2 Samba Unix/Linux SMB client library
3 Distributed SMB/CIFS Server Management Utility
4 Copyright (C) Gerald (Jerry) Carter 2004
5 Copyright (C) Guenther Deschner 2008
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>. */
21 #include "utils/net.h"
23 /********************************************************************
24 ********************************************************************/
26 static NTSTATUS
sid_to_name(struct rpc_pipe_client
*pipe_hnd
,
32 enum lsa_SidType
*sid_types
= NULL
;
34 char **domains
= NULL
, **names
= NULL
;
36 result
= rpccli_lsa_open_policy(pipe_hnd
, mem_ctx
, True
,
37 SEC_RIGHTS_MAXIMUM_ALLOWED
, &pol
);
39 if ( !NT_STATUS_IS_OK(result
) )
42 result
= rpccli_lsa_lookup_sids(pipe_hnd
, mem_ctx
, &pol
, 1, sid
, &domains
, &names
, &sid_types
);
44 if ( NT_STATUS_IS_OK(result
) ) {
46 fstr_sprintf( name
, "%s\\%s", domains
[0], names
[0] );
48 fstrcpy( name
, names
[0] );
51 rpccli_lsa_Close(pipe_hnd
, mem_ctx
, &pol
);
55 /********************************************************************
56 ********************************************************************/
58 static NTSTATUS
name_to_sid(struct rpc_pipe_client
*pipe_hnd
,
60 DOM_SID
*sid
, const char *name
)
63 enum lsa_SidType
*sid_types
;
67 /* maybe its a raw SID */
68 if ( strncmp(name
, "S-", 2) == 0 && string_to_sid(sid
, name
) ) {
72 result
= rpccli_lsa_open_policy(pipe_hnd
, mem_ctx
, True
,
73 SEC_RIGHTS_MAXIMUM_ALLOWED
, &pol
);
75 if ( !NT_STATUS_IS_OK(result
) )
78 result
= rpccli_lsa_lookup_names(pipe_hnd
, mem_ctx
, &pol
, 1, &name
,
79 NULL
, 1, &sids
, &sid_types
);
81 if ( NT_STATUS_IS_OK(result
) )
82 sid_copy( sid
, &sids
[0] );
84 rpccli_lsa_Close(pipe_hnd
, mem_ctx
, &pol
);
88 /********************************************************************
89 ********************************************************************/
91 static NTSTATUS
enum_privileges(struct rpc_pipe_client
*pipe_hnd
,
96 uint32 enum_context
= 0;
97 uint32 pref_max_length
=0x1000;
100 uint16 lang_id_sys
=0;
102 struct lsa_StringLarge
*description
= NULL
;
103 struct lsa_PrivArray priv_array
;
105 result
= rpccli_lsa_EnumPrivs(pipe_hnd
, ctx
,
111 if ( !NT_STATUS_IS_OK(result
) )
116 for (i
= 0; i
< priv_array
.count
; i
++) {
118 struct lsa_String lsa_name
;
121 priv_array
.privs
[i
].name
.string
? priv_array
.privs
[i
].name
.string
: "*unknown*" );
123 /* try to get the description */
125 init_lsa_String(&lsa_name
, priv_array
.privs
[i
].name
.string
);
127 result
= rpccli_lsa_LookupPrivDisplayName(pipe_hnd
, ctx
,
135 if (!NT_STATUS_IS_OK(result
)) {
136 d_printf("??????\n");
140 d_printf("%s\n", description
->string
);
146 /********************************************************************
147 ********************************************************************/
149 static NTSTATUS
check_privilege_for_user(struct rpc_pipe_client
*pipe_hnd
,
156 struct lsa_RightSet rights
;
159 result
= rpccli_lsa_EnumAccountRights(pipe_hnd
, ctx
,
164 if (!NT_STATUS_IS_OK(result
)) {
168 if (rights
.count
== 0) {
169 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
172 for (i
= 0; i
< rights
.count
; i
++) {
173 if (StrCaseCmp(rights
.names
[i
].string
, right
) == 0) {
178 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
181 /********************************************************************
182 ********************************************************************/
184 static NTSTATUS
enum_privileges_for_user(struct rpc_pipe_client
*pipe_hnd
,
190 struct lsa_RightSet rights
;
193 result
