?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-groupdb: fix enum_aliasmem in ldb branch.
[Samba.git] / source / rpc_server / srv_lsa_nt.c
blobfd6cdfab0309fa38d0d2cd493d4678c4f97c20c3
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Jeremy Allison 2001, 2006.
8 * Copyright (C) Rafal Szczesniak 2002,
9 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
10 * Copyright (C) Simo Sorce 2003.
11 * Copyright (C) Gerald (Jerry) Carter 2005.
12 * Copyright (C) Volker Lendecke 2005.
13 * Copyright (C) Guenther Deschner 2008.
14 *
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 3 of the License, or
18 * (at your option) any later version.
19 *
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
23 * GNU General Public License for more details.
24 *
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, see <http://www.gnu.org/licenses/>.
27 */
28
29 /* This is the implementation of the lsa server code. */
30
31 #include "includes.h"
32
33 #undef DBGC_CLASS
34 #define DBGC_CLASS DBGC_RPC_SRV
35
36 extern PRIVS privs[];
37
38 struct lsa_info {
39 DOM_SID sid;
40 uint32 access;
41 };
42
43 const struct generic_mapping lsa_generic_mapping = {
44 LSA_POLICY_READ,
45 LSA_POLICY_WRITE,
46 LSA_POLICY_EXECUTE,
47 LSA_POLICY_ALL_ACCESS
48 };
49
50 /***************************************************************************
51 init_lsa_ref_domain_list - adds a domain if it's not already in, returns the index.
52 ***************************************************************************/
53
54 static int init_lsa_ref_domain_list(TALLOC_CTX *mem_ctx,
55 struct lsa_RefDomainList *ref,
56 const char *dom_name,
57 DOM_SID *dom_sid)
58 {
59 int num = 0;
60
61 if (dom_name != NULL) {
62 for (num = 0; num < ref->count; num++) {
63 if (sid_equal(dom_sid, ref->domains[num].sid)) {
64 return num;
65 }
66 }
67 } else {
68 num = ref->count;
69 }
70
71 if (num >= MAX_REF_DOMAINS) {
72 /* index not found, already at maximum domain limit */
73 return -1;
74 }
75
76 ref->count = num + 1;
77 ref->max_size = MAX_REF_DOMAINS;
78
79 ref->domains = TALLOC_REALLOC_ARRAY(mem_ctx, ref->domains,
80 struct lsa_DomainInfo, ref->count);
81 if (!ref->domains) {
82 return -1;
83 }
84
85 ZERO_STRUCT(ref->domains[num]);
86
87 init_lsa_StringLarge(&ref->domains[num].name, dom_name);
88 ref->domains[num].sid = sid_dup_talloc(mem_ctx, dom_sid);
89 if (!ref->domains[num].sid) {
90 return -1;
91 }
92
93 return num;
94 }
95
96
97 /*******************************************************************
98 Function to free the per handle data.
99 ********************************************************************/
100
101 static void free_lsa_info(void *ptr)
102 {
103 struct lsa_info *lsa = (struct lsa_info *)ptr;
104
105 SAFE_FREE(lsa);
106 }
107
108 /***************************************************************************
109 initialize a lsa_DomainInfo structure.
110 ***************************************************************************/
111
112 static void init_dom_query_3(struct lsa_DomainInfo *r,
113 const char *name,
114 DOM_SID *sid)
115 {
116 init_lsa_StringLarge(&r->name, name);
117 r->sid = sid;
118 }
119
120 /***************************************************************************
121 initialize a lsa_DomainInfo structure.
122 ***************************************************************************/
123
124 static void init_dom_query_5(struct lsa_DomainInfo *r,
125 const char *name,
126 DOM_SID *sid)
127 {
128 init_lsa_StringLarge(&r->name, name);
129 r->sid = sid;
130 }
131
132 /***************************************************************************
133 lookup_lsa_rids. Must be called as root for lookup_name to work.
134 ***************************************************************************/
135
136 static NTSTATUS lookup_lsa_rids(TALLOC_CTX *mem_ctx,
137 struct lsa_RefDomainList *ref,
138 struct lsa_TranslatedSid *prid,
139 uint32_t num_entries,
140 struct lsa_String *name,
141 int flags,
142 uint32_t *pmapped_count)
143 {
144 uint32 mapped_count, i;
145
146 SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
147
148 mapped_count = 0;
149 *pmapped_count = 0;
150
151 for (i = 0; i < num_entries; i++) {
152 DOM_SID sid;
153 uint32 rid;
154 int dom_idx;
155 const char *full_name;
156 const char *domain;
157 enum lsa_SidType type = SID_NAME_UNKNOWN;
158
159 /* Split name into domain and user component */
160
161 full_name = name[i].string;
162 if (full_name == NULL) {
163 return NT_STATUS_NO_MEMORY;
164 }
165
166 DEBUG(5, ("lookup_lsa_rids: looking up name %s\n", full_name));
167
168 /* We can ignore the result of lookup_name, it will not touch
169 "type" if it's not successful */
170
171 lookup_name(mem_ctx, full_name, flags, &domain, NULL,
172 &sid, &type);
173
174 switch (type) {
175 case SID_NAME_USER:
176 case SID_NAME_DOM_GRP:
177 case SID_NAME_DOMAIN:
178 case SID_NAME_ALIAS:
179 case SID_NAME_WKN_GRP:
180 DEBUG(5, ("init_lsa_rids: %s found\n", full_name));
181 /* Leave these unchanged */
182 break;
183 default:
184 /* Don't hand out anything but the list above */
185 DEBUG(5, ("init_lsa_rids: %s not found\n", full_name));
186 type = SID_NAME_UNKNOWN;
187 break;
188 }
189
190 rid = 0;
191 dom_idx = -1;
192
193 if (type != SID_NAME_UNKNOWN) {
194 sid_split_rid(&sid, &rid);
195 dom_idx = init_lsa_ref_domain_list(mem_ctx, ref, domain, &sid);
196 mapped_count++;
197 }
198
199 init_lsa_translated_sid(&prid[i], type, rid, dom_idx);
200 }
201
202 *pmapped_count = mapped_count;
203 return NT_STATUS_OK;
204 }
205
206 /***************************************************************************
207 lookup_lsa_sids. Must be called as root for lookup_name to work.
208 ***************************************************************************/
209
210 static NTSTATUS lookup_lsa_sids(TALLOC_CTX *mem_ctx,
211 struct lsa_RefDomainList *ref,
212 struct lsa_TranslatedSid3 *trans_sids,
213 uint32_t num_entries,
214 struct lsa_String *name,
215 int flags,
216 uint32 *pmapped_count)
217 {
218 uint32 mapped_count, i;
219
220 SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
221
222 mapped_count = 0;
223 *pmapped_count = 0;
224
225 for (i = 0; i < num_entries; i++) {
226 DOM_SID sid;
227 uint32 rid;
228 int dom_idx;
229 const char *full_name;
230 const char *domain;
231 enum lsa_SidType type = SID_NAME_UNKNOWN;
232
233 ZERO_STRUCT(sid);
234
235 /* Split name into domain and user component */
236
237 full_name = name[i].string;
238 if (full_name == NULL) {
239 return NT_STATUS_NO_MEMORY;
240 }
241
242 DEBUG(5, ("init_lsa_sids: looking up name %s\n", full_name));
243
244 /* We can ignore the result of lookup_name, it will not touch
245 "type" if it's not successful */
246
247 lookup_name(mem_ctx, full_name, flags, &domain, NULL,
248 &sid, &type);
249
250 switch (type) {
251 case SID_NAME_USER:
252 case SID_NAME_DOM_GRP:
253 case SID_NAME_DOMAIN:
254 case SID_NAME_ALIAS:
255 case SID_NAME_WKN_GRP:
256 DEBUG(5, ("init_lsa_sids: %s found\n", full_name));
257 /* Leave these unchanged */
258 break;
259 default:
260 /* Don't hand out anything but the list above */
261 DEBUG(5, ("init_lsa_sids: %s not found\n", full_name));
262 type = SID_NAME_UNKNOWN;
263 break;
264 }
265
266 rid = 0;
267 dom_idx = -1;
268
269 if (type != SID_NAME_UNKNOWN) {
270 DOM_SID domain_sid;
271 sid_copy(&domain_sid, &sid);
272 sid_split_rid(&domain_sid, &rid);
273 dom_idx = init_lsa_ref_domain_list(mem_ctx, ref, domain, &domain_sid);
274 mapped_count++;
275 }
276
277 /* Initialize the lsa_TranslatedSid3 return. */
278 trans_sids[i].sid_type = type;
279 trans_sids[i].sid = sid_dup_talloc(mem_ctx, &sid);
280 trans_sids[i].sid_index = dom_idx;
281 }
282
283 *pmapped_count = mapped_count;
284 return NT_STATUS_OK;
285 }
286
287 static NTSTATUS lsa_get_generic_sd(TALLOC_CTX *mem_ctx, SEC_DESC **sd, size_t *sd_size)
288 {
289 DOM_SID local_adm_sid;
290 DOM_SID adm_sid;
291
292 SEC_ACE ace[3];
293 SEC_ACCESS mask;
294
295 SEC_ACL *psa = NULL;
296
297 init_sec_access(&mask, LSA_POLICY_EXECUTE);
298 init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
299
300 sid_copy(&adm_sid, get_global_sam_sid());
301 sid_append_rid(&adm_sid, DOMAIN_GROUP_RID_ADMINS);
302 init_sec_access(&mask, LSA_POLICY_ALL_ACCESS);
303 init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
304
305 sid_copy(&local_adm_sid, &global_sid_Builtin);
306 sid_append_rid(&local_adm_sid, BUILTIN_ALIAS_RID_ADMINS);
307 init_sec_access(&mask, LSA_POLICY_ALL_ACCESS);
308 init_sec_ace(&ace[2], &local_adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
309
310 if((psa = make_sec_acl(mem_ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
311 return NT_STATUS_NO_MEMORY;
312
313 if((*sd = make_sec_desc(mem_ctx, SECURITY_DESCRIPTOR_REVISION_1,
314 SEC_DESC_SELF_RELATIVE, &adm_sid, NULL, NULL,
315 psa, sd_size)) == NULL)
316 return NT_STATUS_NO_MEMORY;
317
318 return NT_STATUS_OK;
