?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smbd: fix posix acls when setting an ACL without explicit ACE for the owner (bug...
[Samba/ekacnet.git] / source / rpc_server / srv_lsa_nt.c
blob96ee36afde4dc49192ac6d2717dee0f1a114fb38
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Jeremy Allison 2001, 2006.
8 * Copyright (C) Rafal Szczesniak 2002,
9 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
10 * Copyright (C) Simo Sorce 2003.
11 * Copyright (C) Gerald (Jerry) Carter 2005.
12 * Copyright (C) Volker Lendecke 2005.
13 * Copyright (C) Guenther Deschner 2008.
14 *
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 3 of the License, or
18 * (at your option) any later version.
19 *
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
23 * GNU General Public License for more details.
24 *
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, see <http://www.gnu.org/licenses/>.
27 */
28
29 /* This is the implementation of the lsa server code. */
30
31 #include "includes.h"
32
33 #undef DBGC_CLASS
34 #define DBGC_CLASS DBGC_RPC_SRV
35
36 extern PRIVS privs[];
37
38 struct lsa_info {
39 DOM_SID sid;
40 uint32 access;
41 };
42
43 const struct generic_mapping lsa_generic_mapping = {
44 LSA_POLICY_READ,
45 LSA_POLICY_WRITE,
46 LSA_POLICY_EXECUTE,
47 LSA_POLICY_ALL_ACCESS
48 };
49
50 /***************************************************************************
51 init_lsa_ref_domain_list - adds a domain if it's not already in, returns the index.
52 ***************************************************************************/
53
54 static int init_lsa_ref_domain_list(TALLOC_CTX *mem_ctx,
55 struct lsa_RefDomainList *ref,
56 const char *dom_name,
57 DOM_SID *dom_sid)
58 {
59 int num = 0;
60
61 if (dom_name != NULL) {
62 for (num = 0; num < ref->count; num++) {
63 if (sid_equal(dom_sid, ref->domains[num].sid)) {
64 return num;
65 }
66 }
67 } else {
68 num = ref->count;
69 }
70
71 if (num >= MAX_REF_DOMAINS) {
72 /* index not found, already at maximum domain limit */
73 return -1;
74 }
75
76 ref->count = num + 1;
77 ref->max_size = MAX_REF_DOMAINS;
78
79 ref->domains = TALLOC_REALLOC_ARRAY(mem_ctx, ref->domains,
80 struct lsa_DomainInfo, ref->count);
81 if (!ref->domains) {
82 return -1;
83 }
84
85 ZERO_STRUCT(ref->domains[num]);
86
87 init_lsa_StringLarge(&ref->domains[num].name, dom_name);
88 ref->domains[num].sid = sid_dup_talloc(mem_ctx, dom_sid);
89 if (!ref->domains[num].sid) {
90 return -1;
91 }
92
93 return num;
94 }
95
96
97 /*******************************************************************
98 Function to free the per handle data.
99 ********************************************************************/
100
101 static void free_lsa_info(void *ptr)
102 {
103 struct lsa_info *lsa = (struct lsa_info *)ptr;
104
105 SAFE_FREE(lsa);
106 }
107
108 /***************************************************************************
109 initialize a lsa_DomainInfo structure.
110 ***************************************************************************/
111
112 static void init_dom_query_3(struct lsa_DomainInfo *r,
113 const char *name,
114 DOM_SID *sid)
115 {
116 init_lsa_StringLarge(&r->name, name);
117 r->sid = sid;
118 }
119
120 /***************************************************************************
121 initialize a lsa_DomainInfo structure.
122 ***************************************************************************/
123
124 static void init_dom_query_5(struct lsa_DomainInfo *r,
125 const char *name,
126 DOM_SID *sid)
127 {
128 init_lsa_StringLarge(&r->name, name);
129 r->sid = sid;
130 }
131
132 /***************************************************************************
133 lookup_lsa_rids. Must be called as root for lookup_name to work.