= rpccli_lsa_EnumAccountRights(pipe_hnd
, ctx
,
198 if (!NT_STATUS_IS_OK(result
))
201 if (rights
.count
== 0) {
202 d_printf("No privileges assigned\n");
205 for (i
= 0; i
< rights
.count
; i
++) {
206 printf("%s\n", rights
.names
[i
].string
);
212 /********************************************************************
213 ********************************************************************/
215 static NTSTATUS
enum_accounts_for_privilege(struct rpc_pipe_client
*pipe_hnd
,
218 const char *privilege
)
221 uint32 enum_context
=0;
222 uint32 pref_max_length
=0x1000;
223 struct lsa_SidArray sid_array
;
227 result
= rpccli_lsa_EnumAccounts(pipe_hnd
, ctx
,
233 if (!NT_STATUS_IS_OK(result
))
236 d_printf("%s:\n", privilege
);
238 for ( i
=0; i
<sid_array
.num_sids
; i
++ ) {
240 result
= check_privilege_for_user(pipe_hnd
, ctx
, pol
,
241 sid_array
.sids
[i
].sid
,
244 if ( ! NT_STATUS_IS_OK(result
)) {
245 if ( ! NT_STATUS_EQUAL(result
, NT_STATUS_OBJECT_NAME_NOT_FOUND
)) {
251 /* try to convert the SID to a name. Fall back to
252 printing the raw SID if necessary */
253 result
= sid_to_name( pipe_hnd
, ctx
, sid_array
.sids
[i
].sid
, name
);
254 if ( !NT_STATUS_IS_OK (result
) )
255 sid_to_fstring(name
, sid_array
.sids
[i
].sid
);
257 d_printf(" %s\n", name
);
263 /********************************************************************
264 ********************************************************************/
266 static NTSTATUS
enum_privileges_for_accounts(struct rpc_pipe_client
*pipe_hnd
,
271 uint32 enum_context
=0;
272 uint32 pref_max_length
=0x1000;
273 struct lsa_SidArray sid_array
;
277 result
= rpccli_lsa_EnumAccounts(pipe_hnd
, ctx
,
283 if (!NT_STATUS_IS_OK(result
))
286 for ( i
=0; i
<sid_array
.num_sids
; i
++ ) {
288 /* try to convert the SID to a name. Fall back to
289 printing the raw SID if necessary */
291 result
= sid_to_name(pipe_hnd
, ctx
, sid_array
.sids
[i
].sid
, name
);
292 if ( !NT_STATUS_IS_OK (result
) )
293 sid_to_fstring(name
, sid_array
.sids
[i
].sid
);
295 d_printf("%s\n", name
);
297 result
= enum_privileges_for_user(pipe_hnd
, ctx
, pol
,
298 sid_array
.sids
[i
].sid
);
299 if ( !NT_STATUS_IS_OK(result
) )
308 /********************************************************************
309 ********************************************************************/
311 static NTSTATUS
rpc_rights_list_internal(const DOM_SID
*domain_sid
,
312 const char *domain_name
,
313 struct cli_state
*cli
,
314 struct rpc_pipe_client
*pipe_hnd
,
323 struct lsa_String lsa_name
;
324 struct lsa_StringLarge
*description
= NULL
;
326 uint16 lang_id_sys
= 0;
330 result
= rpccli_lsa_open_policy(pipe_hnd
, mem_ctx
, True
,
331 SEC_RIGHTS_MAXIMUM_ALLOWED
, &pol
);
333 if ( !NT_STATUS_IS_OK(result
) )
336 /* backwards compatibility; just list available privileges if no arguement */
339 result
= enum_privileges(pipe_hnd
, mem_ctx
, &pol
);
343 if (strequal(argv
[0], "privileges")) {
346 if (argv
[1] == NULL
) {
347 result
= enum_privileges(pipe_hnd
, mem_ctx
, &pol
);
351 while ( argv
[i
] != NULL
) {
352 fstrcpy(privname
, argv
[i
]);
353 init_lsa_String(&lsa_name
, argv
[i
]);
356 /* verify that this is a valid privilege for error reporting */
357 result
= rpccli_lsa_LookupPrivDisplayName(pipe_hnd
, mem_ctx
,
365 if ( !NT_STATUS_IS_OK(result
) ) {
366 if ( NT_STATUS_EQUAL( result
, NT_STATUS_NO_SUCH_PRIVILEGE
) )
367 d_fprintf(stderr
, "No such privilege exists: %s.\n", privname
);
369 d_fprintf(stderr
, "Error resolving privilege display name [%s].\n", nt_errstr(result
));
373 result
= enum_accounts_for_privilege(pipe_hnd
