
*oldnames
= TALLOC_ZERO_P(mem_ctx
, LSA_TRANS_NAME_ENUM
);
420 return NT_STATUS_NO_MEMORY
;
423 oldnames
->num_entries
= names
->num_entries
;
424 oldnames
->ptr_trans_names
= names
->ptr_trans_names
;
425 oldnames
->num_entries2
= names
->num_entries2
;
426 oldnames
->uni_name
= names
->uni_name
;
428 if (names
->num_entries
) {
431 oldnames
->name
= TALLOC_ARRAY(oldnames
, LSA_TRANS_NAME
, names
->num_entries
);
433 if (!oldnames
->name
) {
434 return NT_STATUS_NO_MEMORY
;
436 for (i
= 0; i
< names
->num_entries
; i
++) {
437 oldnames
->name
[i
].sid_name_use
= names
->name
[i
].sid_name_use
;
438 oldnames
->name
[i
].hdr_name
= names
->name
[i
].hdr_name
;
439 oldnames
->name
[i
].domain_idx
= names
->name
[i
].domain_idx
;
443 r_l
->ptr_dom_ref
= ref
? 1 : 0;
445 r_l
->names
= oldnames
;
446 r_l
->mapped_count
= mapped_count
;
450 static NTSTATUS
lsa_get_generic_sd(TALLOC_CTX
*mem_ctx
, SEC_DESC
**sd
, size_t *sd_size
)
452 DOM_SID local_adm_sid
;
460 init_sec_access(&mask
, POLICY_EXECUTE
);
461 init_sec_ace(&ace
[0], &global_sid_World
, SEC_ACE_TYPE_ACCESS_ALLOWED
, mask
, 0);
463 sid_copy(&adm_sid
, get_global_sam_sid());
464 sid_append_rid(&adm_sid
, DOMAIN_GROUP_RID_ADMINS
);
465 init_sec_access(&mask
, POLICY_ALL_ACCESS
);
466 init_sec_ace(&ace
[1], &adm_sid
, SEC_ACE_TYPE_ACCESS_ALLOWED
, mask
, 0);
468 sid_copy(&local_adm_sid
, &global_sid_Builtin
);
469 sid_append_rid(&local_adm_sid
, BUILTIN_ALIAS_RID_ADMINS
);
470 init_sec_access(&mask
, POLICY_ALL_ACCESS
);
471 init_sec_ace(&ace
[2], &local_adm_sid
, SEC_ACE_TYPE_ACCESS_ALLOWED
, mask
, 0);
473 if((psa
= make_sec_acl(mem_ctx
, NT4_ACL_REVISION
, 3, ace
)) == NULL
)
474 return NT_STATUS_NO_MEMORY
;
476 if((*sd
= make_sec_desc(mem_ctx
, SEC_DESC_REVISION
, SEC_DESC_SELF_RELATIVE
, &adm_sid
, NULL
, NULL
, psa
, sd_size
)) == NULL
)
477 return NT_STATUS_NO_MEMORY
;
482 #if 0 /* AD DC work in ongoing in Samba 4 */
484 /***************************************************************************
486 ***************************************************************************/
488 static void init_dns_dom_info(LSA_DNS_DOM_INFO
*r_l
, const char *nb_name
,
489 const char *dns_name
, const char *forest_name
,
490 struct uuid
*dom_guid
, DOM_SID
*dom_sid
)
492 if (nb_name
&& *nb_name
) {
493 init_unistr2(&r_l
->uni_nb_dom_name
, nb_name
, UNI_FLAGS_NONE
);
494 init_uni_hdr(&r_l
->hdr_nb_dom_name
, &r_l
->uni_nb_dom_name
);
495 r_l
->hdr_nb_dom_name
.uni_max_len
+= 2;
496 r_l
->uni_nb_dom_name
.uni_max_len
+= 1;
499 if (dns_name
&& *dns_name
) {
500 init_unistr2(&r_l
->uni_dns_dom_name
, dns_name
, UNI_FLAGS_NONE
);
501 init_uni_hdr(&r_l
->hdr_dns_dom_name
, &r_l
->uni_dns_dom_name
);
502 r_l
->hdr_dns_dom_name
.uni_max_len
+= 2;
503 r_l
->uni_dns_dom_name
.uni_max_len
+= 1;
506 if (forest_name
&& *forest_name
) {
507 init_unistr2(&r_l
->uni_forest_name
, forest_name
, UNI_FLAGS_NONE
);
508 init_uni_hdr(&r_l
->hdr_forest_name
, &r_l
->uni_forest_name
);
509 r_l
->hdr_forest_name
.uni_max_len
+= 2;
510 r_l
->uni_forest_name
.uni_max_len
+= 1;
513 /* how do we init the guid ? probably should write an init fn */
515 memcpy(&r_l
->dom_guid
, dom_guid
, sizeof(struct uuid
));
519 r_l
->ptr_dom_sid
= 1;
520 init_dom_sid2(&r_l
->dom_sid
, dom_sid
);
523 #endif /* AD DC work in ongoing in Samba 4 */
526 /***************************************************************************
528 ***************************************************************************/
530 NTSTATUS
_lsa_open_policy2(pipes_struct
*p
, LSA_Q_OPEN_POL2
*q_u
, LSA_R_OPEN_POL2
*r_u
)
532 struct lsa_info
*info
;
533 SEC_DESC
*psd
= NULL
;
535 uint32 des_access
=q_u
->des_access
;
540 /* map the generic bits to the lsa policy ones */
541 se_map_generic(&des_access
, &lsa_generic_mapping
);
543 /* get the generic lsa policy SD until we store it */
544 lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
546 if(!se_access_check(psd
, p
->pipe_user
.nt_user_token
, des_access
, &acc_granted
, &status
)) {
547 if (geteuid() != 0) {
550 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
551 acc_granted
, des_access
));
552 DEBUGADD(4,("but overwritten by euid == 0\n"));
555 /* This is needed for lsa_open_account and rpcclient .... :-) */
558 acc_granted
= POLICY_ALL_ACCESS
;
560 /* associate the domain SID with the (unique) handle. */
561 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
562 return NT_STATUS_NO_MEMORY
;
565 sid_copy(&info
->sid
,get_global_sam_sid());
566 info
->access
= acc_granted
;
568 /* set up the LSA QUERY INFO response */
569 if (!create_policy_hnd(p
, &r_u
->pol
, free_lsa_info
, (void *)info
))
570 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
575 /***************************************************************************
577 ***************************************************************************/
579 NTSTATUS
_lsa_open_policy(pipes_struct
*p
, LSA_Q_OPEN_POL
*q_u
, LSA_R_OPEN_POL
*r_u
)
581 struct lsa_info
*info
;
582 SEC_DESC
*psd
= NULL
;
584 uint32 des_access
=q_u
->des_access
;
589 /* map the generic bits to the lsa policy ones */
590 se_map_generic(&des_access
, &lsa_generic_mapping
);
592 /* get the generic lsa policy SD until we store it */
593 lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
595 if(!se_access_check(psd
, p
->pipe_user
.nt_user_token
, des_access
, &acc_granted
, &status
)) {
596 if (geteuid() != 0) {
599 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
600 acc_granted
, des_access
));
601 DEBUGADD(4,("but overwritten by euid == 0\n"));
602 acc_granted
= des_access
;
605 /* associate the domain SID with the (unique) handle. */
606 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
607 return NT_STATUS_NO_MEMORY
;
610 sid_copy(&info
->sid
,get_global_sam_sid());
611 info
->access
= acc_granted
;
613 /* set up the LSA QUERY INFO response */
614 if (!create_policy_hnd(p
, &r_u
->pol
, free_lsa_info
, (void *)info
))
615 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
620 /***************************************************************************
621 _lsa_enum_trust_dom - this needs fixing to do more than return NULL ! JRA.