134 ***************************************************************************/
135
136 static NTSTATUS lookup_lsa_rids(TALLOC_CTX *mem_ctx,
137 struct lsa_RefDomainList *ref,
138 struct lsa_TranslatedSid *prid,
139 uint32_t num_entries,
140 struct lsa_String *name,
141 int flags,
142 uint32_t *pmapped_count)
143 {
144 uint32 mapped_count, i;
145
146 SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
147
148 mapped_count = 0;
149 *pmapped_count = 0;
150
151 for (i = 0; i < num_entries; i++) {
152 DOM_SID sid;
153 uint32 rid;
154 int dom_idx;
155 const char *full_name;
156 const char *domain;
157 enum lsa_SidType type = SID_NAME_UNKNOWN;
158
159 /* Split name into domain and user component */
160
161 full_name = name[i].string;
162 if (full_name == NULL) {
163 return NT_STATUS_NO_MEMORY;
164 }
165
166 DEBUG(5, ("lookup_lsa_rids: looking up name %s\n", full_name));
167
168 /* We can ignore the result of lookup_name, it will not touch
169 "type" if it's not successful */
170
171 lookup_name(mem_ctx, full_name, flags, &domain, NULL,
172 &sid, &type);
173
174 switch (type) {
175 case SID_NAME_USER:
176 case SID_NAME_DOM_GRP:
177 case SID_NAME_DOMAIN:
178 case SID_NAME_ALIAS:
179 case SID_NAME_WKN_GRP:
180 DEBUG(5, ("init_lsa_rids: %s found\n", full_name));
181 /* Leave these unchanged */
182 break;
183 default:
184 /* Don't hand out anything but the list above */
185 DEBUG(5, ("init_lsa_rids: %s not found\n", full_name));
186 type = SID_NAME_UNKNOWN;
187 break;
188 }
189
190 rid = 0;
191 dom_idx = -1;
192
193 if (type != SID_NAME_UNKNOWN) {
194 sid_split_rid(&sid, &rid);
195 dom_idx = init_lsa_ref_domain_list(mem_ctx, ref, domain, &sid);
196 mapped_count++;
197 }
198
199 init_lsa_translated_sid(&prid[i], type, rid, dom_idx);
200 }
201
202 *pmapped_count = mapped_count;
203 return NT_STATUS_OK;
204 }
205
206 /***************************************************************************
207 lookup_lsa_sids. Must be called as root for lookup_name to work.
208 ***************************************************************************/
209
210 static NTSTATUS lookup_lsa_sids(TALLOC_CTX *mem_ctx,
211 struct lsa_RefDomainList *ref,
212 struct lsa_TranslatedSid3 *trans_sids,
213 uint32_t num_entries,
214 struct lsa_String *name,
215 int flags,
216 uint32 *pmapped_count)
217 {
218 uint32 mapped_count, i;
219
220 SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
221
222 mapped_count = 0;
223 *pmapped_count = 0;
224
225 for (i = 0; i < num_entries; i++) {
226 DOM_SID sid;
227 uint32 rid;
228 int dom_idx;
229 const char *full_name;
230 const char *domain;
231 enum lsa_SidType type = SID_NAME_UNKNOWN;
232
233 ZERO_STRUCT(sid);
234
235 /* Split name into domain and user component */
236
237 full_name = name[i].string;
238 if (full_name == NULL) {
239 return NT_STATUS_NO_MEMORY;
240 }
241
242 DEBUG(5, ("init_lsa_sids: looking up name %s\n", full_name));
243
244 /* We can ignore the result of lookup_name, it will not touch
245 "type" if it's not successful */
246
247 lookup_name(mem_ctx, full_name, flags, &domain, NULL,
248 &sid, &type);
249
250 switch (type) {
251 case SID_NAME_USER:
252 case SID_NAME_DOM_GRP:
253 case SID_NAME_DOMAIN:
254 case SID_NAME_ALIAS:
255 case SID_NAME_WKN_GRP:
256 DEBUG(5, ("init_lsa_sids: %s found\n", full_name));
257 /* Leave these unchanged */
258 break;
259 default:
260 /* Don't hand out anything but the list above */
261 DEBUG(5, ("init_lsa_sids: %s not found\n", full_name));
262 type = SID_NAME_UNKNOWN;
263 break;