, mem_ctx
, &pol
, privname
);
374 if (!NT_STATUS_IS_OK(result
)) {
375 d_fprintf(stderr
, "Error enumerating accounts for privilege %s [%s].\n",
376 privname
, nt_errstr(result
));
383 /* special case to enumerate all privileged SIDs with associated rights */
385 if (strequal( argv
[0], "accounts")) {
388 if (argv
[1] == NULL
) {
389 result
= enum_privileges_for_accounts(pipe_hnd
, mem_ctx
, &pol
);
393 while (argv
[i
] != NULL
) {
394 result
= name_to_sid(pipe_hnd
, mem_ctx
, &sid
, argv
[i
]);
395 if (!NT_STATUS_IS_OK(result
)) {
398 result
= enum_privileges_for_user(pipe_hnd
, mem_ctx
, &pol
, &sid
);
399 if (!NT_STATUS_IS_OK(result
)) {
407 /* backward comaptibility: if no keyword provided, treat the key
408 as an account name */
410 d_printf("Usage: net rpc rights list [[accounts|privileges] [name|SID]]\n");
411 result
= NT_STATUS_OK
;
415 result
= name_to_sid(pipe_hnd
, mem_ctx
, &sid
, argv
[0]);
416 if (!NT_STATUS_IS_OK(result
)) {
419 result
= enum_privileges_for_user(pipe_hnd
, mem_ctx
, &pol
, &sid
);
422 rpccli_lsa_Close(pipe_hnd
, mem_ctx
, &pol
);
427 /********************************************************************
428 ********************************************************************/
430 static NTSTATUS
rpc_rights_grant_internal(const DOM_SID
*domain_sid
,
431 const char *domain_name
,
432 struct cli_state
*cli
,
433 struct rpc_pipe_client
*pipe_hnd
,
439 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
440 struct lsa_RightSet rights
;
446 d_printf("Usage: net rpc rights grant <name|SID> <rights...>\n");
450 result
= name_to_sid(pipe_hnd
, mem_ctx
, &sid
, argv
[0]);
451 if (!NT_STATUS_IS_OK(result
))
454 result
= rpccli_lsa_open_policy2(pipe_hnd
, mem_ctx
, True
,
455 SEC_RIGHTS_MAXIMUM_ALLOWED
,
458 if (!NT_STATUS_IS_OK(result
))
461 rights
.count
= argc
-1;
462 rights
.names
= TALLOC_ARRAY(mem_ctx
, struct lsa_StringLarge
,
465 return NT_STATUS_NO_MEMORY
;
468 for (i
=0; i
<argc
-1; i
++) {
469 init_lsa_StringLarge(&rights
.names
[i
], argv
[i
+1]);
472 result
= rpccli_lsa_AddAccountRights(pipe_hnd
, mem_ctx
,
477 if (!NT_STATUS_IS_OK(result
))
480 d_printf("Successfully granted rights.\n");
483 if ( !NT_STATUS_IS_OK(result
) ) {
484 d_fprintf(stderr
, "Failed to grant privileges for %s (%s)\n",
485 argv
[0], nt_errstr(result
));
488 rpccli_lsa_Close(pipe_hnd
, mem_ctx
, &dom_pol
);
493 /********************************************************************
494 ********************************************************************/
496 static NTSTATUS
rpc_rights_revoke_internal(const DOM_SID
*domain_sid
,
497 const char *domain_name
,
498 struct cli_state
*cli
,
499 struct rpc_pipe_client
*pipe_hnd
,
505 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
506 struct lsa_RightSet rights
;
511 d_printf("Usage: net rpc rights revoke <name|SID> <rights...>\n");
515 result
= name_to_sid(pipe_hnd
, mem_ctx
, &sid
, argv
[0]);
516 if (!NT_STATUS_IS_OK(result
))
519 result
= rpccli_lsa_open_policy2(pipe_hnd
, mem_ctx
, True
,
520 SEC_RIGHTS_MAXIMUM_ALLOWED
,
523 if (!NT_STATUS_IS_OK(result
))
526 rights
.count
= argc
-1;
527 rights
.names
= TALLOC_ARRAY(mem_ctx
, struct lsa_StringLarge
,
530 return NT_STATUS_NO_MEMORY
;
533 for (i
=0; i
<argc
-1; i
++) {
534 init_lsa_StringLarge(&rights
.names
[i
], argv
[i
+1]);
537 result
= rpccli_lsa_RemoveAccountRights(pipe_hnd
, mem_ctx
,
543 if (!NT_STATUS_IS_OK(result
))
546 d_printf("Successfully revoked rights.\n");
549 if ( !NT_STATUS_IS_OK(result
) ) {
550 d_fprintf(stderr
, "Failed to revoke privileges for %s (%s)\n",