623 ***************************************************************************/
625 NTSTATUS
_lsa_enum_trust_dom(pipes_struct
*p
, LSA_Q_ENUM_TRUST_DOM
*q_u
,
626 LSA_R_ENUM_TRUST_DOM
*r_u
)
628 struct lsa_info
*info
;
630 struct trustdom_info
**domains
;
633 * preferred length is set to 5 as a "our" preferred length
634 * nt sets this parameter to 2
635 * update (20.08.2002): it's not preferred length, but preferred size!
636 * it needs further investigation how to optimally choose this value
638 uint32 max_num_domains
=
639 q_u
->preferred_len
< 5 ? q_u
->preferred_len
: 10;
644 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
645 return NT_STATUS_INVALID_HANDLE
;
647 /* check if the user have enough rights */
648 if (!(info
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
649 return NT_STATUS_ACCESS_DENIED
;
651 nt_status
= secrets_trusted_domains(p
->mem_ctx
, &num_domains
,
654 if (!NT_STATUS_IS_OK(nt_status
)) {
658 if (q_u
->enum_context
< num_domains
) {
659 num_thistime
= MIN(num_domains
, max_num_domains
);
661 r_u
->status
= STATUS_MORE_ENTRIES
;
663 if (q_u
->enum_context
+ num_thistime
> num_domains
) {
664 num_thistime
= num_domains
- q_u
->enum_context
;
665 r_u
->status
= NT_STATUS_OK
;
668 next_idx
= q_u
->enum_context
+ num_thistime
;
671 next_idx
= 0xffffffff;
672 r_u
->status
= NT_STATUS_NO_MORE_ENTRIES
;
675 /* set up the lsa_enum_trust_dom response */
677 init_r_enum_trust_dom(p
->mem_ctx
, r_u
, next_idx
,
678 num_thistime
, domains
+q_u
->enum_context
);
683 /***************************************************************************
684 _lsa_query_info. See the POLICY_INFOMATION_CLASS docs at msdn.
685 ***************************************************************************/
687 NTSTATUS
_lsa_query_info(pipes_struct
*p
, LSA_Q_QUERY_INFO
*q_u
, LSA_R_QUERY_INFO
*r_u
)
689 struct lsa_info
*handle
;
690 LSA_INFO_CTR
*ctr
= &r_u
->ctr
;
695 r_u
->status
= NT_STATUS_OK
;
697 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
698 return NT_STATUS_INVALID_HANDLE
;
700 switch (q_u
->info_class
) {
704 uint32 policy_def
= LSA_AUDIT_POLICY_ALL
;
706 /* check if the user have enough rights */
707 if (!(handle
->access
& POLICY_VIEW_AUDIT_INFORMATION
)) {
708 DEBUG(10,("_lsa_query_info: insufficient access rights\n"));
709 return NT_STATUS_ACCESS_DENIED
;
712 /* fake info: We audit everything. ;) */
713 ctr
->info
.id2
.ptr
= 1;
714 ctr
->info
.id2
.auditing_enabled
= True
;
715 ctr
->info
.id2
.count1
= ctr
->info
.id2
.count2
= LSA_AUDIT_NUM_CATEGORIES
;
717 if ((ctr
->info
.id2
.auditsettings
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, uint32
, LSA_AUDIT_NUM_CATEGORIES
)) == NULL
)
718 return NT_STATUS_NO_MEMORY
;
720 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_ACCOUNT_MANAGEMENT
] = policy_def
;
721 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_FILE_AND_OBJECT_ACCESS
] = policy_def
;
722 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_LOGON
] = policy_def
;
723 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_PROCCESS_TRACKING
] = policy_def
;
724 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_SECURITY_POLICY_CHANGES
] = policy_def
;
725 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_SYSTEM
] = policy_def
;
726 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_USE_OF_USER_RIGHTS
] = policy_def
;
731 /* check if the user have enough rights */
732 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
733 return NT_STATUS_ACCESS_DENIED
;
735 /* Request PolicyPrimaryDomainInformation. */
736 switch (lp_server_role()) {
737 case ROLE_DOMAIN_PDC
:
738 case ROLE_DOMAIN_BDC
:
739 name
= get_global_sam_name();
740 sid
= get_global_sam_sid();
742 case ROLE_DOMAIN_MEMBER
:
743 name
= lp_workgroup();
744 /* We need to return the Domain SID here. */
745 if (secrets_fetch_domain_sid(lp_workgroup(), &domain_sid
))
748 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
750 case ROLE_STANDALONE
:
751 name
= lp_workgroup();
755 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
757 init_dom_query_3(&r_u
->ctr
.info
.id3
, name
, sid
);
760 /* check if the user have enough rights */
761 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
762 return NT_STATUS_ACCESS_DENIED
;
764 /* Request PolicyAccountDomainInformation. */
765 name
= get_global_sam_name();
766 sid
= get_global_sam_sid();
767 init_dom_query_5(&r_u
->ctr
.info
.id5
, name
, sid
);
770 /* check if the user have enough rights */
771 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
772 return NT_STATUS_ACCESS_DENIED
;
774 switch (lp_server_role()) {
775 case ROLE_DOMAIN_BDC
:
777 * only a BDC is a backup controller
778 * of the domain, it controls.
780 ctr
->info
.id6
.server_role
= 2;
784 * any other role is a primary
785 * of the domain, it controls.