264 }
265
266 rid = 0;
267 dom_idx = -1;
268
269 if (type != SID_NAME_UNKNOWN) {
270 DOM_SID domain_sid;
271 sid_copy(&domain_sid, &sid);
272 sid_split_rid(&domain_sid, &rid);
273 dom_idx = init_lsa_ref_domain_list(mem_ctx, ref, domain, &domain_sid);
274 mapped_count++;
275 }
276
277 /* Initialize the lsa_TranslatedSid3 return. */
278 trans_sids[i].sid_type = type;
279 trans_sids[i].sid = sid_dup_talloc(mem_ctx, &sid);
280 trans_sids[i].sid_index = dom_idx;
281 }
282
283 *pmapped_count = mapped_count;
284 return NT_STATUS_OK;
285 }
286
287 static NTSTATUS lsa_get_generic_sd(TALLOC_CTX *mem_ctx, SEC_DESC **sd, size_t *sd_size)
288 {
289 DOM_SID local_adm_sid;
290 DOM_SID adm_sid;
291
292 SEC_ACE ace[3];
293
294 SEC_ACL *psa = NULL;
295
296 init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, LSA_POLICY_EXECUTE, 0);
297
298 sid_copy(&adm_sid, get_global_sam_sid());
299 sid_append_rid(&adm_sid, DOMAIN_GROUP_RID_ADMINS);
300 init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, LSA_POLICY_ALL_ACCESS, 0);
301
302 sid_copy(&local_adm_sid, &global_sid_Builtin);
303 sid_append_rid(&local_adm_sid, BUILTIN_ALIAS_RID_ADMINS);
304 init_sec_ace(&ace[2], &local_adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, LSA_POLICY_ALL_ACCESS, 0);
305
306 if((psa = make_sec_acl(mem_ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
307 return NT_STATUS_NO_MEMORY;
308
309 if((*sd = make_sec_desc(mem_ctx, SECURITY_DESCRIPTOR_REVISION_1,
310 SEC_DESC_SELF_RELATIVE, &adm_sid, NULL, NULL,
311 psa, sd_size)) == NULL)
312 return NT_STATUS_NO_MEMORY;
313
314 return NT_STATUS_OK;
315 }
316
317 #if 0 /* AD DC work in ongoing in Samba 4 */
318
319 /***************************************************************************
320 Init_dns_dom_info.
321 ***************************************************************************/
322
323 static void init_dns_dom_info(LSA_DNS_DOM_INFO *r_l, const char *nb_name,
324 const char *dns_name, const char *forest_name,
325 struct GUID *dom_guid, DOM_SID *dom_sid)
326 {
327 if (nb_name && *nb_name) {
328 init_unistr2(&r_l->uni_nb_dom_name, nb_name, UNI_FLAGS_NONE);
329 init_uni_hdr(&r_l->hdr_nb_dom_name, &r_l->uni_nb_dom_name);
330 r_l->hdr_nb_dom_name.uni_max_len += 2;
331 r_l->uni_nb_dom_name.uni_max_len += 1;
332 }
333
334 if (dns_name && *dns_name) {
335 init_unistr2(&r_l->uni_dns_dom_name, dns_name, UNI_FLAGS_NONE);
336 init_uni_hdr(&r_l->hdr_dns_dom_name, &r_l->uni_dns_dom_name);
337 r_l->hdr_dns_dom_name.uni_max_len += 2;
338 r_l->uni_dns_dom_name.uni_max_len += 1;
339 }
340
341 if (forest_name && *forest_name) {
342 init_unistr2(&r_l->uni_forest_name, forest_name, UNI_FLAGS_NONE);
343 init_uni_hdr(&r_l->hdr_forest_name, &r_l->uni_forest_name);
344 r_l->hdr_forest_name.uni_max_len += 2;
345 r_l->uni_forest_name.uni_max_len += 1;
346 }
347
348 /* how do we init the guid ? probably should write an init fn */
349 if (dom_guid) {
350 memcpy(&r_l->dom_guid, dom_guid, sizeof(struct GUID));
351 }
352
353 if (dom_sid) {
354 r_l->ptr_dom_sid = 1;
355 init_dom_sid2(&r_l->dom_sid, dom_sid);
356 }
357 }
358 #endif /* AD DC work in ongoing in Samba 4 */
359
360
361 /***************************************************************************
362 _lsa_OpenPolicy2
363 ***************************************************************************/
364
365 NTSTATUS _lsa_OpenPolicy2(pipes_struct *p,
366 struct lsa_OpenPolicy2 *r)
367 {
368 struct lsa_info *info;
369 SEC_DESC *psd = NULL;
370 size_t sd_size;