551 argv
[0], nt_errstr(result
));
554 rpccli_lsa_Close(pipe_hnd
, mem_ctx
, &dom_pol
);
560 /********************************************************************
561 ********************************************************************/
563 static int rpc_rights_list( int argc
, const char **argv
)
565 return run_rpc_command( NULL
, PI_LSARPC
, 0,
566 rpc_rights_list_internal
, argc
, argv
);
569 /********************************************************************
570 ********************************************************************/
572 static int rpc_rights_grant( int argc
, const char **argv
)
574 return run_rpc_command( NULL
, PI_LSARPC
, 0,
575 rpc_rights_grant_internal
, argc
, argv
);
578 /********************************************************************
579 ********************************************************************/
581 static int rpc_rights_revoke( int argc
, const char **argv
)
583 return run_rpc_command( NULL
, PI_LSARPC
, 0,
584 rpc_rights_revoke_internal
, argc
, argv
);
587 /********************************************************************
588 ********************************************************************/
590 static int net_help_rights( int argc
, const char **argv
)
592 d_printf("net rpc rights list [{accounts|privileges} [name|SID]] View available or assigned privileges\n");
593 d_printf("net rpc rights grant <name|SID> <right> Assign privilege[s]\n");
594 d_printf("net rpc rights revoke <name|SID> <right> Revoke privilege[s]\n");
596 d_printf("\nBoth 'grant' and 'revoke' require a SID and a list of privilege names.\n");
597 d_printf("For example\n");
598 d_printf("\n net rpc rights grant 'VALE\\biddle' SePrintOperatorPrivilege SeDiskOperatorPrivilege\n");
599 d_printf("\nwould grant the printer admin and disk manager rights to the user 'VALE\\biddle'\n\n");
605 /********************************************************************
606 ********************************************************************/
608 int net_rpc_rights(int argc
, const char **argv
)
610 struct functable func
[] = {
611 {"list", rpc_rights_list
},
612 {"grant", rpc_rights_grant
},
613 {"revoke", rpc_rights_revoke
},
618 return net_run_function( argc
, argv
, func
, net_help_rights
);
620 return net_help_rights( argc
, argv
);
623 static NTSTATUS
rpc_sh_rights_list(TALLOC_CTX
*mem_ctx
, struct rpc_sh_ctx
*ctx
,
624 struct rpc_pipe_client
*pipe_hnd
,
625 int argc
, const char **argv
)
627 return rpc_rights_list_internal(ctx
->domain_sid
, ctx
->domain_name
,
628 ctx
->cli
, pipe_hnd
, mem_ctx
,
632 static NTSTATUS
rpc_sh_rights_grant(TALLOC_CTX
*mem_ctx
,
633 struct rpc_sh_ctx
*ctx
,
634 struct rpc_pipe_client
*pipe_hnd
,
635 int argc
, const char **argv
)
637 return rpc_rights_grant_internal(ctx
->domain_sid
, ctx
->domain_name
,
638 ctx
->cli
, pipe_hnd
, mem_ctx
,
642 static NTSTATUS
rpc_sh_rights_revoke(TALLOC_CTX
*mem_ctx
,
643 struct rpc_sh_ctx
*ctx
,
644 struct rpc_pipe_client
*pipe_hnd
,
645 int argc
, const char **argv
)
647 return rpc_rights_revoke_internal(ctx
->domain_sid
, ctx
->domain_name
,
648 ctx
->cli
, pipe_hnd
, mem_ctx
,
652 struct rpc_sh_cmd
*net_rpc_rights_cmds(TALLOC_CTX
*mem_ctx
,
653 struct rpc_sh_ctx
*ctx
)
655 static struct rpc_sh_cmd cmds
[] = {
657 { "list", NULL
, PI_LSARPC
, rpc_sh_rights_list
,
658 "View available or assigned privileges" },
660 { "grant", NULL
, PI_LSARPC
, rpc_sh_rights_grant
,
661 "Assign privilege[s]" },
663 { "revoke", NULL
, PI_LSARPC
, rpc_sh_rights_revoke
,
664 "Revoke privilege[s]" },
666 { NULL
, NULL
, 0, NULL
, NULL
}