787 ctr
->info
.id6
.server_role
= 3;
792 DEBUG(0,("_lsa_query_info: unknown info level in Lsa Query: %d\n", q_u
->info_class
));
793 r_u
->status
= NT_STATUS_INVALID_INFO_CLASS
;
797 if (NT_STATUS_IS_OK(r_u
->status
)) {
798 r_u
->dom_ptr
= 0x22000000; /* bizarre */
799 ctr
->info_class
= q_u
->info_class
;
805 /***************************************************************************
806 _lsa_lookup_sids_internal
807 ***************************************************************************/
809 static NTSTATUS
_lsa_lookup_sids_internal(pipes_struct
*p
,
810 uint16 level
, /* input */
811 int num_sids
, /* input */
812 const DOM_SID2
*sid
, /* input */
813 DOM_R_REF
**pp_ref
, /* output */
814 LSA_TRANS_NAME_ENUM2
**pp_names
, /* output */
815 uint32
*pp_mapped_count
)
819 const DOM_SID
**sids
= NULL
;
820 LSA_TRANS_NAME_ENUM2
*names
= NULL
;
821 DOM_R_REF
*ref
= NULL
;
822 uint32 mapped_count
= 0;
823 struct lsa_dom_info
*dom_infos
= NULL
;
824 struct lsa_name_info
*name_infos
= NULL
;
826 *pp_mapped_count
= 0;
830 names
= TALLOC_ZERO_P(p
->mem_ctx
, LSA_TRANS_NAME_ENUM2
);
831 sids
= TALLOC_ARRAY(p
->mem_ctx
, const DOM_SID
*, num_sids
);
832 ref
= TALLOC_ZERO_P(p
->mem_ctx
, DOM_R_REF
);
834 if (sids
== NULL
|| names
== NULL
|| ref
== NULL
) {
835 return NT_STATUS_NO_MEMORY
;
838 for (i
=0; i
<num_sids
; i
++) {
839 sids
[i
] = &sid
[i
].sid
;
842 status
= lookup_sids(p
->mem_ctx
, num_sids
, sids
, level
,
843 &dom_infos
, &name_infos
);
845 if (!NT_STATUS_IS_OK(status
)) {
850 names
->name
= TALLOC_ARRAY(names
, LSA_TRANS_NAME2
, num_sids
);
851 names
->uni_name
= TALLOC_ARRAY(names
, UNISTR2
, num_sids
);
852 if ((names
->name
== NULL
) || (names
->uni_name
== NULL
)) {
853 return NT_STATUS_NO_MEMORY
;
857 for (i
=0; i
<MAX_REF_DOMAINS
; i
++) {
859 if (!dom_infos
[i
].valid
) {
863 if (init_dom_ref(ref
, dom_infos
[i
].name
,
864 &dom_infos
[i
].sid
) != i
) {
865 DEBUG(0, ("Domain %s mentioned twice??\n",
867 return NT_STATUS_INTERNAL_ERROR
;
871 for (i
=0; i
<num_sids
; i
++) {
872 struct lsa_name_info
*name
= &name_infos
[i
];
874 if (name
->type
== SID_NAME_UNKNOWN
) {
876 /* unknown sids should return the string representation of the SID */
877 name
->name
= talloc_asprintf(p
->mem_ctx
, "%s",
878 sid_string_static(sids
[i
]));
879 if (name
->name
== NULL
) {
880 return NT_STATUS_NO_MEMORY
;
885 init_lsa_trans_name2(&names
->name
[i
], &names
->uni_name
[i
],
886 name
->type
, name
->name
, name
->dom_idx
);
889 names
->num_entries
= num_sids
;
890 names
->ptr_trans_names
= 1;
891 names
->num_entries2
= num_sids
;
893 status
= NT_STATUS_NONE_MAPPED
;
894 if (mapped_count
> 0) {
895 status
= (mapped_count
< num_sids
) ?
896 STATUS_SOME_UNMAPPED
: NT_STATUS_OK
;
899 DEBUG(10, ("num_sids %d, mapped_count %d, status %s\n",
900 num_sids
, mapped_count
, nt_errstr(status
)));
902 *pp_mapped_count
= mapped_count
;
909 /***************************************************************************
911 ***************************************************************************/
913 NTSTATUS
_lsa_lookup_sids(pipes_struct
*p
,
914 LSA_Q_LOOKUP_SIDS
*q_u
,
915 LSA_R_LOOKUP_SIDS
*r_u
)
917 struct lsa_info
*handle
;
918 int num_sids
= q_u
->sids
.num_entries
;
919 uint32 mapped_count
= 0;
920 DOM_R_REF
*ref
= NULL
;
921 LSA_TRANS_NAME_ENUM2
*names
= NULL
;
924 if ((q_u
->level
< 1) || (q_u
->level
> 6)) {
925 return NT_STATUS_INVALID_PARAMETER
;
928 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
)) {
929 return NT_STATUS_INVALID_HANDLE
;
932 /* check if the user has enough rights */
933 if (!(handle
->access
& POLICY_LOOKUP_NAMES
)) {
934 return NT_STATUS_ACCESS_DENIED
;
937 if (num_sids
> MAX_LOOKUP_SIDS
) {
938 DEBUG(5,("_lsa_lookup_sids: limit of %d exceeded, requested %d\n",
939 MAX_LOOKUP_SIDS
, num_sids
));
940 return NT_STATUS_NONE_MAPPED
;
943 r_u
->status
= _lsa_lookup_sids_internal(p
,
951 /* Convert from LSA_TRANS_NAME_ENUM2 to LSA_TRANS_NAME_ENUM */
953 status
= init_reply_lookup_sids(p
->mem_ctx
, r_u
, ref
, names
, mapped_count
);
954 if (!NT_STATUS_IS_OK(status
)) {
960 /***************************************************************************
962 ***************************************************************************/
964 NTSTATUS
_lsa_lookup_sids2(pipes_struct
*p
,
965 LSA_Q_LOOKUP_SIDS2
*q_u
,
966 LSA_R_LOOKUP_SIDS2
*r_u
)
968 struct lsa_info
*handle
;
969 int num_sids
= q_u
->sids
.num_entries
;
970 uint32 mapped_count
= 0;
971 DOM_R_REF
*ref
= NULL
;
972 LSA_TRANS_NAME_ENUM2
*names
= NULL
;
974 if ((q_u
->level
< 1) || (q_u
->level
> 6)) {
975 return NT_STATUS_INVALID_PARAMETER
;
978 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
)) {
979 return NT_STATUS_INVALID_HANDLE
;
982 /* check if the user have enough rights */
983 if (!(handle
->access
& POLICY_LOOKUP_NAMES
)) {
984 return NT_STATUS_ACCESS_DENIED
;
987 if (num_sids
> MAX_LOOKUP_SIDS
) {
988 DEBUG(5,("_lsa_lookup_sids2: limit of %d exceeded, requested %d\n",
989 MAX_LOOKUP_SIDS
, num_sids
));
990 return NT_STATUS_NONE_MAPPED
;
993 r_u
->status
= _lsa_lookup_sids_internal(p
,
1001 init_reply_lookup_sids2(r_u
, ref
, names
, mapped_count
);
1005 /***************************************************************************
1007 ***************************************************************************/
1009 NTSTATUS
_lsa_lookup_sids3(pipes_struct
*p
,
1010 LSA_Q_LOOKUP_SIDS3
*q_u
,
1011 LSA_R_LOOKUP_SIDS3
*r_u
)
1013 int num_sids
= q_u
->sids
.num_entries
;
1014 uint32 mapped_count
= 0;
1015 DOM_R_REF
*ref
= NULL
;
1016 LSA_TRANS_NAME_ENUM2
*names
= NULL
;
1018 if ((q_u
->level
< 1) || (q_u
->level
> 6)) {
1019 return NT_STATUS_INVALID_PARAMETER
;
1022 /* No policy handle on this call. Restrict to crypto connections. */
1023 if (p
->auth
.auth_type
!= PIPE_AUTH_TYPE_SCHANNEL
) {
1024 DEBUG(0,("_lsa_lookup_sids3: client %s not using schannel for netlogon\n",
1025 get_remote_machine_name() ));
1026 return NT_STATUS_INVALID_PARAMETER
;
1029 if (num_sids
> MAX_LOOKUP_SIDS
) {
1030 DEBUG(5,("_lsa_lookup_sids3: limit of %d exceeded, requested %d\n",