371 uint32 des_access = r->in.access_mask;
372 uint32 acc_granted;
373 NTSTATUS status;
374
375
376 /* map the generic bits to the lsa policy ones */
377 se_map_generic(&des_access, &lsa_generic_mapping);
378
379 /* get the generic lsa policy SD until we store it */
380 lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
381
382 status = se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted);
383 if (!NT_STATUS_IS_OK(status)) {
384 if (p->pipe_user.ut.uid != sec_initial_uid()) {
385 return status;
386 }
387 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
388 acc_granted, des_access));
389 DEBUGADD(4,("but overwritten by euid == 0\n"));
390 }
391
392 /* This is needed for lsa_open_account and rpcclient .... :-) */
393
394 if (p->pipe_user.ut.uid == sec_initial_uid())
395 acc_granted = LSA_POLICY_ALL_ACCESS;
396
397 /* associate the domain SID with the (unique) handle. */
398 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
399 return NT_STATUS_NO_MEMORY;
400
401 ZERO_STRUCTP(info);
402 sid_copy(&info->sid,get_global_sam_sid());
403 info->access = acc_granted;
404
405 /* set up the LSA QUERY INFO response */
406 if (!create_policy_hnd(p, r->out.handle, free_lsa_info, (void *)info))
407 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
408
409 return NT_STATUS_OK;
410 }
411
412 /***************************************************************************
413 _lsa_OpenPolicy
414 ***************************************************************************/
415
416 NTSTATUS _lsa_OpenPolicy(pipes_struct *p,
417 struct lsa_OpenPolicy *r)
418 {
419 struct lsa_info *info;
420 SEC_DESC *psd = NULL;
421 size_t sd_size;
422 uint32 des_access= r->in.access_mask;
423 uint32 acc_granted;
424 NTSTATUS status;
425
426
427 /* map the generic bits to the lsa policy ones */
428 se_map_generic(&des_access, &lsa_generic_mapping);
429
430 /* get the generic lsa policy SD until we store it */
431 lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
432
433 status = se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted);
434 if (!NT_STATUS_IS_OK(status)) {
435 if (p->pipe_user.ut.uid != sec_initial_uid()) {
436 return status;
437 }
438 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
439 acc_granted, des_access));
440 DEBUGADD(4,("but overwritten by euid == 0\n"));
441 acc_granted = des_access;
442 }
443
444 /* associate the domain SID with the (unique) handle. */
445 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
446 return NT_STATUS_NO_MEMORY;
447
448 ZERO_STRUCTP(info);
449 sid_copy(&info->sid,get_global_sam_sid());
450 info->access = acc_granted;
451
452 /* set up the LSA QUERY INFO response */
453 if (!create_policy_hnd(p, r->out.handle, free_lsa_info, (void *)info))
454 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
455
456 return NT_STATUS_OK;
457 }
458
459 /***************************************************************************
460 _lsa_EnumTrustDom - this needs fixing to do more than return NULL ! JRA.
461 ufff, done :) mimir
462 ***************************************************************************/
463
464 NTSTATUS _lsa_EnumTrustDom(pipes_struct *p,
465 struct lsa_EnumTrustDom *r)
466 {
467 struct lsa_info *info;
468 uint32 next_idx;
469 struct trustdom_info **domains;
470 struct lsa_DomainInfo *lsa_domains = NULL;
471 int i;
472
473 /*
474 * preferred length is set to 5 as a "our" preferred length
475 * nt sets this parameter to 2
476 * update (20.08.2002): it's not preferred length, but preferred size!