319 }
320
321 #if 0 /* AD DC work in ongoing in Samba 4 */
322
323 /***************************************************************************
324 Init_dns_dom_info.
325 ***************************************************************************/
326
327 static void init_dns_dom_info(LSA_DNS_DOM_INFO *r_l, const char *nb_name,
328 const char *dns_name, const char *forest_name,
329 struct GUID *dom_guid, DOM_SID *dom_sid)
330 {
331 if (nb_name && *nb_name) {
332 init_unistr2(&r_l->uni_nb_dom_name, nb_name, UNI_FLAGS_NONE);
333 init_uni_hdr(&r_l->hdr_nb_dom_name, &r_l->uni_nb_dom_name);
334 r_l->hdr_nb_dom_name.uni_max_len += 2;
335 r_l->uni_nb_dom_name.uni_max_len += 1;
336 }
337
338 if (dns_name && *dns_name) {
339 init_unistr2(&r_l->uni_dns_dom_name, dns_name, UNI_FLAGS_NONE);
340 init_uni_hdr(&r_l->hdr_dns_dom_name, &r_l->uni_dns_dom_name);
341 r_l->hdr_dns_dom_name.uni_max_len += 2;
342 r_l->uni_dns_dom_name.uni_max_len += 1;
343 }
344
345 if (forest_name && *forest_name) {
346 init_unistr2(&r_l->uni_forest_name, forest_name, UNI_FLAGS_NONE);
347 init_uni_hdr(&r_l->hdr_forest_name, &r_l->uni_forest_name);
348 r_l->hdr_forest_name.uni_max_len += 2;
349 r_l->uni_forest_name.uni_max_len += 1;
350 }
351
352 /* how do we init the guid ? probably should write an init fn */
353 if (dom_guid) {
354 memcpy(&r_l->dom_guid, dom_guid, sizeof(struct GUID));
355 }
356
357 if (dom_sid) {
358 r_l->ptr_dom_sid = 1;
359 init_dom_sid2(&r_l->dom_sid, dom_sid);
360 }
361 }
362 #endif /* AD DC work in ongoing in Samba 4 */
363
364
365 /***************************************************************************
366 _lsa_OpenPolicy2
367 ***************************************************************************/
368
369 NTSTATUS _lsa_OpenPolicy2(pipes_struct *p,
370 struct lsa_OpenPolicy2 *r)
371 {
372 struct lsa_info *info;
373 SEC_DESC *psd = NULL;
374 size_t sd_size;
375 uint32 des_access = r->in.access_mask;
376 uint32 acc_granted;
377 NTSTATUS status;
378
379
380 /* map the generic bits to the lsa policy ones */
381 se_map_generic(&des_access, &lsa_generic_mapping);
382
383 /* get the generic lsa policy SD until we store it */
384 lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
385
386 if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status)) {
387 if (p->pipe_user.ut.uid != sec_initial_uid()) {
388 return status;
389 }
390 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
391 acc_granted, des_access));
392 DEBUGADD(4,("but overwritten by euid == 0\n"));
393 }
394
395 /* This is needed for lsa_open_account and rpcclient .... :-) */
396
397 if (p->pipe_user.ut.uid == sec_initial_uid())
398 acc_granted = LSA_POLICY_ALL_ACCESS;
399
400 /* associate the domain SID with the (unique) handle. */
401 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
402 return NT_STATUS_NO_MEMORY;
403
404 ZERO_STRUCTP(info);
405 sid_copy(&info->sid,get_global_sam_sid());
406 info->access = acc_granted;
407
408 /* set up the LSA QUERY INFO response */
409 if (!create_policy_hnd(p, r->out.handle, free_lsa_info, (void *)info))
410 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
411
412 return NT_STATUS_OK;
413 }
414
415 /***************************************************************************
416 _lsa_OpenPolicy
417 ***************************************************************************/
418
419 NTSTATUS _lsa_OpenPolicy(pipes_struct *p,
420 struct lsa_OpenPolicy *r)
421 {
422 struct lsa_info *info;
423 SEC_DESC *psd = NULL;
424 size_t sd_size;
425 uint32 des_access= r->in.access_mask;
426 uint32 acc_granted;
427 NTSTATUS status;
428
429
430 /* map the generic bits to the lsa policy ones */
431 se_map_generic(&des_access, &lsa_generic_mapping);
432
433 /* get the generic lsa policy SD until we store it */
434 lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
435
436 if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status)) {
437 if (p->pipe_user.ut.uid != sec_initial_uid()) {
438 return status;
439 }
440 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
441 acc_granted, des_access));
442 DEBUGADD(4,("but overwritten by euid == 0\n"));
443 acc_granted = des_access;
444 }
445
446 /* associate the domain SID with the (unique) handle. */
447 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
448 return NT_STATUS_NO_MEMORY;
449
450 ZERO_STRUCTP(info);
451 sid_copy(&info->sid,get_global_sam_sid());
452 info->access = acc_granted;
453
454 /* set up the LSA QUERY INFO response */
455 if (!create_policy_hnd(p, r->out.handle, free_lsa_info, (void *)info))
456 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
457
458 return NT_STATUS_OK;
459 }
460
461 /***************************************************************************
462 _lsa_EnumTrustDom - this needs fixing to do more than return NULL ! JRA.
463 ufff, done :) mimir
464 ***************************************************************************/
465
466 NTSTATUS _lsa_EnumTrustDom(pipes_struct *p,
467 struct lsa_EnumTrustDom *r)
468 {
469 struct lsa_info *info;
470 uint32 next_idx;
471 struct trustdom_info **domains;
472 struct lsa_DomainInfo *lsa_domains = NULL;
473 int i;
474
475 /*
476 * preferred length is set to 5 as a "our" preferred length
477 * nt sets this parameter to 2
478 * update (20.08.2002): it's not preferred length, but preferred size!
479 * it needs further investigation how to optimally choose this value
480 */
481 uint32 max_num_domains =
482 r->in.max_size < 5 ? r->in.max_size : 10;
483 uint32 num_domains;
484 NTSTATUS nt_status;
485 uint32 num_thistime;
486
487 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
488 return NT_STATUS_INVALID_HANDLE;
489
490 /* check if the user have enough rights */
491 if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
492 return NT_STATUS_ACCESS_DENIED;
493
494 become_root();
495 nt_status = pdb_enum_trusteddoms(p->mem_ctx, &num_domains, &domains);
496 unbecome_root();
497
498 if (!NT_STATUS_IS_OK(nt_status)) {
499 return nt_status;
500 }
501
502 if (*r->in.resume_handle < num_domains) {
503 num_thistime = MIN(num_domains, max_num_domains);
504
505 nt_status = STATUS_MORE_ENTRIES;
506
507 if (*r->in.resume_handle + num_thistime > num_domains) {
508 num_thistime = num_domains - *r->in.resume_handle;
509 nt_status = NT_STATUS_OK;
510 }
511
512 next_idx = *r->in.resume_handle + num_thistime;
513 } else {
514 num_thistime = 0;
515 next_idx = 0xffffffff;
516 nt_status = NT_STATUS_NO_MORE_ENTRIES;
517 }
518
519 /* set up the lsa_enum_trust_dom response */
520
521 lsa_domains = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_DomainInfo,
522 num_thistime);
523 if (!lsa_domains) {
524 return NT_STATUS_NO_MEMORY;
525 }
526
527 for (i=0; i<num_thistime; i++) {
528 init_lsa_StringLarge(&lsa_domains[i].name, domains[i]->name);
529 lsa_domains[i].sid = &domains[i]->sid;
530 }
531
532 *r->out.resume_handle = next_idx;
533 r->out.domains->count = num_thistime;
534 r->out.domains->domains = lsa_domains;
535
536 return nt_status;
537 }
538
539 #define LSA_AUDIT_NUM_CATEGORIES_NT4 7
540 #define LSA_AUDIT_NUM_CATEGORIES_WIN2K 9
541 #define LSA_AUDIT_NUM_CATEGORIES LSA_AUDIT_NUM_CATEGORIES_NT4
542
543 /***************************************************************************
544 _lsa_QueryInfoPolicy
545 ***************************************************************************/
546
547 NTSTATUS _lsa_QueryInfoPolicy(pipes_struct *p,
548 struct lsa_QueryInfoPolicy *r)
549 {
550 NTSTATUS status = NT_STATUS_OK;
551 struct lsa_info *handle;
552 DOM_SID domain_sid;
553 const char *name;
554 DOM_SID *sid = NULL;
555 union lsa_PolicyInformation *info = NULL;
556
557 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
558 return NT_STATUS_INVALID_HANDLE;
559
560 info = TALLOC_ZERO_P(p->mem_ctx, union lsa_PolicyInformation);
561 if (!info) {
562 return NT_STATUS_NO_MEMORY;
563 }
564
565 switch (r->in.level) {
566 case 0x02:
567 {
568
569 uint32 policy_def = LSA_AUDIT_POLICY_ALL;
570
571 /* check if the user have enough rights */
572 if (!(handle->access & LSA_POLICY_VIEW_AUDIT_INFORMATION)) {
573 DEBUG(10,("_lsa_QueryInfoPolicy: insufficient access rights\n"));
574 return NT_STATUS_ACCESS_DENIED;
575 }
576
577 /* fake info: We audit everything. ;) */
578
579 info->audit_events.auditing_mode = true;
580 info->audit_events.count = LSA_AUDIT_NUM_CATEGORIES;
581 info->audit_events.settings = TALLOC_ZERO_ARRAY(p->mem_ctx,
582 enum lsa_PolicyAuditPolicy,
583 info->audit_events.count);
584 if (!info->audit_events.settings) {
585 return NT_STATUS_NO_MEMORY;
586 }
587
588 info->audit_events.settings[LSA_AUDIT_CATEGORY_ACCOUNT_MANAGEMENT] = policy_def;
589 info->audit_events.settings[LSA_AUDIT_CATEGORY_FILE_AND_OBJECT_ACCESS] = policy_def;
590 info->audit_events.settings[LSA_AUDIT_CATEGORY_LOGON] = policy_def;
591 info->audit_events.settings[LSA_AUDIT_CATEGORY_PROCCESS_TRACKING] = policy_def;
592 info->audit_events.settings[LSA_AUDIT_CATEGORY_SECURITY_POLICY_CHANGES] = policy_def;
593 info->audit_events.settings[LSA_AUDIT_CATEGORY_SYSTEM] = policy_def;
594 info->audit_events.settings[LSA_AUDIT_CATEGORY_USE_OF_USER_RIGHTS] = policy_def;
595
596 break;
597 }
598 case 0x03:
599 /* check if the user have enough rights */
600 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
601 return NT_STATUS_ACCESS_DENIED;
602
603 /* Request PolicyPrimaryDomainInformation. */
604 switch (lp_server_role()) {
605 case ROLE_DOMAIN_PDC:
606 case ROLE_DOMAIN_BDC:
607 name = get_global_sam_name();
608 sid = sid_dup_talloc(p->mem_ctx, get_global_sam_sid());
609 if (!sid) {
610 return NT_STATUS_NO_MEMORY;
611 }
612 break;
613 case ROLE_DOMAIN_MEMBER:
614 name = lp_workgroup();
615 /* We need to return the Domain SID here. */
616 if (secrets_fetch_domain_sid(lp_workgroup(), &domain_sid)) {
617 sid = sid_dup_talloc(p->mem_ctx, &domain_sid);
618 if (!sid) {
619 return NT_STATUS_NO_MEMORY;
620 }
621 } else {
622 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
623 }
624 break;
625 case ROLE_STANDALONE:
626 name = lp_workgroup();
627 sid = NULL;
628 break;
629 default:
630 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
631 }
632 init_dom_query_3(&info->domain, name, sid);
633 break;
634 case 0x05:
635 /* check if the user have enough rights */
636 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
637 return NT_STATUS_ACCESS_DENIED;
638
639 /* Request PolicyAccountDomainInformation. */
640 name = get_global_sam_name();
641 sid = get_global_sam_sid();
642
643 init_dom_query_5(&info->account_domain, name, sid);
644 break;
645 case 0x06:
646 /* check if the user have enough rights */
647 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
648 return NT_STATUS_ACCESS_DENIED;
649
650 switch (lp_server_role()) {
651 case ROLE_DOMAIN_BDC:
652 /*
653 * only a BDC is a backup controller
654 * of the domain, it controls.