1031 MAX_LOOKUP_SIDS
, num_sids
));
1032 return NT_STATUS_NONE_MAPPED
;
1035 r_u
->status
= _lsa_lookup_sids_internal(p
,
1043 init_reply_lookup_sids3(r_u
, ref
, names
, mapped_count
);
1047 /***************************************************************************
1048 lsa_reply_lookup_names
1049 ***************************************************************************/
1051 NTSTATUS
_lsa_lookup_names(pipes_struct
*p
,LSA_Q_LOOKUP_NAMES
*q_u
, LSA_R_LOOKUP_NAMES
*r_u
)
1053 struct lsa_info
*handle
;
1054 UNISTR2
*names
= q_u
->uni_name
;
1055 uint32 num_entries
= q_u
->num_entries
;
1058 uint32 mapped_count
= 0;
1061 if (num_entries
> MAX_LOOKUP_SIDS
) {
1062 num_entries
= MAX_LOOKUP_SIDS
;
1063 DEBUG(5,("_lsa_lookup_names: truncating name lookup list to %d\n", num_entries
));
1066 /* Probably the lookup_level is some sort of bitmask. */
1067 if (q_u
->lookup_level
== 1) {
1068 flags
= LOOKUP_NAME_ALL
;
1071 ref
= TALLOC_ZERO_P(p
->mem_ctx
, DOM_R_REF
);
1072 rids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, DOM_RID
, num_entries
);
1074 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
)) {
1075 r_u
->status
= NT_STATUS_INVALID_HANDLE
;
1079 /* check if the user have enough rights */
1080 if (!(handle
->access
& POLICY_LOOKUP_NAMES
)) {
1081 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
1086 return NT_STATUS_NO_MEMORY
;
1088 /* set up the LSA Lookup RIDs response */
1089 become_root(); /* lookup_name can require root privs */
1090 r_u
->status
= lookup_lsa_rids(p
->mem_ctx
, ref
, rids
, num_entries
,
1091 names
, flags
, &mapped_count
);
1096 if (NT_STATUS_IS_OK(r_u
->status
) && (num_entries
!= 0) ) {
1097 if (mapped_count
== 0)
1098 r_u
->status
= NT_STATUS_NONE_MAPPED
;
1099 else if (mapped_count
!= num_entries
)
1100 r_u
->status
= STATUS_SOME_UNMAPPED
;
1103 init_reply_lookup_names(r_u
, ref
, num_entries
, rids
, mapped_count
);
1107 /***************************************************************************
1108 lsa_reply_lookup_names2
1109 ***************************************************************************/
1111 NTSTATUS
_lsa_lookup_names2(pipes_struct
*p
, LSA_Q_LOOKUP_NAMES2
*q_u
, LSA_R_LOOKUP_NAMES2
*r_u
)
1113 struct lsa_info
*handle
;
1114 UNISTR2
*names
= q_u
->uni_name
;
1115 uint32 num_entries
= q_u
->num_entries
;
1120 uint32 mapped_count
= 0;
1123 if (num_entries
> MAX_LOOKUP_SIDS
) {
1124 num_entries
= MAX_LOOKUP_SIDS
;
1125 DEBUG(5,("_lsa_lookup_names2: truncating name lookup list to %d\n", num_entries
));
1128 /* Probably the lookup_level is some sort of bitmask. */
1129 if (q_u
->lookup_level
== 1) {
1130 flags
= LOOKUP_NAME_ALL
;
1133 ref
= TALLOC_ZERO_P(p
->mem_ctx
, DOM_R_REF
);
1134 rids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, DOM_RID
, num_entries
);
1135 rids2
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, DOM_RID2
, num_entries
);
1137 if ((ref
== NULL
) || (rids
== NULL
) || (rids2
== NULL
)) {
1138 r_u
->status
= NT_STATUS_NO_MEMORY
;
1139 return NT_STATUS_NO_MEMORY
;
1142 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
)) {
1143 r_u
->status
= NT_STATUS_INVALID_HANDLE
;
1147 /* check if the user have enough rights */
1148 if (!(handle
->access
& POLICY_LOOKUP_NAMES
)) {
1149 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
1153 /* set up the LSA Lookup RIDs response */
1154 become_root(); /* lookup_name can require root privs */
1155 r_u
->status
= lookup_lsa_rids(p
->mem_ctx
, ref
, rids
, num_entries
,
1156 names
, flags
, &mapped_count
);
1161 if (NT_STATUS_IS_OK(r_u
->status
)) {
1162 if (mapped_count
== 0) {
1163 r_u
->status
= NT_STATUS_NONE_MAPPED
;
1164 } else if (mapped_count
!= num_entries
) {
1165 r_u
->status
= STATUS_SOME_UNMAPPED
;
1169 /* Convert the rids array to rids2. */
1170 for (i
= 0; i
< num_entries
; i
++) {
1171 rids2
[i
].type
= rids
[i
].type
;
1172 rids2
[i
].rid
= rids
[i
].rid
;
1173 rids2
[i
].rid_idx
= rids
[i
].rid_idx
;
1174 rids2
[i
].unknown
= 0;
1177 init_reply_lookup_names2(r_u
, ref
, num_entries
, rids2
, mapped_count
);
1181 /***************************************************************************
1182 lsa_reply_lookup_names3.
1183 ***************************************************************************/
1185 NTSTATUS
_lsa_lookup_names3(pipes_struct
*p
, LSA_Q_LOOKUP_NAMES3
*q_u
, LSA_R_LOOKUP_NAMES3
*r_u
)
1187 struct lsa_info
*handle
;
1188 UNISTR2
*names
= q_u
->uni_name
;
1189 uint32 num_entries
= q_u
->num_entries
;
1190 DOM_R_REF
*ref
= NULL
;
1191 LSA_TRANSLATED_SID3
*trans_sids
= NULL
;
1192 uint32 mapped_count
= 0;
1195 if (num_entries
> MAX_LOOKUP_SIDS
) {
1196 num_entries
= MAX_LOOKUP_SIDS
;
1197 DEBUG(5,("_lsa_lookup_names3: truncating name lookup list to %d\n", num_entries
));
1200 /* Probably the lookup_level is some sort of bitmask. */
1201 if (q_u
->lookup_level
== 1) {
1202 flags
= LOOKUP_NAME_ALL
;
1205 ref
= TALLOC_ZERO_P(p
->mem_ctx
, DOM_R_REF
);
1206 trans_sids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, LSA_TRANSLATED_SID3
, num_entries
);
1208 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
)) {
1209 r_u
->status
= NT_STATUS_INVALID_HANDLE
;
1213 /* check if the user have enough rights */
1214 if (!(handle
->access
& POLICY_LOOKUP_NAMES
)) {
1215 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
1219 if (!ref
|| !trans_sids
) {
1220 return NT_STATUS_NO_MEMORY
;
1223 /* set up the LSA Lookup SIDs response */
1224 become_root(); /* lookup_name can require root privs */
1225 r_u
->status
= lookup_lsa_sids(p
->mem_ctx
, ref
, trans_sids
, num_entries
,
1226 names
, flags
, &mapped_count
);
1231 if (NT_STATUS_IS_OK(r_u
->status
)) {
1232 if (mapped_count
== 0) {
1233 r_u
->status
= NT_STATUS_NONE_MAPPED
;
1234 } else if (mapped_count
!= num_entries
) {
1235 r_u
->status
= STATUS_SOME_UNMAPPED
;
1239 init_reply_lookup_names3(r_u
, ref
, num_entries
, trans_sids
, mapped_count
);
1243 /***************************************************************************
1244 lsa_reply_lookup_names4.