477 * it needs further investigation how to optimally choose this value
478 */
479 uint32 max_num_domains =
480 r->in.max_size < 5 ? r->in.max_size : 10;
481 uint32 num_domains;
482 NTSTATUS nt_status;
483 uint32 num_thistime;
484
485 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
486 return NT_STATUS_INVALID_HANDLE;
487
488 /* check if the user has enough rights */
489 if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
490 return NT_STATUS_ACCESS_DENIED;
491
492 become_root();
493 nt_status = pdb_enum_trusteddoms(p->mem_ctx, &num_domains, &domains);
494 unbecome_root();
495
496 if (!NT_STATUS_IS_OK(nt_status)) {
497 return nt_status;
498 }
499
500 if (*r->in.resume_handle < num_domains) {
501 num_thistime = MIN(num_domains, max_num_domains);
502
503 nt_status = STATUS_MORE_ENTRIES;
504
505 if (*r->in.resume_handle + num_thistime > num_domains) {
506 num_thistime = num_domains - *r->in.resume_handle;
507 nt_status = NT_STATUS_OK;
508 }
509
510 next_idx = *r->in.resume_handle + num_thistime;
511 } else {
512 num_thistime = 0;
513 next_idx = 0xffffffff;
514 nt_status = NT_STATUS_NO_MORE_ENTRIES;
515 }
516
517 /* set up the lsa_enum_trust_dom response */
518
519 lsa_domains = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_DomainInfo,
520 num_thistime);
521 if (!lsa_domains) {
522 return NT_STATUS_NO_MEMORY;
523 }
524
525 for (i=0; i<num_thistime; i++) {
526 init_lsa_StringLarge(&lsa_domains[i].name, domains[i]->name);
527 lsa_domains[i].sid = &domains[i]->sid;
528 }
529
530 *r->out.resume_handle = next_idx;
531 r->out.domains->count = num_thistime;
532 r->out.domains->domains = lsa_domains;
533
534 return nt_status;
535 }
536
537 #define LSA_AUDIT_NUM_CATEGORIES_NT4 7
538 #define LSA_AUDIT_NUM_CATEGORIES_WIN2K 9
539 #define LSA_AUDIT_NUM_CATEGORIES LSA_AUDIT_NUM_CATEGORIES_NT4
540
541 /***************************************************************************
542 _lsa_QueryInfoPolicy
543 ***************************************************************************/
544
545 NTSTATUS _lsa_QueryInfoPolicy(pipes_struct *p,
546 struct lsa_QueryInfoPolicy *r)
547 {
548 NTSTATUS status = NT_STATUS_OK;
549 struct lsa_info *handle;
550 DOM_SID domain_sid;
551 const char *name;
552 DOM_SID *sid = NULL;
553 union lsa_PolicyInformation *info = NULL;
554
555 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
556 return NT_STATUS_INVALID_HANDLE;
557
558 info = TALLOC_ZERO_P(p->mem_ctx, union lsa_PolicyInformation);
559 if (!info) {
560 return NT_STATUS_NO_MEMORY;
561 }
562
563 switch (r->in.level) {
564 case 0x02:
565 {
566
567 uint32 policy_def = LSA_AUDIT_POLICY_ALL;
568
569 /* check if the user has enough rights */
570 if (!(handle->access & LSA_POLICY_VIEW_AUDIT_INFORMATION)) {
571 DEBUG(10,("_lsa_QueryInfoPolicy: insufficient access rights\n"));
572 return NT_STATUS_ACCESS_DENIED;
573 }
574
575 /* fake info: We audit everything. ;) */
576
577 info->audit_events.auditing_mode = true;
578 info->audit_events.count = LSA_AUDIT_NUM_CATEGORIES;
579 info->audit_events.settings = TALLOC_ZERO_ARRAY(p->mem_ctx,
580 enum lsa_PolicyAuditPolicy,
581 info->audit_events.count);
582 if (!info->audit_events.settings) {
583 return NT_STATUS_NO_MEMORY;
584 }
585
586 info->audit_events.settings[LSA_AUDIT_CATEGORY_ACCOUNT_MANAGEMENT] = policy_def;
587 info->audit_events.settings[LSA_AUDIT_CATEGORY_FILE_AND_OBJECT_ACCESS] = policy_def;
588 info->audit_events.settings[LSA_AUDIT_CATEGORY_LOGON] = policy_def;
589 info->audit_events.settings[LSA_AUDIT_CATEGORY_PROCCESS_TRACKING] = policy_def;
590 info->audit_events.settings[LSA_AUDIT_CATEGORY_SECURITY_POLICY_CHANGES] = policy_def;