655 */
656 info->role.role = 2;
657 break;
658 default:
659 /*
660 * any other role is a primary
661 * of the domain, it controls.
662 */
663 info->role.role = 3;
664 break;
665 }
666 break;
667 default:
668 DEBUG(0,("_lsa_QueryInfoPolicy: unknown info level in Lsa Query: %d\n",
669 r->in.level));
670 status = NT_STATUS_INVALID_INFO_CLASS;
671 break;
672 }
673
674 *r->out.info = info;
675
676 return status;
677 }
678
679 /***************************************************************************
680 _lsa_lookup_sids_internal
681 ***************************************************************************/
682
683 static NTSTATUS _lsa_lookup_sids_internal(pipes_struct *p,
684 TALLOC_CTX *mem_ctx,
685 uint16_t level, /* input */
686 int num_sids, /* input */
687 struct lsa_SidPtr *sid, /* input */
688 struct lsa_RefDomainList **pp_ref, /* input/output */
689 struct lsa_TranslatedName2 **pp_names,/* input/output */
690 uint32_t *pp_mapped_count) /* input/output */
691 {
692 NTSTATUS status;
693 int i;
694 const DOM_SID **sids = NULL;
695 struct lsa_RefDomainList *ref = NULL;
696 uint32 mapped_count = 0;
697 struct lsa_dom_info *dom_infos = NULL;
698 struct lsa_name_info *name_infos = NULL;
699 struct lsa_TranslatedName2 *names = NULL;
700
701 *pp_mapped_count = 0;
702 *pp_names = NULL;
703 *pp_ref = NULL;
704
705 if (num_sids == 0) {
706 return NT_STATUS_OK;
707 }
708
709 sids = TALLOC_ARRAY(p->mem_ctx, const DOM_SID *, num_sids);
710 ref = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
711
712 if (sids == NULL || ref == NULL) {
713 return NT_STATUS_NO_MEMORY;
714 }
715
716 for (i=0; i<num_sids; i++) {
717 sids[i] = sid[i].sid;
718 }
719
720 status = lookup_sids(p->mem_ctx, num_sids, sids, level,
721 &dom_infos, &name_infos);
722
723 if (!NT_STATUS_IS_OK(status)) {
724 return status;
725 }
726
727 names = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedName2, num_sids);
728 if (names == NULL) {
729 return NT_STATUS_NO_MEMORY;
730 }
731
732 for (i=0; i<MAX_REF_DOMAINS; i++) {
733
734 if (!dom_infos[i].valid) {
735 break;
736 }
737
738 if (init_lsa_ref_domain_list(mem_ctx, ref,
739 dom_infos[i].name,
740 &dom_infos[i].sid) != i) {
741 DEBUG(0, ("Domain %s mentioned twice??\n",
742 dom_infos[i].name));
743 return NT_STATUS_INTERNAL_ERROR;
744 }
745 }
746
747 for (i=0; i<num_sids; i++) {
748 struct lsa_name_info *name = &name_infos[i];
749
750 if (name->type == SID_NAME_UNKNOWN) {
751 fstring tmp;
752 name->dom_idx = -1;
753 /* Unknown sids should return the string
754 * representation of the SID. Windows 2003 behaves
755 * rather erratic here, in many cases it returns the
756 * RID as 8 bytes hex, in others it returns the full
757 * SID. We (Jerry/VL) could not figure out which the
758 * hard cases are, so leave it with the SID. */
759 name->name = talloc_asprintf(p->mem_ctx, "%s",
760 sid_to_fstring(tmp,
761 sids[i]));
762 if (name->name == NULL) {
763 return NT_STATUS_NO_MEMORY;
764 }
765 } else {
766 mapped_count += 1;
767 }
768
769 init_lsa_translated_name2(&names[i], name->type,
770 name->name, name->dom_idx, 0);
771 }
772
773 status = NT_STATUS_NONE_MAPPED;
774 if (mapped_count > 0) {
775 status = (mapped_count < num_sids) ?
776 STATUS_SOME_UNMAPPED : NT_STATUS_OK;
777 }
778
779 DEBUG(10, ("num_sids %d, mapped_count %d, status %s\n",
780 num_sids, mapped_count, nt_errstr(status)));
781
782 *pp_mapped_count = mapped_count;
783 *pp_names = names;
784 *pp_ref = ref;
785
786 return status;
787 }
788
789 /***************************************************************************
790 _lsa_LookupSids
791 ***************************************************************************/
792
793 NTSTATUS _lsa_LookupSids(pipes_struct *p,
794 struct lsa_LookupSids *r)
795 {
796 NTSTATUS status;
797 struct lsa_info *handle;
798 int num_sids = r->in.sids->num_sids;
799 uint32 mapped_count = 0;
800 struct lsa_RefDomainList *domains = NULL;
801 struct lsa_TranslatedName *names_out = NULL;
802 struct lsa_TranslatedName2 *names = NULL;
803 int i;
804
805 if ((r->in.level < 1) || (r->in.level > 6)) {
806 return NT_STATUS_INVALID_PARAMETER;
807 }
808
809 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
810 return NT_STATUS_INVALID_HANDLE;
811 }
812
813 /* check if the user has enough rights */
814 if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
815 return NT_STATUS_ACCESS_DENIED;
816 }
817
818 if (num_sids > MAX_LOOKUP_SIDS) {
819 DEBUG(5,("_lsa_LookupSids: limit of %d exceeded, requested %d\n",
820 MAX_LOOKUP_SIDS, num_sids));
821 return NT_STATUS_NONE_MAPPED;
822 }
823
824 status = _lsa_lookup_sids_internal(p,
825 p->mem_ctx,
826 r->in.level,
827 num_sids,
828 r->in.sids->sids,
829 &domains,
830 &names,
831 &mapped_count);
832
833 /* Only return here when there is a real error.
834 NT_STATUS_NONE_MAPPED is a special case as it indicates that none of
835 the requested sids could be resolved. Older versions of XP (pre SP3)
836 rely that we return with the string representations of those SIDs in
837 that case. If we don't, XP crashes - Guenther
838 */
839
840 if (NT_STATUS_IS_ERR(status) &&
841 !NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
842 return status;
843 }
844
845 /* Convert from lsa_TranslatedName2 to lsa_TranslatedName */
846 names_out = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedName,
847 num_sids);
848 if (!names_out) {
849 return NT_STATUS_NO_MEMORY;
850 }
851
852 for (i=0; i<num_sids; i++) {
853 names_out[i].sid_type = names[i].sid_type;
854 names_out[i].name = names[i].name;
855 names_out[i].sid_index = names[i].sid_index;
856 }
857
858 *r->out.domains = domains;
859 r->out.names->count = num_sids;
860 r->out.names->names = names_out;
861 *r->out.count = mapped_count;
862
863 return status;
864 }
865
866 /***************************************************************************
867 _lsa_LookupSids2
868 ***************************************************************************/
869
870 NTSTATUS _lsa_LookupSids2(pipes_struct *p,
871 struct lsa_LookupSids2 *r)
872 {
873 NTSTATUS status;
874 struct lsa_info *handle;
875 int num_sids = r->in.sids->num_sids;
876 uint32 mapped_count = 0;
877 struct lsa_RefDomainList *domains = NULL;
878 struct lsa_TranslatedName2 *names = NULL;
879 bool check_policy = true;
880
881 switch (p->hdr_req.opnum) {
882 case NDR_LSA_LOOKUPSIDS3:
883 check_policy = false;
884 break;
885 case NDR_LSA_LOOKUPSIDS2:
886 default:
887 check_policy = true;
888 }
889
890 if ((r->in.level < 1) || (r->in.level > 6)) {
891 return NT_STATUS_INVALID_PARAMETER;
892 }
893
894 if (check_policy) {
895 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
896 return NT_STATUS_INVALID_HANDLE;
897 }
898
899 /* check if the user have enough rights */
900 if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
901 return NT_STATUS_ACCESS_DENIED;
902 }
903 }
904
905 if (num_sids > MAX_LOOKUP_SIDS) {
906 DEBUG(5,("_lsa_LookupSids2: limit of %d exceeded, requested %d\n",
907 MAX_LOOKUP_SIDS, num_sids));
908 return NT_STATUS_NONE_MAPPED;
909 }
910
911 status = _lsa_lookup_sids_internal(p,
912 p->mem_ctx,
913 r->in.level,
914 num_sids,
915 r->in.sids->sids,
916 &domains,
917 &names,
918 &mapped_count);
919
920 *r->out.domains = domains;
921 r->out.names->count = num_sids;
922 r->out.names->names = names;
923 *r->out.count = mapped_count;
924
925 return status;
926 }
927
928 /***************************************************************************
929 _lsa_LookupSids3
930 ***************************************************************************/
931
932 NTSTATUS _lsa_LookupSids3(pipes_struct *p,
933 struct lsa_LookupSids3 *r)
934 {
935 struct lsa_LookupSids2 q;
936
937 /* No policy handle on this call. Restrict to crypto connections. */
938 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
939 DEBUG(0,("_lsa_LookupSids3: client %s not using schannel for netlogon\n",
940 get_remote_machine_name() ));
941 return NT_STATUS_INVALID_PARAMETER;
942 }
943
944 q.in.handle = NULL;
945 q.in.sids = r->in.sids;
946 q.in.level = r->in.level;
947 q.in.unknown1 = r->in.unknown1;
948 q.in.unknown2 = r->in.unknown2;
949 q.in.names = r->in.names;
950 q.in.count = r->in.count;
951
952 q.out.domains = r->out.domains;
953 q.out.names = r->out.names;
954 q.out.count = r->out.count;
955
956 return _lsa_LookupSids2(p, &q);
957 }
958
959 /***************************************************************************
960 ***************************************************************************/
961
962 static int lsa_lookup_level_to_flags(uint16 level)
963 {
964 int flags;
965
966 switch (level) {
967 case 1:
968 flags = LOOKUP_NAME_ALL;
969 break;
970 case 2:
971 flags = LOOKUP_NAME_DOMAIN|LOOKUP_NAME_REMOTE|LOOKUP_NAME_ISOLATED;
972 break;
973 case 3:
974 flags = LOOKUP_NAME_DOMAIN|LOOKUP_NAME_ISOLATED;
975 break;
976 case 4:
977 case 5:
978 case 6:
979 default:
980 flags = LOOKUP_NAME_NONE;
981 break;
982 }
983
984 return flags;
985 }
986
987 /***************************************************************************
988 _lsa_LookupNames
989 ***************************************************************************/
990
991 NTSTATUS _lsa_LookupNames(pipes_struct *p,
992 struct lsa_LookupNames *r)
993 {
994 NTSTATUS status = NT_STATUS_NONE_MAPPED;
995 struct lsa_info *handle;
996 struct lsa_String *names = r->in.names;
997 uint32 num_entries = r->in.num_names;
998 struct lsa_RefDomainList *domains = NULL;
999 struct lsa_TranslatedSid *rids = NULL;
1000 uint32 mapped_count = 0;
1001 int flags = 0;
1002
1003 if (num_entries > MAX_LOOKUP_SIDS) {
1004 num_entries = MAX_LOOKUP_SIDS;
1005 DEBUG(5,("_lsa_LookupNames: truncating name lookup list to %d\n",
1006 num_entries));
1007 }
1008
1009 flags = lsa_lookup_level_to_flags(r->in.level);
1010
1011 domains = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
1012 if (!domains) {
1013 return NT_STATUS_NO_MEMORY;
1014 }
1015
1016 if (num_entries) {
1017 rids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_TranslatedSid,
1018 num_entries);
1019 if (!rids) {
1020 return NT_STATUS_NO_MEMORY;
1021 }
1022 } else {
1023 rids = NULL;
1024 }
1025
1026 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
1027 status = NT_STATUS_INVALID_HANDLE;
1028 goto done;
1029 }
1030
1031 /* check if the user have enough rights */
1032 if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
1033 status = NT_STATUS_ACCESS_DENIED;
1034 goto done;
1035 }
1036
1037 /* set up the LSA Lookup RIDs response */
1038 become_root(); /* lookup_name can require root privs */