1245 ***************************************************************************/
1247 NTSTATUS
_lsa_lookup_names4(pipes_struct
*p
, LSA_Q_LOOKUP_NAMES4
*q_u
, LSA_R_LOOKUP_NAMES4
*r_u
)
1249 UNISTR2
*names
= q_u
->uni_name
;
1250 uint32 num_entries
= q_u
->num_entries
;
1251 DOM_R_REF
*ref
= NULL
;
1252 LSA_TRANSLATED_SID3
*trans_sids
= NULL
;
1253 uint32 mapped_count
= 0;
1256 if (num_entries
> MAX_LOOKUP_SIDS
) {
1257 num_entries
= MAX_LOOKUP_SIDS
;
1258 DEBUG(5,("_lsa_lookup_names4: truncating name lookup list to %d\n", num_entries
));
1261 /* Probably the lookup_level is some sort of bitmask. */
1262 if (q_u
->lookup_level
== 1) {
1263 flags
= LOOKUP_NAME_ALL
;
1266 /* No policy handle on this call. Restrict to crypto connections. */
1267 if (p
->auth
.auth_type
!= PIPE_AUTH_TYPE_SCHANNEL
) {
1268 DEBUG(0,("_lsa_lookup_names4: client %s not using schannel for netlogon\n",
1269 get_remote_machine_name() ));
1270 return NT_STATUS_INVALID_PARAMETER
;
1273 ref
= TALLOC_ZERO_P(p
->mem_ctx
, DOM_R_REF
);
1274 trans_sids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, LSA_TRANSLATED_SID3
, num_entries
);
1276 if (!ref
|| !trans_sids
) {
1277 return NT_STATUS_NO_MEMORY
;
1280 /* set up the LSA Lookup SIDs response */
1281 become_root(); /* lookup_name can require root privs */
1282 r_u
->status
= lookup_lsa_sids(p
->mem_ctx
, ref
, trans_sids
, num_entries
,
1283 names
, flags
, &mapped_count
);
1286 if (NT_STATUS_IS_OK(r_u
->status
)) {
1287 if (mapped_count
== 0) {
1288 r_u
->status
= NT_STATUS_NONE_MAPPED
;
1289 } else if (mapped_count
!= num_entries
) {
1290 r_u
->status
= STATUS_SOME_UNMAPPED
;
1294 init_reply_lookup_names4(r_u
, ref
, num_entries
, trans_sids
, mapped_count
);
1298 /***************************************************************************
1299 _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
1300 ***************************************************************************/
1302 NTSTATUS
_lsa_close(pipes_struct
*p
, LSA_Q_CLOSE
*q_u
, LSA_R_CLOSE
*r_u
)
1304 if (!find_policy_by_hnd(p
, &q_u
->pol
, NULL
)) {
1305 return NT_STATUS_INVALID_HANDLE
;
1308 close_policy_hnd(p
, &q_u
->pol
);
1309 return NT_STATUS_OK
;
1312 /***************************************************************************
1313 ***************************************************************************/
1315 NTSTATUS
_lsa_open_secret(pipes_struct
*p
, LSA_Q_OPEN_SECRET
*q_u
, LSA_R_OPEN_SECRET
*r_u
)
1317 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1320 /***************************************************************************
1321 ***************************************************************************/
1323 NTSTATUS
_lsa_open_trusted_domain(pipes_struct
*p
, LSA_Q_OPEN_TRUSTED_DOMAIN
*q_u
, LSA_R_OPEN_TRUSTED_DOMAIN
*r_u
)
1325 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1328 /***************************************************************************
1329 ***************************************************************************/
1331 NTSTATUS
_lsa_create_trusted_domain(pipes_struct
*p
, LSA_Q_CREATE_TRUSTED_DOMAIN
*q_u
, LSA_R_CREATE_TRUSTED_DOMAIN
*r_u
)
1333 return NT_STATUS_ACCESS_DENIED
;
1336 /***************************************************************************
1337 ***************************************************************************/
1339 NTSTATUS
_lsa_create_secret(pipes_struct
*p
, LSA_Q_CREATE_SECRET
*q_u
, LSA_R_CREATE_SECRET
*r_u
)
1341 return NT_STATUS_ACCESS_DENIED
;
1344 /***************************************************************************
1345 ***************************************************************************/
1347 NTSTATUS
_lsa_set_secret(pipes_struct
*p
, LSA_Q_SET_SECRET
*q_u
, LSA_R_SET_SECRET
*r_u
)
1349 return NT_STATUS_ACCESS_DENIED
;
1352 /***************************************************************************
1353 ***************************************************************************/
1355 NTSTATUS
_lsa_delete_object(pipes_struct
*p
, LSA_Q_DELETE_OBJECT
*q_u
, LSA_R_DELETE_OBJECT
*r_u
)
1357 return NT_STATUS_ACCESS_DENIED
;
1360 /***************************************************************************
1362 ***************************************************************************/
1364 NTSTATUS
_lsa_enum_privs(pipes_struct
*p
, LSA_Q_ENUM_PRIVS
*q_u
, LSA_R_ENUM_PRIVS
*r_u
)
1366 struct lsa_info
*handle
;
1368 uint32 enum_context
= q_u
->enum_context
;
1369 int num_privs
= count_all_privileges();
1370 LSA_PRIV_ENTRY
*entries
= NULL
;
1373 /* remember that the enum_context starts at 0 and not 1 */
1375 if ( enum_context
>= num_privs
)
1376 return NT_STATUS_NO_MORE_ENTRIES
;
1378 DEBUG(10,("_lsa_enum_privs: enum_context:%d total entries:%d\n",
1379 enum_context
, num_privs
));
1381 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1382 return NT_STATUS_INVALID_HANDLE
;
1384 /* check if the user have enough rights
1385 I don't know if it's the right one. not documented. */
1387 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
1388 return NT_STATUS_ACCESS_DENIED
;
1390 if ( !(entries
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, LSA_PRIV_ENTRY
, num_privs
)) )
1391 return NT_STATUS_NO_MEMORY
;
1393 for (i
= 0; i
< num_privs
; i
++) {
1394 if( i
< enum_context
) {
1395 init_unistr2(&entries
[i
].name
, NULL
, UNI_FLAGS_NONE
);
1396 init_uni_hdr(&entries
[i
].hdr_name
, &entries
[i
].name
);
1398 entries
[i
].luid_low
= 0;
1399 entries
[i
].luid_high
= 0;
1401 init_unistr2(&entries
[i
].name
, privs
[i
].name
, UNI_FLAGS_NONE
);
1402 init_uni_hdr(&entries
[i
].hdr_name
, &entries
[i
].name
);
1404 luid
= get_privilege_luid( &privs
[i
].se_priv
);
1406 entries
[i
].luid_low
= luid
.luid
.low
;
1407 entries
[i
].luid_high
= luid
.luid
.high
;
1411 enum_context
= num_privs
;
1413 init_lsa_r_enum_privs(r_u
, enum_context
, num_privs
, entries
);
1415 return NT_STATUS_OK
;
1418 /***************************************************************************
1419 _lsa_priv_get_dispname.
1420 ***************************************************************************/
1422 NTSTATUS
_lsa_priv_get_dispname(pipes_struct
*p
, LSA_Q_PRIV_GET_DISPNAME
*q_u
, LSA_R_PRIV_GET_DISPNAME
*r_u
)
1424 struct lsa_info
*handle
;
1426 const char *description
;
1428 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1429 return NT_STATUS_INVALID_HANDLE
;
1431 /* check if the user have enough rights */
1434 * I don't know if it's the right one. not documented.