591 info->audit_events.settings[LSA_AUDIT_CATEGORY_SYSTEM] = policy_def;
592 info->audit_events.settings[LSA_AUDIT_CATEGORY_USE_OF_USER_RIGHTS] = policy_def;
593
594 break;
595 }
596 case 0x03:
597 /* check if the user has enough rights */
598 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
599 return NT_STATUS_ACCESS_DENIED;
600
601 /* Request PolicyPrimaryDomainInformation. */
602 switch (lp_server_role()) {
603 case ROLE_DOMAIN_PDC:
604 case ROLE_DOMAIN_BDC:
605 name = get_global_sam_name();
606 sid = sid_dup_talloc(p->mem_ctx, get_global_sam_sid());
607 if (!sid) {
608 return NT_STATUS_NO_MEMORY;
609 }
610 break;
611 case ROLE_DOMAIN_MEMBER:
612 name = lp_workgroup();
613 /* We need to return the Domain SID here. */
614 if (secrets_fetch_domain_sid(lp_workgroup(), &domain_sid)) {
615 sid = sid_dup_talloc(p->mem_ctx, &domain_sid);
616 if (!sid) {
617 return NT_STATUS_NO_MEMORY;
618 }
619 } else {
620 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
621 }
622 break;
623 case ROLE_STANDALONE:
624 name = lp_workgroup();
625 sid = NULL;
626 break;
627 default:
628 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
629 }
630 init_dom_query_3(&info->domain, name, sid);
631 break;
632 case 0x05:
633 /* check if the user has enough rights */
634 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
635 return NT_STATUS_ACCESS_DENIED;
636
637 /* Request PolicyAccountDomainInformation. */
638 name = get_global_sam_name();
639 sid = get_global_sam_sid();
640
641 init_dom_query_5(&info->account_domain, name, sid);
642 break;
643 case 0x06:
644 /* check if the user has enough rights */
645 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
646 return NT_STATUS_ACCESS_DENIED;
647
648 switch (lp_server_role()) {
649 case ROLE_DOMAIN_BDC:
650 /*
651 * only a BDC is a backup controller
652 * of the domain, it controls.
653 */
654 info->role.role = 2;
655 break;
656 default:
657 /*
658 * any other role is a primary
659 * of the domain, it controls.
660 */
661 info->role.role = 3;
662 break;
663 }
664 break;
665 default:
666 DEBUG(0,("_lsa_QueryInfoPolicy: unknown info level in Lsa Query: %d\n",
667 r->in.level));
668 status = NT_STATUS_INVALID_INFO_CLASS;
669 break;
670 }
671
672 *r->out.info = info;
673
674 return status;
675 }
676
677 /***************************************************************************
678 _lsa_lookup_sids_internal
679 ***************************************************************************/
680
681 static NTSTATUS _lsa_lookup_sids_internal(pipes_struct *p,
682 TALLOC_CTX *mem_ctx,
683 uint16_t level, /* input */
684 int num_sids, /* input */
685 struct lsa_SidPtr *sid, /* input */
686 struct lsa_RefDomainList **pp_ref, /* input/output */
687 struct lsa_TranslatedName2 **pp_names,/* input/output */
688 uint32_t *pp_mapped_count) /* input/output */
689 {
690 NTSTATUS status;
691 int i;
692 const DOM_SID **sids = NULL;
693 struct lsa_RefDomainList *ref = NULL;
694 uint32 mapped_count = 0;
695 struct lsa_dom_info *dom_infos = NULL;
696 struct lsa_name_info *name_infos = NULL;
697 struct lsa_TranslatedName2 *names = NULL;
698
699 *pp_mapped_count = 0;
700 *pp_names = NULL;
701 *pp_ref = NULL;
702
703 if (num_sids == 0) {
704 return NT_STATUS_OK;
705 }
706
707 sids = TALLOC_ARRAY(p->mem_ctx, const DOM_SID *, num_sids);
708 ref = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
709
710 if (sids == NULL || ref == NULL) {
711 return NT_STATUS_NO_MEMORY;
712 }
713
714 for (i=0; i<num_sids; i++) {
715 sids[i] = sid[i].sid;
716 }
717
718 status = lookup_sids(p->mem_ctx, num_sids, sids, level,
719 &dom_infos, &name_infos);
720
721 if (!NT_STATUS_IS_OK(status)) {
722 return status;