1039 status = lookup_lsa_rids(p->mem_ctx, domains, rids, num_entries,
1040 names, flags, &mapped_count);
1041 unbecome_root();
1042
1043 done:
1044
1045 if (NT_STATUS_IS_OK(status) && (num_entries != 0) ) {
1046 if (mapped_count == 0) {
1047 status = NT_STATUS_NONE_MAPPED;
1048 } else if (mapped_count != num_entries) {
1049 status = STATUS_SOME_UNMAPPED;
1050 }
1051 }
1052
1053 *r->out.count = mapped_count;
1054 *r->out.domains = domains;
1055 r->out.sids->sids = rids;
1056 r->out.sids->count = num_entries;
1057
1058 return status;
1059 }
1060
1061 /***************************************************************************
1062 _lsa_LookupNames2
1063 ***************************************************************************/
1064
1065 NTSTATUS _lsa_LookupNames2(pipes_struct *p,
1066 struct lsa_LookupNames2 *r)
1067 {
1068 NTSTATUS status;
1069 struct lsa_LookupNames q;
1070 struct lsa_TransSidArray2 *sid_array2 = r->in.sids;
1071 struct lsa_TransSidArray *sid_array = NULL;
1072 uint32_t i;
1073
1074 sid_array = TALLOC_ZERO_P(p->mem_ctx, struct lsa_TransSidArray);
1075 if (!sid_array) {
1076 return NT_STATUS_NO_MEMORY;
1077 }
1078
1079 q.in.handle = r->in.handle;
1080 q.in.num_names = r->in.num_names;
1081 q.in.names = r->in.names;
1082 q.in.level = r->in.level;
1083 q.in.sids = sid_array;
1084 q.in.count = r->in.count;
1085 /* we do not know what this is for */
1086 /* = r->in.unknown1; */
1087 /* = r->in.unknown2; */
1088
1089 q.out.domains = r->out.domains;
1090 q.out.sids = sid_array;
1091 q.out.count = r->out.count;
1092
1093 status = _lsa_LookupNames(p, &q);
1094
1095 sid_array2->sids = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedSid2, sid_array->count);
1096 if (!sid_array2->sids) {
1097 return NT_STATUS_NO_MEMORY;
1098 }
1099
1100 for (i=0; i<sid_array->count; i++) {
1101 sid_array2->sids[i].sid_type = sid_array->sids[i].sid_type;
1102 sid_array2->sids[i].rid = sid_array->sids[i].rid;
1103 sid_array2->sids[i].sid_index = sid_array->sids[i].sid_index;
1104 sid_array2->sids[i].unknown = 0;
1105 }
1106
1107 r->out.sids = sid_array2;
1108
1109 return status;
1110 }
1111
1112 /***************************************************************************
1113 _lsa_LookupNames3
1114 ***************************************************************************/
1115
1116 NTSTATUS _lsa_LookupNames3(pipes_struct *p,
1117 struct lsa_LookupNames3 *r)
1118 {
1119 NTSTATUS status;
1120 struct lsa_info *handle;
1121 struct lsa_String *names = r->in.names;
1122 uint32 num_entries = r->in.num_names;
1123 struct lsa_RefDomainList *domains = NULL;
1124 struct lsa_TranslatedSid3 *trans_sids = NULL;
1125 uint32 mapped_count = 0;
1126 int flags = 0;
1127 bool check_policy = true;
1128
1129 switch (p->hdr_req.opnum) {
1130 case NDR_LSA_LOOKUPNAMES4:
1131 check_policy = false;
1132 break;
1133 case NDR_LSA_LOOKUPNAMES3:
1134 default:
1135 check_policy = true;
1136 }
1137
1138 if (num_entries > MAX_LOOKUP_SIDS) {
1139 num_entries = MAX_LOOKUP_SIDS;
1140 DEBUG(5,("_lsa_LookupNames3: truncating name lookup list to %d\n", num_entries));
1141 }
1142
1143 /* Probably the lookup_level is some sort of bitmask. */
1144 if (r->in.level == 1) {
1145 flags = LOOKUP_NAME_ALL;
1146 }
1147
1148 domains = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
1149 if (!domains) {
1150 return NT_STATUS_NO_MEMORY;
1151 }
1152
1153 if (num_entries) {
1154 trans_sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_TranslatedSid3,
1155 num_entries);
1156 if (!trans_sids) {
1157 return NT_STATUS_NO_MEMORY;
1158 }
1159 } else {
1160 trans_sids = NULL;
1161 }
1162
1163 if (check_policy) {
1164
1165 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
1166 status = NT_STATUS_INVALID_HANDLE;
1167 goto done;
1168 }
1169
1170 /* check if the user have enough rights */
1171 if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
1172 status = NT_STATUS_ACCESS_DENIED;
1173 goto done;
1174 }
1175 }
1176
1177 /* set up the LSA Lookup SIDs response */
1178 become_root(); /* lookup_name can require root privs */
1179 status = lookup_lsa_sids(p->mem_ctx, domains, trans_sids, num_entries,
1180 names, flags, &mapped_count);
1181 unbecome_root();
1182
1183 done:
1184
1185 if (NT_STATUS_IS_OK(status)) {
1186 if (mapped_count == 0) {
1187 status = NT_STATUS_NONE_MAPPED;
1188 } else if (mapped_count != num_entries) {
1189 status = STATUS_SOME_UNMAPPED;
1190 }
1191 }
1192
1193 *r->out.count = mapped_count;
1194 *r->out.domains = domains;
1195 r->out.sids->sids = trans_sids;
1196 r->out.sids->count = num_entries;
1197
1198 return status;
1199 }
1200
1201 /***************************************************************************
1202 _lsa_LookupNames4
1203 ***************************************************************************/
1204
1205 NTSTATUS _lsa_LookupNames4(pipes_struct *p,
1206 struct lsa_LookupNames4 *r)
1207 {
1208 struct lsa_LookupNames3 q;
1209
1210 /* No policy handle on this call. Restrict to crypto connections. */
1211 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1212 DEBUG(0,("_lsa_lookup_names4: client %s not using schannel for netlogon\n",
1213 get_remote_machine_name() ));
1214 return NT_STATUS_INVALID_PARAMETER;
1215 }
1216
1217 q.in.handle = NULL;
1218 q.in.num_names = r->in.num_names;
1219 q.in.names = r->in.names;
1220 q.in.level = r->in.level;
1221 q.in.unknown1 = r->in.unknown1;
1222 q.in.unknown2 = r->in.unknown2;
1223 q.in.sids = r->in.sids;
1224 q.in.count = r->in.count;
1225
1226 q.out.domains = r->out.domains;
1227 q.out.sids = r->out.sids;
1228 q.out.count = r->out.count;
1229
1230 return _lsa_LookupNames3(p, &q);
1231 }
1232
1233 /***************************************************************************
1234 _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
1235 ***************************************************************************/
1236
1237 NTSTATUS _lsa_Close(pipes_struct *p, struct lsa_Close *r)
1238 {
1239 if (!find_policy_by_hnd(p, r->in.handle, NULL)) {
1240 return NT_STATUS_INVALID_HANDLE;
1241 }
1242
1243 close_policy_hnd(p, r->in.handle);
1244 ZERO_STRUCTP(r->out.handle);
1245 return NT_STATUS_OK;
1246 }
1247
1248 /***************************************************************************
1249 ***************************************************************************/
1250
1251 NTSTATUS _lsa_OpenSecret(pipes_struct *p, struct lsa_OpenSecret *r)
1252 {
1253 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1254 }
1255
1256 /***************************************************************************
1257 ***************************************************************************/
1258
1259 NTSTATUS _lsa_OpenTrustedDomain(pipes_struct *p, struct lsa_OpenTrustedDomain *r)
1260 {
1261 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1262 }
1263
1264 /***************************************************************************
1265 ***************************************************************************/
1266
1267 NTSTATUS _lsa_CreateTrustedDomain(pipes_struct *p, struct lsa_CreateTrustedDomain *r)
1268 {
1269 return NT_STATUS_ACCESS_DENIED;
1270 }
1271
1272 /***************************************************************************
1273 ***************************************************************************/
1274
1275 NTSTATUS _lsa_CreateSecret(pipes_struct *p, struct lsa_CreateSecret *r)
1276 {
1277 return NT_STATUS_ACCESS_DENIED;
1278 }
1279
1280 /***************************************************************************
1281 ***************************************************************************/
1282
1283 NTSTATUS _lsa_SetSecret(pipes_struct *p, struct lsa_SetSecret *r)
1284 {
1285 return NT_STATUS_ACCESS_DENIED;
1286 }
1287
1288 /***************************************************************************
1289 _lsa_DeleteObject
1290 ***************************************************************************/
1291
1292 NTSTATUS _lsa_DeleteObject(pipes_struct *p,
1293 struct lsa_DeleteObject *r)
1294 {
1295 return NT_STATUS_ACCESS_DENIED;
1296 }
1297
1298 /***************************************************************************
1299 _lsa_EnumPrivs
1300 ***************************************************************************/
1301
1302 NTSTATUS _lsa_EnumPrivs(pipes_struct *p,
1303 struct lsa_EnumPrivs *r)
1304 {
1305 struct lsa_info *handle;
1306 uint32 i;
1307 uint32 enum_context = *r->in.resume_handle;
1308 int num_privs = count_all_privileges();
1309 struct lsa_PrivEntry *entries = NULL;
1310 LUID_ATTR luid;
1311
1312 /* remember that the enum_context starts at 0 and not 1 */
1313
1314 if ( enum_context >= num_privs )
1315 return NT_STATUS_NO_MORE_ENTRIES;
1316
1317 DEBUG(10,("_lsa_EnumPrivs: enum_context:%d total entries:%d\n",
1318 enum_context, num_privs));
1319
1320 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1321 return NT_STATUS_INVALID_HANDLE;
1322
1323 /* check if the user have enough rights
1324 I don't know if it's the right one. not documented. */
1325
1326 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1327 return NT_STATUS_ACCESS_DENIED;
1328
1329 if (num_privs) {
1330 entries = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_PrivEntry, num_privs);
1331 if (!entries) {
1332 return NT_STATUS_NO_MEMORY;
1333 }
1334 } else {
1335 entries = NULL;
1336 }
1337
1338 for (i = 0; i < num_privs; i++) {
1339 if( i < enum_context) {
1340
1341 init_lsa_StringLarge(&entries[i].name, NULL);
1342
1343 entries[i].luid.low = 0;
1344 entries[i].luid.high = 0;
1345 } else {
1346
1347 init_lsa_StringLarge(&entries[i].name, privs[i].name);
1348
1349 luid = get_privilege_luid( &privs[i].se_priv );
1350
1351 entries[i].luid.low = luid.luid.low;
1352 entries[i].luid.high = luid.luid.high;
1353 }
1354 }
1355
1356 enum_context = num_privs;
1357
1358 *r->out.resume_handle = enum_context;
1359 r->out.privs->count = num_privs;
1360 r->out.privs->privs = entries;
1361
1362 return NT_STATUS_OK;
1363 }
1364
1365 /***************************************************************************
1366 _lsa_LookupPrivDisplayName
1367 ***************************************************************************/
1368
1369 NTSTATUS _lsa_LookupPrivDisplayName(pipes_struct *p,
1370 struct lsa_LookupPrivDisplayName *r)
1371 {
1372 struct lsa_info *handle;
1373 const char *description;
1374 struct lsa_StringLarge *lsa_name;
1375
1376 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1377 return NT_STATUS_INVALID_HANDLE;
1378
1379 /* check if the user have enough rights */
1380
1381 /*
1382 * I don't know if it's the right one. not documented.