1436 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
1437 return NT_STATUS_ACCESS_DENIED
;
1439 unistr2_to_ascii(name_asc
, &q_u
->name
, sizeof(name_asc
));
1441 DEBUG(10,("_lsa_priv_get_dispname: name = %s\n", name_asc
));
1443 description
= get_privilege_dispname( name_asc
);
1445 if ( description
) {
1446 DEBUG(10,("_lsa_priv_get_dispname: display name = %s\n", description
));
1448 init_unistr2(&r_u
->desc
, description
, UNI_FLAGS_NONE
);
1449 init_uni_hdr(&r_u
->hdr_desc
, &r_u
->desc
);
1451 r_u
->ptr_info
= 0xdeadbeef;
1452 r_u
->lang_id
= q_u
->lang_id
;
1454 return NT_STATUS_OK
;
1456 DEBUG(10,("_lsa_priv_get_dispname: doesn't exist\n"));
1460 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1464 /***************************************************************************
1466 ***************************************************************************/
1468 NTSTATUS
_lsa_enum_accounts(pipes_struct
*p
, LSA_Q_ENUM_ACCOUNTS
*q_u
, LSA_R_ENUM_ACCOUNTS
*r_u
)
1470 struct lsa_info
*handle
;
1472 int i
, j
, num_entries
;
1473 LSA_SID_ENUM
*sids
=&r_u
->sids
;
1476 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1477 return NT_STATUS_INVALID_HANDLE
;
1479 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
1480 return NT_STATUS_ACCESS_DENIED
;
1485 /* The only way we can currently find out all the SIDs that have been
1486 privileged is to scan all privileges */
1488 if (!NT_STATUS_IS_OK(ret
= privilege_enumerate_accounts(&sid_list
, &num_entries
))) {
1492 if (q_u
->enum_context
>= num_entries
)
1493 return NT_STATUS_NO_MORE_ENTRIES
;
1495 sids
->ptr_sid
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, uint32
, num_entries
-q_u
->enum_context
);
1496 sids
->sid
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, DOM_SID2
, num_entries
-q_u
->enum_context
);
1498 if (sids
->ptr_sid
==NULL
|| sids
->sid
==NULL
) {
1499 SAFE_FREE(sid_list
);
1500 return NT_STATUS_NO_MEMORY
;
1503 for (i
= q_u
->enum_context
, j
= 0; i
< num_entries
; i
++, j
++) {
1504 init_dom_sid2(&(*sids
).sid
[j
], &sid_list
[i
]);
1505 (*sids
).ptr_sid
[j
] = 1;
1508 SAFE_FREE(sid_list
);
1510 init_lsa_r_enum_accounts(r_u
, num_entries
);
1512 return NT_STATUS_OK
;
1516 NTSTATUS
_lsa_unk_get_connuser(pipes_struct
*p
, LSA_Q_UNK_GET_CONNUSER
*q_u
, LSA_R_UNK_GET_CONNUSER
*r_u
)
1518 fstring username
, domname
;
1519 user_struct
*vuser
= get_valid_user_struct(p
->vuid
);
1522 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
1524 fstrcpy(username
, vuser
->user
.smb_name
);
1525 fstrcpy(domname
, vuser
->user
.domain
);
1527 r_u
->ptr_user_name
= 1;
1528 init_unistr2(&r_u
->uni2_user_name
, username
, UNI_STR_TERMINATE
);
1529 init_uni_hdr(&r_u
->hdr_user_name
, &r_u
->uni2_user_name
);
1533 r_u
->ptr_dom_name
= 1;
1534 init_unistr2(&r_u
->uni2_dom_name
, domname
, UNI_STR_TERMINATE
);
1535 init_uni_hdr(&r_u
->hdr_dom_name
, &r_u
->uni2_dom_name
);
1537 r_u
->status
= NT_STATUS_OK
;
1542 /***************************************************************************
1544 ***************************************************************************/
1546 NTSTATUS
_lsa_create_account(pipes_struct
*p
, LSA_Q_CREATEACCOUNT
*q_u
, LSA_R_CREATEACCOUNT
*r_u
)
1548 struct lsa_info
*handle
;
1549 struct lsa_info
*info
;
1551 /* find the connection policy handle. */
1552 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1553 return NT_STATUS_INVALID_HANDLE
;
1555 /* check if the user have enough rights */
1558 * I don't know if it's the right one. not documented.
1559 * but guessed with rpcclient.
1561 if (!(handle
->access
& POLICY_GET_PRIVATE_INFORMATION
))
1562 return NT_STATUS_ACCESS_DENIED
;
1564 /* check to see if the pipe_user is a Domain Admin since
1565 account_pol.tdb was already opened as root, this is all we have */
1567 if ( !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1568 return NT_STATUS_ACCESS_DENIED
;
1570 if ( is_privileged_sid( &q_u
->sid
.sid
) )
1571 return NT_STATUS_OBJECT_NAME_COLLISION
;
1573 /* associate the user/group SID with the (unique) handle. */
1575 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
1576 return NT_STATUS_NO_MEMORY
;
1579 info
->sid
= q_u
->sid
.sid
;
1580 info
->access
= q_u
->access
;
1582 /* get a (unique) handle. open a policy on it. */
1583 if (!create_policy_hnd(p
, &r_u
->pol
, free_lsa_info
, (void *)info
))
1584 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1586 return privilege_create_account( &info
->sid
);
1590 /***************************************************************************
1592 ***************************************************************************/
1594 NTSTATUS
_lsa_open_account(pipes_struct
*p
, LSA_Q_OPENACCOUNT
*q_u
, LSA_R_OPENACCOUNT
*r_u
)
1596 struct lsa_info
*handle
;
1597 struct lsa_info
*info
;
1599 /* find the connection policy handle. */
1600 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1601 return NT_STATUS_INVALID_HANDLE
;
1603 /* check if the user have enough rights */
1606 * I don't know if it's the right one. not documented.
1607 * but guessed with rpcclient.
1609 if (!(handle
->access
& POLICY_GET_PRIVATE_INFORMATION
))
1610 return NT_STATUS_ACCESS_DENIED
;
1612 /* TODO: Fis the parsing routine before reenabling this check! */
1614 if (!lookup_sid(&handle
->sid
, dom_name
, name
, &type
))
1615 return NT_STATUS_ACCESS_DENIED
;
1617 /* associate the user/group SID with the (unique) handle. */
1618 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
1619 return NT_STATUS_NO_MEMORY
;
1622 info
->sid
= q_u
->sid
.sid
;
1623 info
->access
= q_u
->access
;
1625 /* get a (unique) handle. open a policy on it. */
1626 if (!create_policy_hnd(p
, &r_u
->pol
, free_lsa_info
, (void *)info
))
1627 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1629 return NT_STATUS_OK
;
1632 /***************************************************************************