1383 */
1384 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1385 return NT_STATUS_ACCESS_DENIED;
1386
1387 DEBUG(10,("_lsa_LookupPrivDisplayName: name = %s\n", r->in.name->string));
1388
1389 description = get_privilege_dispname(r->in.name->string);
1390 if (!description) {
1391 DEBUG(10,("_lsa_LookupPrivDisplayName: doesn't exist\n"));
1392 return NT_STATUS_NO_SUCH_PRIVILEGE;
1393 }
1394
1395 DEBUG(10,("_lsa_LookupPrivDisplayName: display name = %s\n", description));
1396
1397 lsa_name = TALLOC_ZERO_P(p->mem_ctx, struct lsa_StringLarge);
1398 if (!lsa_name) {
1399 return NT_STATUS_NO_MEMORY;
1400 }
1401
1402 init_lsa_StringLarge(lsa_name, description);
1403
1404 *r->out.returned_language_id = r->in.language_id;
1405 *r->out.disp_name = lsa_name;
1406
1407 return NT_STATUS_OK;
1408 }
1409
1410 /***************************************************************************
1411 _lsa_EnumAccounts
1412 ***************************************************************************/
1413
1414 NTSTATUS _lsa_EnumAccounts(pipes_struct *p,
1415 struct lsa_EnumAccounts *r)
1416 {
1417 struct lsa_info *handle;
1418 DOM_SID *sid_list;
1419 int i, j, num_entries;
1420 NTSTATUS status;
1421 struct lsa_SidPtr *sids = NULL;
1422
1423 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1424 return NT_STATUS_INVALID_HANDLE;
1425
1426 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1427 return NT_STATUS_ACCESS_DENIED;
1428
1429 sid_list = NULL;
1430 num_entries = 0;
1431
1432 /* The only way we can currently find out all the SIDs that have been
1433 privileged is to scan all privileges */
1434
1435 status = privilege_enumerate_accounts(&sid_list, &num_entries);
1436 if (!NT_STATUS_IS_OK(status)) {
1437 return status;
1438 }
1439
1440 if (*r->in.resume_handle >= num_entries) {
1441 return NT_STATUS_NO_MORE_ENTRIES;
1442 }
1443
1444 if (num_entries - *r->in.resume_handle) {
1445 sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_SidPtr,
1446 num_entries - *r->in.resume_handle);
1447 if (!sids) {
1448 SAFE_FREE(sid_list);
1449 return NT_STATUS_NO_MEMORY;
1450 }
1451
1452 for (i = *r->in.resume_handle, j = 0; i < num_entries; i++, j++) {
1453 sids[j].sid = sid_dup_talloc(p->mem_ctx, &sid_list[i]);
1454 if (!sids[j].sid) {
1455 SAFE_FREE(sid_list);
1456 return NT_STATUS_NO_MEMORY;
1457 }
1458 }
1459 }
1460
1461 talloc_free(sid_list);
1462
1463 *r->out.resume_handle = num_entries;
1464 r->out.sids->num_sids = num_entries;
1465 r->out.sids->sids = sids;
1466
1467 return NT_STATUS_OK;
1468 }
1469
1470 /***************************************************************************
1471 _lsa_GetUserName
1472 ***************************************************************************/
1473
1474 NTSTATUS _lsa_GetUserName(pipes_struct *p,
1475 struct lsa_GetUserName *r)
1476 {
1477 const char *username, *domname;
1478 user_struct *vuser = get_valid_user_struct(p->vuid);
1479 struct lsa_String *account_name = NULL;
1480 struct lsa_String *authority_name = NULL;
1481
1482 if (vuser == NULL)
1483 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1484
1485 if (vuser->guest) {
1486 /*
1487 * I'm 99% sure this is not the right place to do this,
1488 * global_sid_Anonymous should probably be put into the token
1489 * instead of the guest id -- vl
1490 */
1491 if (!lookup_sid(p->mem_ctx, &global_sid_Anonymous,
1492 &domname, &username, NULL)) {
1493 return NT_STATUS_NO_MEMORY;
1494 }
1495 } else {
1496 username = vuser->user.smb_name;
1497 domname = vuser->user.domain;
1498 }
1499
1500 account_name = TALLOC_ZERO_P(p->mem_ctx, struct lsa_String);
1501 if (!account_name) {
1502 return NT_STATUS_NO_MEMORY;
1503 }
1504
1505 authority_name = TALLOC_ZERO_P(p->mem_ctx, struct lsa_String);
1506 if (!authority_name) {
1507 return NT_STATUS_NO_MEMORY;
1508 }
1509
1510 init_lsa_String(account_name, username);
1511 init_lsa_String(authority_name, domname);
1512
1513 *r->out.account_name = account_name;
1514 *r->out.authority_name = authority_name;
1515
1516 return NT_STATUS_OK;
1517 }
1518
1519 /***************************************************************************
1520 _lsa_CreateAccount
1521 ***************************************************************************/
1522
1523 NTSTATUS _lsa_CreateAccount(pipes_struct *p,
1524 struct lsa_CreateAccount *r)
1525 {
1526 struct lsa_info *handle;
1527 struct lsa_info *info;
1528
1529 /* find the connection policy handle. */
1530 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1531 return NT_STATUS_INVALID_HANDLE;
1532
1533 /* check if the user have enough rights */
1534
1535 /*
1536 * I don't know if it's the right one. not documented.
1537 * but guessed with rpcclient.
1538 */
1539 if (!(handle->access & LSA_POLICY_GET_PRIVATE_INFORMATION))
1540 return NT_STATUS_ACCESS_DENIED;
1541
1542 /* check to see if the pipe_user is a Domain Admin since
1543 account_pol.tdb was already opened as root, this is all we have */
1544
1545 if ( p->pipe_user.ut.uid != sec_initial_uid()
1546 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1547 return NT_STATUS_ACCESS_DENIED;
1548
1549 if ( is_privileged_sid( r->in.sid ) )
1550 return NT_STATUS_OBJECT_NAME_COLLISION;
1551
1552 /* associate the user/group SID with the (unique) handle. */
1553
1554 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
1555 return NT_STATUS_NO_MEMORY;
1556
1557 ZERO_STRUCTP(info);
1558 info->sid = *r->in.sid;
1559 info->access = r->in.access_mask;
1560
1561 /* get a (unique) handle. open a policy on it. */
1562 if (!create_policy_hnd(p, r->out.acct_handle, free_lsa_info, (void *)info))
1563 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1564
1565 return privilege_create_account( &info->sid );
1566 }
1567
1568
1569 /***************************************************************************
1570 _lsa_OpenAccount
1571 ***************************************************************************/
1572
1573 NTSTATUS _lsa_OpenAccount(pipes_struct *p,
1574 struct lsa_OpenAccount *r)
1575 {
1576 struct lsa_info *handle;
1577 struct lsa_info *info;
1578
1579 /* find the connection policy handle. */
1580 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1581 return NT_STATUS_INVALID_HANDLE;
1582
1583 /* check if the user have enough rights */
1584
1585 /*
1586 * I don't know if it's the right one. not documented.
1587 * but guessed with rpcclient.
1588 */
1589 if (!(handle->access & LSA_POLICY_GET_PRIVATE_INFORMATION))
1590 return NT_STATUS_ACCESS_DENIED;
1591
1592 /* TODO: Fis the parsing routine before reenabling this check! */
1593 #if 0
1594 if (!lookup_sid(&handle->sid, dom_name, name, &type))
1595 return NT_STATUS_ACCESS_DENIED;
1596 #endif
1597 /* associate the user/group SID with the (unique) handle. */
1598 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
1599 return NT_STATUS_NO_MEMORY;
1600
1601 ZERO_STRUCTP(info);
1602 info->sid = *r->in.sid;
1603 info->access = r->in.access_mask;
1604
1605 /* get a (unique) handle. open a policy on it. */
1606 if (!create_policy_hnd(p, r->out.acct_handle, free_lsa_info, (void *)info))
1607 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1608
1609 return NT_STATUS_OK;
1610 }
1611
1612 /***************************************************************************
1613 _lsa_EnumPrivsAccount
1614 For a given SID, enumerate all the privilege this account has.
1615 ***************************************************************************/
1616
1617 NTSTATUS _lsa_EnumPrivsAccount(pipes_struct *p,
1618 struct lsa_EnumPrivsAccount *r)
1619 {
1620 NTSTATUS status = NT_STATUS_OK;
1621 struct lsa_info *info=NULL;
1622 SE_PRIV mask;
1623 PRIVILEGE_SET privileges;
1624 struct lsa_PrivilegeSet *priv_set = NULL;
1625 struct lsa_LUIDAttribute *luid_attrs = NULL;
1626 int i;
1627
1628 /* find the connection policy handle. */
1629 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1630 return NT_STATUS_INVALID_HANDLE;
1631
1632 if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1633 return NT_STATUS_ACCESS_DENIED;
1634
1635 if ( !get_privileges_for_sids( &mask, &info->sid, 1 ) )
1636 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1637
1638 privilege_set_init( &privileges );
1639
1640 if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
1641
1642 DEBUG(10,("_lsa_EnumPrivsAccount: %s has %d privileges\n",
1643 sid_string_dbg(&info->sid),
1644 privileges.count));
1645
1646 priv_set = TALLOC_ZERO_P(p->mem_ctx, struct lsa_PrivilegeSet);
1647 if (!priv_set) {
1648 status = NT_STATUS_NO_MEMORY;
1649 goto done;
1650 }
1651
1652 luid_attrs = TALLOC_ZERO_ARRAY(p->mem_ctx,
1653 struct lsa_LUIDAttribute,
1654 privileges.count);
1655 if (!luid_attrs) {
1656 status = NT_STATUS_NO_MEMORY;
1657 goto done;
1658 }
1659
1660 for (i=0; i<privileges.count; i++) {
1661 luid_attrs[i].luid.low = privileges.set[i].luid.low;
1662 luid_attrs[i].luid.high = privileges.set[i].luid.high;
1663 luid_attrs[i].attribute = privileges.set[i].attr;
1664 }
1665
1666 priv_set->count = privileges.count;
1667 priv_set->unknown = 0;
1668 priv_set->set = luid_attrs;
1669
1670 *r->out.privs = priv_set;
1671 } else {
1672 status = NT_STATUS_NO_SUCH_PRIVILEGE;
1673 }
1674
1675 done:
1676 privilege_set_free( &privileges );
1677
1678 return status;
1679 }
1680
1681 /***************************************************************************
1682 _lsa_GetSystemAccessAccount
1683 ***************************************************************************/
1684
1685 NTSTATUS _lsa_GetSystemAccessAccount(pipes_struct *p,
1686 struct lsa_GetSystemAccessAccount *r)
1687 {
1688 struct lsa_info *info=NULL;
1689
1690 /* find the connection policy handle. */
1691
1692 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1693 return NT_STATUS_INVALID_HANDLE;
1694
1695 if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1696 return NT_STATUS_ACCESS_DENIED;
1697
1698 if (!lookup_sid(p->mem_ctx, &info->sid, NULL, NULL, NULL))
1699 return NT_STATUS_ACCESS_DENIED;
1700
1701 /*
1702 0x01 -> Log on locally
1703 0x02 -> Access this computer from network
1704 0x04 -> Log on as a batch job
1705 0x10 -> Log on as a service
1706
1707 they can be ORed together
1708 */
1709
1710 *r->out.access_mask = PR_LOG_ON_LOCALLY | PR_ACCESS_FROM_NETWORK;
1711
1712 return NT_STATUS_OK;
1713 }
1714
1715 /***************************************************************************
1716 update the systemaccount information
1717 ***************************************************************************/
1718
1719 NTSTATUS _lsa_SetSystemAccessAccount(pipes_struct *p,
1720 struct lsa_SetSystemAccessAccount *r)
1721 {
1722 struct lsa_info *info=NULL;
1723 GROUP_MAP map;
1724
1725 /* find the connection policy handle. */
1726 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1727 return NT_STATUS_INVALID_HANDLE;
1728
1729 /* check to see if the pipe_user is a Domain Admin since
1730 account_pol.tdb was already opened as root, this is all we have */
1731
1732 if ( p->pipe_user.ut.uid != sec_initial_uid()
1733 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1734 return NT_STATUS_ACCESS_DENIED;
1735
1736 if (!pdb_getgrsid(&map, info->sid))
1737 return NT_STATUS_NO_SUCH_GROUP;
1738
1739 return pdb_update_group_mapping_entry(&map);
1740 }
1741
1742 /***************************************************************************
1743 _lsa_AddPrivilegesToAccount
1744 For a given SID, add some privileges.
1745 ***************************************************************************/
1746
1747 NTSTATUS _lsa_AddPrivilegesToAccount(pipes_struct *p,
1748 struct lsa_AddPrivilegesToAccount *r)
1749 {
1750 struct lsa_info *info = NULL;
1751 SE_PRIV mask;
1752 struct lsa_PrivilegeSet *set = NULL;
1753
1754 /* find the connection policy handle. */
1755 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1756 return NT_STATUS_INVALID_HANDLE;
1757
1758 /* check to see if the pipe_user is root or a Domain Admin since
1759 account_pol.tdb was already opened as root, this is all we have */
1760
1761 if ( p->pipe_user.ut.uid != sec_initial_uid()
1762 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1763 {
1764 return NT_STATUS_ACCESS_DENIED;
1765 }
1766
1767 set = r->in.privs;
1768 if ( !privilege_set_to_se_priv( &mask, set ) )
1769 return NT_STATUS_NO_SUCH_PRIVILEGE;
1770
1771 if ( !grant_privilege( &info->sid, &mask ) ) {
1772 DEBUG(3,("_lsa_AddPrivilegesToAccount: grant_privilege(%s) failed!\n",
1773 sid_string_dbg(&info->sid) ));
1774 DEBUG(3,("Privilege mask:\n"));
1775 dump_se_priv( DBGC_ALL, 3, &mask );
1776 return NT_STATUS_NO_SUCH_PRIVILEGE;
1777 }
1778
1779 return NT_STATUS_OK;
1780 }
1781
1782 /***************************************************************************
1783 _lsa_RemovePrivilegesFromAccount
1784 For a given SID, remove some privileges.
1785 ***************************************************************************/
1786
1787 NTSTATUS _lsa_RemovePrivilegesFromAccount(pipes_struct *p,
1788 struct lsa_RemovePrivilegesFromAccount *r)
1789 {
1790 struct lsa_info *info = NULL;
1791 SE_PRIV mask;
1792 struct lsa_PrivilegeSet *set = NULL;
1793
1794 /* find the connection policy handle. */
1795 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1796 return NT_STATUS_INVALID_HANDLE;
1797
1798 /* check to see if the pipe_user is root or a Domain Admin since
1799 account_pol.tdb was already opened as root, this is all we have */
1800
1801 if ( p->pipe_user.ut.uid != sec_initial_uid()
1802 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1803 {
1804 return NT_STATUS_ACCESS_DENIED;
1805 }
1806
1807 set = r->in.privs;
1808
1809 if ( !privilege_set_to_se_priv( &mask, set ) )
1810 return NT_STATUS_NO_SUCH_PRIVILEGE;
1811
1812 if ( !revoke_privilege( &info->sid, &mask ) ) {
1813 DEBUG(3,("_lsa_RemovePrivilegesFromAccount: revoke_privilege(%s) failed!\n",
1814 sid_string_dbg(&info->sid) ));
1815 DEBUG(3,("Privilege mask:\n"));
1816 dump_se_priv( DBGC_ALL, 3, &mask );
1817 return NT_STATUS_NO_SUCH_PRIVILEGE;
1818 }
1819
1820 return NT_STATUS_OK;
1821 }
1822
1823 /***************************************************************************
1824 _lsa_QuerySecurity
1825 ***************************************************************************/
1826
1827 NTSTATUS _lsa_QuerySecurity(pipes_struct *p,
1828 struct lsa_QuerySecurity *r)
1829 {
1830 struct lsa_info *handle=NULL;
1831 SEC_DESC *psd = NULL;
1832 size_t sd_size;
1833 NTSTATUS status;
1834
1835 /* find the connection policy handle. */
1836 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1837 return NT_STATUS_INVALID_HANDLE;
1838
1839 /* check if the user have enough rights */
1840 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1841 return NT_STATUS_ACCESS_DENIED;
1842
1843 switch (r->in.sec_info) {
1844 case 1:
1845 /* SD contains only the owner */
1846
1847 status=lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
1848 if(!NT_STATUS_IS_OK(status))
1849 return NT_STATUS_NO_MEMORY;
1850
1851
1852 if((*r->out.sdbuf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1853 return NT_STATUS_NO_MEMORY;
1854 break;
1855 case 4:
1856 /* SD contains only the ACL */
1857
1858 status=lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
1859 if(!NT_STATUS_IS_OK(status))
1860 return NT_STATUS_NO_MEMORY;
1861
1862 if((*r->out.sdbuf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1863 return NT_STATUS_NO_MEMORY;