1633 For a given SID, enumerate all the privilege this account has.
1634 ***************************************************************************/
1636 NTSTATUS
_lsa_enum_privsaccount(pipes_struct
*p
, prs_struct
*ps
, LSA_Q_ENUMPRIVSACCOUNT
*q_u
, LSA_R_ENUMPRIVSACCOUNT
*r_u
)
1638 struct lsa_info
*info
=NULL
;
1640 PRIVILEGE_SET privileges
;
1642 /* find the connection policy handle. */
1643 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1644 return NT_STATUS_INVALID_HANDLE
;
1646 if ( !get_privileges_for_sids( &mask
, &info
->sid
, 1 ) )
1647 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1649 privilege_set_init( &privileges
);
1651 if ( se_priv_to_privilege_set( &privileges
, &mask
) ) {
1653 DEBUG(10,("_lsa_enum_privsaccount: %s has %d privileges\n",
1654 sid_string_static(&info
->sid
), privileges
.count
));
1656 r_u
->status
= init_lsa_r_enum_privsaccount(ps
->mem_ctx
, r_u
, privileges
.set
, privileges
.count
, 0);
1659 r_u
->status
= NT_STATUS_NO_SUCH_PRIVILEGE
;
1661 privilege_set_free( &privileges
);
1666 /***************************************************************************
1668 ***************************************************************************/
1670 NTSTATUS
_lsa_getsystemaccount(pipes_struct
*p
, LSA_Q_GETSYSTEMACCOUNT
*q_u
, LSA_R_GETSYSTEMACCOUNT
*r_u
)
1672 struct lsa_info
*info
=NULL
;
1674 /* find the connection policy handle. */
1676 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1677 return NT_STATUS_INVALID_HANDLE
;
1679 if (!lookup_sid(p
->mem_ctx
, &info
->sid
, NULL
, NULL
, NULL
))
1680 return NT_STATUS_ACCESS_DENIED
;
1683 0x01 -> Log on locally
1684 0x02 -> Access this computer from network
1685 0x04 -> Log on as a batch job
1686 0x10 -> Log on as a service
1688 they can be ORed together
1691 r_u
->access
= PR_LOG_ON_LOCALLY
| PR_ACCESS_FROM_NETWORK
;
1693 return NT_STATUS_OK
;
1696 /***************************************************************************
1697 update the systemaccount information
1698 ***************************************************************************/
1700 NTSTATUS
_lsa_setsystemaccount(pipes_struct
*p
, LSA_Q_SETSYSTEMACCOUNT
*q_u
, LSA_R_SETSYSTEMACCOUNT
*r_u
)
1702 struct lsa_info
*info
=NULL
;
1704 r_u
->status
= NT_STATUS_OK
;
1706 /* find the connection policy handle. */
1707 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1708 return NT_STATUS_INVALID_HANDLE
;
1710 /* check to see if the pipe_user is a Domain Admin since
1711 account_pol.tdb was already opened as root, this is all we have */
1713 if ( !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1714 return NT_STATUS_ACCESS_DENIED
;
1716 if (!pdb_getgrsid(&map
, info
->sid
))
1717 return NT_STATUS_NO_SUCH_GROUP
;
1719 return pdb_update_group_mapping_entry(&map
);
1722 /***************************************************************************
1723 For a given SID, add some privileges.
1724 ***************************************************************************/
1726 NTSTATUS
_lsa_addprivs(pipes_struct
*p
, LSA_Q_ADDPRIVS
*q_u
, LSA_R_ADDPRIVS
*r_u
)
1728 struct lsa_info
*info
= NULL
;
1730 PRIVILEGE_SET
*set
= NULL
;
1731 struct current_user user
;
1733 /* find the connection policy handle. */
1734 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1735 return NT_STATUS_INVALID_HANDLE
;
1737 /* check to see if the pipe_user is root or a Domain Admin since
1738 account_pol.tdb was already opened as root, this is all we have */
1740 get_current_user( &user
, p
);
1741 if ( user
.ut
.uid
!= sec_initial_uid()
1742 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1744 return NT_STATUS_ACCESS_DENIED
;
1749 if ( !privilege_set_to_se_priv( &mask
, set
) )
1750 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1752 if ( !grant_privilege( &info
->sid
, &mask
) ) {
1753 DEBUG(3,("_lsa_addprivs: grant_privilege(%s) failed!\n",
1754 sid_string_static(&info
->sid
) ));
1755 DEBUG(3,("Privilege mask:\n"));
1756 dump_se_priv( DBGC_ALL
, 3, &mask
);
1757 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1760 return NT_STATUS_OK
;
1763 /***************************************************************************
1764 For a given SID, remove some privileges.
1765 ***************************************************************************/
1767 NTSTATUS
_lsa_removeprivs(pipes_struct
*p
, LSA_Q_REMOVEPRIVS
*q_u
, LSA_R_REMOVEPRIVS
*r_u
)
1769 struct lsa_info
*info
= NULL
;
1771 PRIVILEGE_SET
*set
= NULL
;
1772 struct current_user user
;
1774 /* find the connection policy handle. */
1775 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1776 return NT_STATUS_INVALID_HANDLE
;
1778 /* check to see if the pipe_user is root or a Domain Admin since
1779 account_pol.tdb was already opened as root, this is all we have */
1781 get_current_user( &user
, p
);
1782 if ( user
.ut
.uid
!= sec_initial_uid()
1783 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1785 return NT_STATUS_ACCESS_DENIED
;
1790 if ( !privilege_set_to_se_priv( &mask
, set
) )
1791 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1793 if ( !revoke_privilege( &info
->sid
, &mask
) ) {
1794 DEBUG(3,("_lsa_removeprivs: revoke_privilege(%s) failed!\n",
1795 sid_string_static(&info
->sid
) ));
1796 DEBUG(3,("Privilege mask:\n"));
1797 dump_se_priv( DBGC_ALL
, 3, &mask
);
1798 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1801 return NT_STATUS_OK
;
1804 /***************************************************************************
1805 For a given SID, remove some privileges.
1806 ***************************************************************************/
1808 NTSTATUS
_lsa_query_secobj(pipes_struct
*p
, LSA_Q_QUERY_SEC_OBJ
*q_u
, LSA_R_QUERY_SEC_OBJ
*r_u
)
1810 struct lsa_info
*handle
=NULL
;
1811 SEC_DESC
*psd
= NULL
;
1815 r_u
->status
= NT_STATUS_OK
;
1817 /* find the connection policy handle. */
1818 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1819 return NT_STATUS_INVALID_HANDLE
;
1821 /* check if the user have enough rights */
1822 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
1823 return NT_STATUS_ACCESS_DENIED
;
1826 switch (q_u
->sec_info
) {
1828 /* SD contains only the owner */
1830 status
=lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
1831 if(!NT_STATUS_IS_OK(status
))
1832 return NT_STATUS_NO_MEMORY
;
1835 if((r_u
->buf
= make_sec_desc_buf(p
->mem_ctx
, sd_size
, psd
)) == NULL
)
1836 return NT_STATUS_NO_MEMORY
;
1839 /* SD contains only the ACL */
1841 status
=lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
1842 if(!NT_STATUS_IS_OK(status
))
1843 return NT_STATUS_NO_MEMORY
;
1845 if((r_u
->buf
= make_sec_desc_buf(p
->mem_ctx
, sd_size
, psd
)) == NULL
)
1846 return NT_STATUS_NO_MEMORY
;
1849 return NT_STATUS_INVALID_LEVEL
;
1857 #if 0 /* AD DC work in ongoing in Samba 4 */
1859 /***************************************************************************
1860 ***************************************************************************/
1862 NTSTATUS
_lsa_query_info2(pipes_struct
*p
, LSA_Q_QUERY_INFO2