1864 break;
1865 default:
1866 return NT_STATUS_INVALID_LEVEL;
1867 }
1868
1869 return status;
1870 }
1871
1872 #if 0 /* AD DC work in ongoing in Samba 4 */
1873
1874 /***************************************************************************
1875 ***************************************************************************/
1876
1877 NTSTATUS _lsa_query_info2(pipes_struct *p, LSA_Q_QUERY_INFO2 *q_u, LSA_R_QUERY_INFO2 *r_u)
1878 {
1879 struct lsa_info *handle;
1880 const char *nb_name;
1881 char *dns_name = NULL;
1882 char *forest_name = NULL;
1883 DOM_SID *sid = NULL;
1884 struct GUID guid;
1885 fstring dnsdomname;
1886
1887 ZERO_STRUCT(guid);
1888 r_u->status = NT_STATUS_OK;
1889
1890 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle))
1891 return NT_STATUS_INVALID_HANDLE;
1892
1893 switch (q_u->info_class) {
1894 case 0x0c:
1895 /* check if the user have enough rights */
1896 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1897 return NT_STATUS_ACCESS_DENIED;
1898
1899 /* Request PolicyPrimaryDomainInformation. */
1900 switch (lp_server_role()) {
1901 case ROLE_DOMAIN_PDC:
1902 case ROLE_DOMAIN_BDC:
1903 nb_name = get_global_sam_name();
1904 /* ugly temp hack for these next two */
1905
1906 /* This should be a 'netbios domain -> DNS domain' mapping */
1907 dnsdomname = get_mydnsdomname(p->mem_ctx);
1908 if (!dnsdomname || !*dnsdomname) {
1909 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1910 }
1911 strlower_m(dnsdomname);
1912
1913 dns_name = dnsdomname;
1914 forest_name = dnsdomname;
1915
1916 sid = get_global_sam_sid();
1917 secrets_fetch_domain_guid(lp_workgroup(), &guid);
1918 break;
1919 default:
1920 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1921 }
1922 init_dns_dom_info(&r_u->info.dns_dom_info, nb_name, dns_name,
1923 forest_name,&guid,sid);
1924 break;
1925 default:
1926 DEBUG(0,("_lsa_query_info2: unknown info level in Lsa Query: %d\n", q_u->info_class));
1927 r_u->status = NT_STATUS_INVALID_INFO_CLASS;
1928 break;
1929 }
1930
1931 if (NT_STATUS_IS_OK(r_u->status)) {
1932 r_u->ptr = 0x1;
1933 r_u->info_class = q_u->info_class;
1934 }
1935
1936 return r_u->status;
1937 }
1938 #endif /* AD DC work in ongoing in Samba 4 */
1939
1940 /***************************************************************************
1941 _lsa_AddAccountRights
1942 ***************************************************************************/
1943
1944 NTSTATUS _lsa_AddAccountRights(pipes_struct *p,
1945 struct lsa_AddAccountRights *r)
1946 {
1947 struct lsa_info *info = NULL;
1948 int i = 0;
1949 DOM_SID sid;
1950
1951 /* find the connection policy handle. */
1952 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1953 return NT_STATUS_INVALID_HANDLE;
1954
1955 /* check to see if the pipe_user is a Domain Admin since
1956 account_pol.tdb was already opened as root, this is all we have */
1957
1958 if ( p->pipe_user.ut.uid != sec_initial_uid()
1959 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1960 {
1961 return NT_STATUS_ACCESS_DENIED;
1962 }
1963
1964 /* according to an NT4 PDC, you can add privileges to SIDs even without
1965 call_lsa_create_account() first. And you can use any arbitrary SID. */
1966
1967 sid_copy( &sid, r->in.sid );
1968
1969 for ( i=0; i < r->in.rights->count; i++ ) {
1970
1971 const char *privname = r->in.rights->names[i].string;
1972
1973 /* only try to add non-null strings */
1974
1975 if ( !privname )
1976 continue;
1977
1978 if ( !grant_privilege_by_name( &sid, privname ) ) {
1979 DEBUG(2,("_lsa_AddAccountRights: Failed to add privilege [%s]\n",
1980 privname ));
1981 return NT_STATUS_NO_SUCH_PRIVILEGE;
1982 }
1983 }
1984
1985 return NT_STATUS_OK;
1986 }
1987
1988 /***************************************************************************
1989 _lsa_RemoveAccountRights
1990 ***************************************************************************/
1991
1992 NTSTATUS _lsa_RemoveAccountRights(pipes_struct *p,
1993 struct lsa_RemoveAccountRights *r)
1994 {
1995 struct lsa_info *info = NULL;
1996 int i = 0;
1997 DOM_SID sid;
1998 const char *privname = NULL;
1999
2000 /* find the connection policy handle. */
2001 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2002 return NT_STATUS_INVALID_HANDLE;
2003
2004 /* check to see if the pipe_user is a Domain Admin since
2005 account_pol.tdb was already opened as root, this is all we have */
2006
2007 if ( p->pipe_user.ut.uid != sec_initial_uid()
2008 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
2009 {
2010 return NT_STATUS_ACCESS_DENIED;
2011 }
2012
2013 sid_copy( &sid, r->in.sid );
2014
2015 if ( r->in.remove_all ) {
2016 if ( !revoke_all_privileges( &sid ) )
2017 return NT_STATUS_ACCESS_DENIED;
2018
2019 return NT_STATUS_OK;
2020 }
2021
2022 for ( i=0; i < r->in.rights->count; i++ ) {
2023
2024 privname = r->in.rights->names[i].string;
2025
2026 /* only try to add non-null strings */
2027
2028 if ( !privname )
2029 continue;
2030
2031 if ( !revoke_privilege_by_name( &sid, privname ) ) {
2032 DEBUG(2,("_lsa_RemoveAccountRights: Failed to revoke privilege [%s]\n",
2033 privname ));
2034 return NT_STATUS_NO_SUCH_PRIVILEGE;
2035 }
2036 }
2037
2038 return NT_STATUS_OK;
2039 }
2040
2041 /*******************************************************************
2042 ********************************************************************/
2043
2044 static NTSTATUS init_lsa_right_set(TALLOC_CTX *mem_ctx,
2045 struct lsa_RightSet *r,
2046 PRIVILEGE_SET *privileges)
2047 {
2048 uint32 i;
2049 const char *privname;
2050 const char **privname_array = NULL;
2051 int num_priv = 0;
2052
2053 for (i=0; i<privileges->count; i++) {
2054
2055 privname = luid_to_privilege_name(&privileges->set[i].luid);
2056 if (privname) {
2057 if (!add_string_to_array(mem_ctx, privname,
2058 &privname_array, &num_priv)) {
2059 return NT_STATUS_NO_MEMORY;
2060 }
2061 }
2062 }
2063
2064 if (num_priv) {
2065
2066 r->names = TALLOC_ZERO_ARRAY(mem_ctx, struct lsa_StringLarge,
2067 num_priv);
2068 if (!r->names) {
2069 return NT_STATUS_NO_MEMORY;
2070 }
2071
2072 for (i=0; i<num_priv; i++) {
2073 init_lsa_StringLarge(&r->names[i], privname_array[i]);
2074 }
2075
2076 r->count = num_priv;
2077 }
2078
2079 return NT_STATUS_OK;
2080 }
2081
2082 /***************************************************************************
2083 _lsa_EnumAccountRights
2084 ***************************************************************************/
2085
2086 NTSTATUS _lsa_EnumAccountRights(pipes_struct *p,
2087 struct lsa_EnumAccountRights *r)
2088 {
2089 NTSTATUS status;
2090 struct lsa_info *info = NULL;
2091 DOM_SID sid;
2092 PRIVILEGE_SET privileges;
2093 SE_PRIV mask;
2094
2095 /* find the connection policy handle. */
2096
2097 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2098 return NT_STATUS_INVALID_HANDLE;
2099
2100 if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
2101 return NT_STATUS_ACCESS_DENIED;
2102
2103 /* according to an NT4 PDC, you can add privileges to SIDs even without
2104 call_lsa_create_account() first. And you can use any arbitrary SID. */
2105
2106 sid_copy( &sid, r->in.sid );
2107
2108 if ( !get_privileges_for_sids( &mask, &sid, 1 ) )
2109 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2110
2111 privilege_set_init( &privileges );
2112
2113 if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
2114
2115 DEBUG(10,("_lsa_EnumAccountRights: %s has %d privileges\n",
2116 sid_string_dbg(&sid), privileges.count));
2117
2118 status = init_lsa_right_set(p->mem_ctx, r->out.rights, &privileges);
2119 } else {
2120 status = NT_STATUS_NO_SUCH_PRIVILEGE;
2121 }
2122
2123 privilege_set_free( &privileges );
2124
2125 return status;
2126 }
2127
2128 /***************************************************************************
2129 _lsa_LookupPrivValue
2130 ***************************************************************************/
2131
2132 NTSTATUS _lsa_LookupPrivValue(pipes_struct *p,
2133 struct lsa_LookupPrivValue *r)
2134 {
2135 struct lsa_info *info = NULL;
2136 const char *name = NULL;
2137 LUID_ATTR priv_luid;
2138 SE_PRIV mask;
2139
2140 /* find the connection policy handle. */
2141
2142 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2143 return NT_STATUS_INVALID_HANDLE;
2144
2145 if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
2146 return NT_STATUS_ACCESS_DENIED;
2147
2148 name = r->in.name->string;
2149
2150 DEBUG(10,("_lsa_lookup_priv_value: name = %s\n", name));
2151
2152 if ( !se_priv_from_name( name, &mask ) )
2153 return NT_STATUS_NO_SUCH_PRIVILEGE;
2154
2155 priv_luid = get_privilege_luid( &mask );
2156
2157 r->out.luid->low = priv_luid.luid.low;
2158 r->out.luid->high = priv_luid.luid.high;
2159
2160 return NT_STATUS_OK;
2161 }
2162
2163 /*
2164 * From here on the server routines are just dummy ones to make smbd link with
2165 * librpc/gen_ndr/srv_lsa.c. These routines are actually never called, we are
2166 * pulling the server stubs across one by one.
2167 */
2168
2169 NTSTATUS _lsa_Delete(pipes_struct *p, struct lsa_Delete *r)
2170 {
2171 p->rng_fault_state = True;
2172 return NT_STATUS_NOT_IMPLEMENTED;
2173 }
2174
2175 NTSTATUS _lsa_SetSecObj(pipes_struct *p, struct lsa_SetSecObj *r)
2176 {
2177 p->rng_fault_state = True;
2178 return NT_STATUS_NOT_IMPLEMENTED;
2179 }
2180
2181 NTSTATUS _lsa_ChangePassword(pipes_struct *p, struct lsa_ChangePassword *r)
2182 {
2183 p->rng_fault_state = True;
2184 return NT_STATUS_NOT_IMPLEMENTED;
2185 }
2186
2187 NTSTATUS _lsa_SetInfoPolicy(pipes_struct *p, struct lsa_SetInfoPolicy *r)
2188 {
2189 p->rng_fault_state = True;
2190 return NT_STATUS_NOT_IMPLEMENTED;
2191 }
2192
2193 NTSTATUS _lsa_ClearAuditLog(pipes_struct *p, struct lsa_ClearAuditLog *r)
2194 {
2195 p->rng_fault_state = True;
2196 return NT_STATUS_NOT_IMPLEMENTED;
2197 }
2198
2199 NTSTATUS _lsa_GetQuotasForAccount(pipes_struct *p, struct lsa_GetQuotasForAccount *r)
2200 {
2201 p->rng_fault_state = True;
2202 return NT_STATUS_NOT_IMPLEMENTED;
2203 }
2204
2205 NTSTATUS _lsa_SetQuotasForAccount(pipes_struct *p, struct lsa_SetQuotasForAccount *r)
2206 {
2207 p->rng_fault_state = True;
2208 return NT_STATUS_NOT_IMPLEMENTED;
2209 }
2210
2211 NTSTATUS _lsa_QueryTrustedDomainInfo(pipes_struct *p, struct lsa_QueryTrustedDomainInfo *r)
2212 {
2213 p->rng_fault_state = True;
2214 return NT_STATUS_NOT_IMPLEMENTED;
2215 }
2216
2217 NTSTATUS _lsa_SetInformationTrustedDomain(pipes_struct *p, struct lsa_SetInformationTrustedDomain *r)
2218 {
2219 p->rng_fault_state = True;
2220 return NT_STATUS_NOT_IMPLEMENTED;
2221 }
2222
2223 NTSTATUS _lsa_QuerySecret(pipes_struct *p, struct lsa_QuerySecret *r)
2224 {
2225 p->rng_fault_state = True;
2226 return NT_STATUS_NOT_IMPLEMENTED;
2227 }
2228
2229 NTSTATUS _lsa_LookupPrivName(pipes_struct *p, struct lsa_LookupPrivName *r)
2230 {
2231 p->rng_fault_state = True;
2232 return NT_STATUS_NOT_IMPLEMENTED;
2233 }
2234
2235 NTSTATUS _lsa_EnumAccountsWithUserRight(pipes_struct *p, struct lsa_EnumAccountsWithUserRight *r)
2236 {
2237 p->rng_fault_state = True;
2238 return NT_STATUS_NOT_IMPLEMENTED;
2239 }
2240
2241 NTSTATUS _lsa_QueryTrustedDomainInfoBySid(pipes_struct *p, struct lsa_QueryTrustedDomainInfoBySid *r)
2242 {
2243 p->rng_fault_state = True;
2244 return NT_STATUS_NOT_IMPLEMENTED;
2245 }
2246
2247 NTSTATUS _lsa_SetTrustedDomainInfo(pipes_struct *p, struct lsa_SetTrustedDomainInfo *r)
2248 {
2249 p->rng_fault_state = True;
2250 return NT_STATUS_NOT_IMPLEMENTED;
2251 }
2252
2253 NTSTATUS _lsa_DeleteTrustedDomain(pipes_struct *p, struct lsa_DeleteTrustedDomain *r)
2254 {
2255 p->rng_fault_state = True;
2256 return NT_STATUS_NOT_IMPLEMENTED;
2257 }
2258
2259 NTSTATUS _lsa_StorePrivateData(pipes_struct *p, struct lsa_StorePrivateData *r)
2260 {
2261 p->rng_fault_state = True;
2262 return NT_STATUS_NOT_IMPLEMENTED;
2263 }
2264
2265 NTSTATUS _lsa_RetrievePrivateData(pipes_struct *p, struct lsa_RetrievePrivateData *r)
2266 {
2267 p->rng_fault_state = True;
2268 return NT_STATUS_NOT_IMPLEMENTED;
2269 }
2270
2271 NTSTATUS _lsa_QueryInfoPolicy2(pipes_struct *p, struct lsa_QueryInfoPolicy2 *r)
2272 {
2273 p->rng_fault_state = True;
2274 return NT_STATUS_NOT_IMPLEMENTED;
2275 }
2276
2277 NTSTATUS _lsa_SetInfoPolicy2(pipes_struct *p, struct lsa_SetInfoPolicy2 *r)
2278 {
2279 p->rng_fault_state = True;
2280 return NT_STATUS_NOT_IMPLEMENTED;
2281 }
2282
2283 NTSTATUS _lsa_QueryTrustedDomainInfoByName(pipes_struct *p, struct lsa_QueryTrustedDomainInfoByName *r)
2284 {
2285 p->rng_fault_state = True;
2286 return NT_STATUS_NOT_IMPLEMENTED;
2287 }
2288
2289 NTSTATUS _lsa_SetTrustedDomainInfoByName(pipes_struct *p, struct lsa_SetTrustedDomainInfoByName *r)
2290 {
2291 p->rng_fault_state = True;
2292 return NT_STATUS_NOT_IMPLEMENTED;
2293 }
2294
2295 NTSTATUS _lsa_EnumTrustedDomainsEx(pipes_struct *p, struct lsa_EnumTrustedDomainsEx *r)
2296 {
2297 p->rng_fault_state = True;
2298 return NT_STATUS_NOT_IMPLEMENTED;
2299 }
2300
2301 NTSTATUS _lsa_CreateTrustedDomainEx(pipes_struct *p, struct lsa_CreateTrustedDomainEx *r)
2302 {
2303 p->rng_fault_state = True;
2304 return NT_STATUS_NOT_IMPLEMENTED;
2305 }
2306
2307 NTSTATUS _lsa_CloseTrustedDomainEx(pipes_struct *p, struct lsa_CloseTrustedDomainEx *r)
2308 {
2309 p->rng_fault_state = True;
2310 return NT_STATUS_NOT_IMPLEMENTED;
2311 }
2312
2313 NTSTATUS _lsa_QueryDomainInformationPolicy(pipes_struct *p, struct lsa_QueryDomainInformationPolicy *r)
2314 {
2315 p->rng_fault_state = True;
2316 return NT_STATUS_NOT_IMPLEMENTED;
2317 }
2318
2319 NTSTATUS _lsa_SetDomainInformationPolicy(pipes_struct *p, struct lsa_SetDomainInformationPolicy *r)
2320 {
2321 p->rng_fault_state = True;
2322 return NT_STATUS_NOT_IMPLEMENTED;
2323 }
2324
2325 NTSTATUS _lsa_OpenTrustedDomainByName(pipes_struct *p, struct lsa_OpenTrustedDomainByName *r)
2326 {
2327 p->rng_fault_state = True;
2328 return NT_STATUS_NOT_IMPLEMENTED;
2329 }
2330
2331 NTSTATUS _lsa_TestCall(pipes_struct *p, struct lsa_TestCall *r)
2332 {
2333 p->rng_fault_state = True;
2334 return NT_STATUS_NOT_IMPLEMENTED;
2335 }
2336
2337 NTSTATUS _lsa_CreateTrustedDomainEx2(pipes_struct *p, struct lsa_CreateTrustedDomainEx2 *r)
2338 {
2339 p->rng_fault_state = True;
2340 return NT_STATUS_NOT_IMPLEMENTED;
2341 }
2342
2343 NTSTATUS _lsa_CREDRWRITE(pipes_struct *p, struct lsa_CREDRWRITE *r)
2344 {
2345 p->rng_fault_state = True;
2346 return NT_STATUS_NOT_IMPLEMENTED;
2347 }
2348
2349 NTSTATUS _lsa_CREDRREAD(pipes_struct *p, struct lsa_CREDRREAD *r)
2350 {
2351 p->rng_fault_state = True;
2352 return NT_STATUS_NOT_IMPLEMENTED;
2353 }
2354
2355 NTSTATUS _lsa_CREDRENUMERATE(pipes_struct *p, struct lsa_CREDRENUMERATE *r)
2356 {
2357 p->rng_fault_state = True;
2358 return NT_STATUS_NOT_IMPLEMENTED;
2359 }
2360
2361 NTSTATUS _lsa_CREDRWRITEDOMAINCREDENTIALS(pipes_struct *p, struct lsa_CREDRWRITEDOMAINCREDENTIALS *r)
2362 {
2363 p->rng_fault_state = True;
2364 return NT_STATUS_NOT_IMPLEMENTED;
2365 }
2366
2367 NTSTATUS _lsa_CREDRREADDOMAINCREDENTIALS(pipes_struct *p, struct lsa_CREDRREADDOMAINCREDENTIALS *r)
2368 {
2369 p->rng_fault_state = True;
2370 return NT_STATUS_NOT_IMPLEMENTED;
2371 }
2372
2373 NTSTATUS _lsa_CREDRDELETE(pipes_struct *p, struct lsa_CREDRDELETE *r)
2374 {
2375 p->rng_fault_state = True;
2376 return NT_STATUS_NOT_IMPLEMENTED;
2377 }
2378
2379 NTSTATUS _lsa_CREDRGETTARGETINFO(pipes_struct *p, struct lsa_CREDRGETTARGETINFO *r)
2380 {
2381 p->rng_fault_state = True;
2382 return NT_STATUS_NOT_IMPLEMENTED;
2383 }
2384
2385 NTSTATUS _lsa_CREDRPROFILELOADED(pipes_struct *p, struct lsa_CREDRPROFILELOADED *r)
2386 {
2387 p->rng_fault_state = True;
2388 return NT_STATUS_NOT_IMPLEMENTED;
2389 }
2390
2391 NTSTATUS _lsa_CREDRGETSESSIONTYPES(pipes_struct *p, struct lsa_CREDRGETSESSIONTYPES *r)
2392 {
2393 p->rng_fault_state = True;
2394 return NT_STATUS_NOT_IMPLEMENTED;
2395 }
2396
2397 NTSTATUS _lsa_LSARREGISTERAUDITEVENT(pipes_struct *p, struct lsa_LSARREGISTERAUDITEVENT *r)
2398 {
2399 p->rng_fault_state = True;
2400 return NT_STATUS_NOT_IMPLEMENTED;
2401 }
2402
2403 NTSTATUS _lsa_LSARGENAUDITEVENT(pipes_struct *p, struct lsa_LSARGENAUDITEVENT *r)
2404 {
2405 p->rng_fault_state = True;
2406 return NT_STATUS_NOT_IMPLEMENTED;
2407 }
2408
2409 NTSTATUS _lsa_LSARUNREGISTERAUDITEVENT(pipes_struct *p, struct lsa_LSARUNREGISTERAUDITEVENT *r)
2410 {
2411 p->rng_fault_state = True;
2412 return NT_STATUS_NOT_IMPLEMENTED;
2413 }
2414
2415 NTSTATUS _lsa_lsaRQueryForestTrustInformation(pipes_struct *p, struct lsa_lsaRQueryForestTrustInformation *r)
2416 {
2417 p->rng_fault_state = True;
2418 return NT_STATUS_NOT_IMPLEMENTED;
2419 }
2420
2421 NTSTATUS _lsa_LSARSETFORESTTRUSTINFORMATION(pipes_struct *p, struct lsa_LSARSETFORESTTRUSTINFORMATION *r)
2422 {
2423 p->rng_fault_state = True;
2424 return NT_STATUS_NOT_IMPLEMENTED;
2425 }
2426
2427 NTSTATUS _lsa_CREDRRENAME(pipes_struct *p, struct lsa_CREDRRENAME *r)
2428 {
2429 p->rng_fault_state = True;
2430 return NT_STATUS_NOT_IMPLEMENTED;
2431 }
2432
2433 NTSTATUS _lsa_LSAROPENPOLICYSCE(pipes_struct *p, struct lsa_LSAROPENPOLICYSCE *r)
2434 {
2435 p->rng_fault_state = True;
2436 return NT_STATUS_NOT_IMPLEMENTED;
2437 }
2438
2439 NTSTATUS _lsa_LSARADTREGISTERSECURITYEVENTSOURCE(pipes_struct *p, struct lsa_LSARADTREGISTERSECURITYEVENTSOURCE *r)
2440 {
2441 p->rng_fault_state = True;
2442 return NT_STATUS_NOT_IMPLEMENTED;
2443 }
2444
2445 NTSTATUS _lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE(pipes_struct *p, struct lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE *r)
2446 {
2447 p->rng_fault_state = True;
2448 return NT_STATUS_NOT_IMPLEMENTED;
2449 }
2450
2451 NTSTATUS _lsa_LSARADTREPORTSECURITYEVENT(pipes_struct *p, struct lsa_LSARADTREPORTSECURITYEVENT *r)
2452 {
2453 p->rng_fault_state = True;
2454 return NT_STATUS_NOT_IMPLEMENTED;
2455 }
Samba GIT mirror