*q_u
, LSA_R_QUERY_INFO2
*r_u
)
1864 struct lsa_info
*handle
;
1865 const char *nb_name
;
1866 char *dns_name
= NULL
;
1867 char *forest_name
= NULL
;
1868 DOM_SID
*sid
= NULL
;
1873 r_u
->status
= NT_STATUS_OK
;
1875 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1876 return NT_STATUS_INVALID_HANDLE
;
1878 switch (q_u
->info_class
) {
1880 /* check if the user have enough rights */
1881 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
1882 return NT_STATUS_ACCESS_DENIED
;
1884 /* Request PolicyPrimaryDomainInformation. */
1885 switch (lp_server_role()) {
1886 case ROLE_DOMAIN_PDC
:
1887 case ROLE_DOMAIN_BDC
:
1888 nb_name
= get_global_sam_name();
1889 /* ugly temp hack for these next two */
1891 /* This should be a 'netbios domain -> DNS domain' mapping */
1892 dnsdomname
[0] = '\0';
1893 get_mydnsdomname(dnsdomname
);
1894 strlower_m(dnsdomname
);
1896 dns_name
= dnsdomname
;
1897 forest_name
= dnsdomname
;
1899 sid
= get_global_sam_sid();
1900 secrets_fetch_domain_guid(lp_workgroup(), &guid
);
1903 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
1905 init_dns_dom_info(&r_u
->info
.dns_dom_info
, nb_name
, dns_name
,
1906 forest_name
,&guid
,sid
);
1909 DEBUG(0,("_lsa_query_info2: unknown info level in Lsa Query: %d\n", q_u
->info_class
));
1910 r_u
->status
= NT_STATUS_INVALID_INFO_CLASS
;
1914 if (NT_STATUS_IS_OK(r_u
->status
)) {
1916 r_u
->info_class
= q_u
->info_class
;
1921 #endif /* AD DC work in ongoing in Samba 4 */
1923 /***************************************************************************
1924 ***************************************************************************/
1926 NTSTATUS
_lsa_add_acct_rights(pipes_struct
*p
, LSA_Q_ADD_ACCT_RIGHTS
*q_u
, LSA_R_ADD_ACCT_RIGHTS
*r_u
)
1928 struct lsa_info
*info
= NULL
;
1932 UNISTR4_ARRAY
*uni_privnames
= q_u
->rights
;
1933 struct current_user user
;
1936 /* find the connection policy handle. */
1937 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1938 return NT_STATUS_INVALID_HANDLE
;
1940 /* check to see if the pipe_user is a Domain Admin since
1941 account_pol.tdb was already opened as root, this is all we have */
1943 get_current_user( &user
, p
);
1944 if ( user
.ut
.uid
!= sec_initial_uid()
1945 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1947 return NT_STATUS_ACCESS_DENIED
;
1950 /* according to an NT4 PDC, you can add privileges to SIDs even without
1951 call_lsa_create_account() first. And you can use any arbitrary SID. */
1953 sid_copy( &sid
, &q_u
->sid
.sid
);
1955 /* just a little sanity check */
1957 if ( q_u
->count
!= uni_privnames
->count
) {
1958 DEBUG(0,("_lsa_add_acct_rights: count != number of UNISTR2 elements!\n"));
1959 return NT_STATUS_INVALID_HANDLE
;
1962 for ( i
=0; i
<q_u
->count
; i
++ ) {
1963 UNISTR4
*uni4_str
= &uni_privnames
->strings
[i
];
1965 /* only try to add non-null strings */
1967 if ( !uni4_str
->string
)
1970 rpcstr_pull( privname
, uni4_str
->string
->buffer
, sizeof(privname
), -1, STR_TERMINATE
);
1972 if ( !grant_privilege_by_name( &sid
, privname
) ) {
1973 DEBUG(2,("_lsa_add_acct_rights: Failed to add privilege [%s]\n", privname
));
1974 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1978 return NT_STATUS_OK
;
1981 /***************************************************************************
1982 ***************************************************************************/
1984 NTSTATUS
_lsa_remove_acct_rights(pipes_struct
*p
, LSA_Q_REMOVE_ACCT_RIGHTS
*q_u
, LSA_R_REMOVE_ACCT_RIGHTS
*r_u
)
1986 struct lsa_info
*info
= NULL
;
1990 UNISTR4_ARRAY
*uni_privnames
= q_u
->rights
;
1991 struct current_user user
;
1994 /* find the connection policy handle. */
1995 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1996 return NT_STATUS_INVALID_HANDLE
;
1998 /* check to see if the pipe_user is a Domain Admin since
1999 account_pol.tdb was already opened as root, this is all we have */
2001 get_current_user( &user
, p
);
2002 if ( user
.ut
.uid
!= sec_initial_uid()
2003 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
2005 return NT_STATUS_ACCESS_DENIED
;
2008 sid_copy( &sid
, &q_u
->sid
.sid
);
2010 if ( q_u
->removeall
) {
2011 if ( !revoke_all_privileges( &sid
) )
2012 return NT_STATUS_ACCESS_DENIED
;
2014 return NT_STATUS_OK
;
2017 /* just a little sanity check */
2019 if ( q_u
->count
!= uni_privnames
->count
) {
2020 DEBUG(0,("_lsa_add_acct_rights: count != number of UNISTR2 elements!\n"));
2021 return NT_STATUS_INVALID_HANDLE
;
2024 for ( i
=0; i
<q_u
->count
; i
++ ) {
2025 UNISTR4
*uni4_str
= &uni_privnames
->strings
[i
];
2027 /* only try to add non-null strings */
2029 if ( !uni4_str
->string
)
2032 rpcstr_pull( privname
, uni4_str
->string
->buffer
, sizeof(privname
), -1, STR_TERMINATE
);
2034 if ( !revoke_privilege_by_name( &sid
, privname
) ) {
2035 DEBUG(2,("_lsa_remove_acct_rights: Failed to revoke privilege [%s]\n", privname
));
2036 return NT_STATUS_NO_SUCH_PRIVILEGE
;
2040 return NT_STATUS_OK
;
2044 /***************************************************************************
2045 ***************************************************************************/
2047 NTSTATUS
_lsa_enum_acct_rights(pipes_struct
*p
, LSA_Q_ENUM_ACCT_RIGHTS
*q_u
, LSA_R_ENUM_ACCT_RIGHTS
*r_u
)
2049 struct lsa_info
*info
= NULL
;
2051 PRIVILEGE_SET privileges
;
2055 /* find the connection policy handle. */
2057 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
2058 return NT_STATUS_INVALID_HANDLE
;
2060 /* according to an NT4 PDC, you can add privileges to SIDs even without
2061 call_lsa_create_account() first. And you can use any arbitrary SID. */
2063 sid_copy( &sid
, &q_u
->sid
.sid
);
2065 if ( !get_privileges_for_sids( &mask
, &sid
, 1 ) )
2066 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
2068 privilege_set_init( &privileges
);
2070 if ( se_priv_to_privilege_set( &privileges
, &mask
) ) {
2072 DEBUG(10,("_lsa_enum_acct_rights: %s has %d privileges\n",
2073 sid_string_static(&sid
), privileges
.count
));
2075 r_u
->status
= init_r_enum_acct_rights( r_u
, &privileges
);
2078 r_u
->status
= NT_STATUS_NO_SUCH_PRIVILEGE
;
2080 privilege_set_free( &privileges
);
2086 /***************************************************************************
2087 ***************************************************************************/
2089 NTSTATUS
_lsa_lookup_priv_value(pipes_struct
*p
, LSA_Q_LOOKUP_PRIV_VALUE
*q_u
, LSA_R_LOOKUP_PRIV_VALUE
*r_u
)
2091 struct lsa_info
*info
= NULL
;
2093 LUID_ATTR priv_luid
;
2096 /* find the connection policy handle. */
2098 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
2099 return NT_STATUS_INVALID_HANDLE
;
2101 unistr2_to_ascii(name
, &q_u
->privname
.unistring
, sizeof(name
));
2103 DEBUG(10,("_lsa_lookup_priv_value: name = %s\n", name
));
2105 if ( !se_priv_from_name( name
, &mask
) )
2106 return NT_STATUS_NO_SUCH_PRIVILEGE
;
2108 priv_luid
= get_privilege_luid( &mask
);
2110 r_u
->luid
.low
= priv_luid
.luid
.low
;
2111 r_u
->luid
.high
= priv_luid
.luid
.high
;
2114 return NT_STATUS_OK
;