723 }
724
725 names = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedName2, num_sids);
726 if (names == NULL) {
727 return NT_STATUS_NO_MEMORY;
728 }
729
730 for (i=0; i<MAX_REF_DOMAINS; i++) {
731
732 if (!dom_infos[i].valid) {
733 break;
734 }
735
736 if (init_lsa_ref_domain_list(mem_ctx, ref,
737 dom_infos[i].name,
738 &dom_infos[i].sid) != i) {
739 DEBUG(0, ("Domain %s mentioned twice??\n",
740 dom_infos[i].name));
741 return NT_STATUS_INTERNAL_ERROR;
742 }
743 }
744
745 for (i=0; i<num_sids; i++) {
746 struct lsa_name_info *name = &name_infos[i];
747
748 if (name->type == SID_NAME_UNKNOWN) {
749 fstring tmp;
750 name->dom_idx = -1;
751 /* Unknown sids should return the string
752 * representation of the SID. Windows 2003 behaves
753 * rather erratic here, in many cases it returns the
754 * RID as 8 bytes hex, in others it returns the full
755 * SID. We (Jerry/VL) could not figure out which the
756 * hard cases are, so leave it with the SID. */
757 name->name = talloc_asprintf(p->mem_ctx, "%s",
758 sid_to_fstring(tmp,
759 sids[i]));
760 if (name->name == NULL) {
761 return NT_STATUS_NO_MEMORY;
762 }
763 } else {
764 mapped_count += 1;
765 }
766
767 init_lsa_translated_name2(&names[i], name->type,
768 name->name, name->dom_idx, 0);
769 }
770
771 status = NT_STATUS_NONE_MAPPED;
772 if (mapped_count > 0) {
773 status = (mapped_count < num_sids) ?
774 STATUS_SOME_UNMAPPED : NT_STATUS_OK;
775 }
776
777 DEBUG(10, ("num_sids %d, mapped_count %d, status %s\n",
778 num_sids, mapped_count, nt_errstr(status)));
779
780 *pp_mapped_count = mapped_count;
781 *pp_names = names;
782 *pp_ref = ref;
783
784 return status;
785 }
786
787 /***************************************************************************
788 _lsa_LookupSids
789 ***************************************************************************/
790
791 NTSTATUS _lsa_LookupSids(pipes_struct *p,
792 struct lsa_LookupSids *r)
793 {
794 NTSTATUS status;
795 struct lsa_info *handle;
796 int num_sids = r->in.sids->num_sids;
797 uint32 mapped_count = 0;
798 struct lsa_RefDomainList *domains = NULL;
799 struct lsa_TranslatedName *names_out = NULL;
800 struct lsa_TranslatedName2 *names = NULL;
801 int i;
802
803 if ((r->in.level < 1) || (r->in.level > 6)) {
804 return NT_STATUS_INVALID_PARAMETER;
805 }
806
807 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
808 return NT_STATUS_INVALID_HANDLE;
809 }
810
811 /* check if the user has enough rights */
812 if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
813 return NT_STATUS_ACCESS_DENIED;
814 }
815
816 if (num_sids > MAX_LOOKUP_SIDS) {
817 DEBUG(5,("_lsa_LookupSids: limit of %d exceeded, requested %d\n",
818 MAX_LOOKUP_SIDS, num_sids));
819 return NT_STATUS_NONE_MAPPED;
820 }
821
822 status = _lsa_lookup_sids_internal(p,
823 p->mem_ctx,
824 r->in.level,
825 num_sids,
826 r->in.sids->sids,
827 &domains,
828 &names,
829 &mapped_count);
830
831 /* Only return here when there is a real error.
832 NT_STATUS_NONE_MAPPED is a special case as it indicates that none of
833 the requested sids could be resolved. Older versions of XP (pre SP3)
834 rely that we return with the string representations of those SIDs in
835 that case. If we don't, XP crashes - Guenther
836 */
837
838 if (NT_STATUS_IS_ERR(status) &&
839 !NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
840 return status;
841 }
842
843 /* Convert from lsa_TranslatedName2 to lsa_TranslatedName */
844 names_out = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedName,
845 num_sids);
846 if (!names_out) {
847 return NT_STATUS_NO_MEMORY;
848 }
849
850 for (i=0; i<num_sids; i++) {
851 names_out[i].sid_type = names[i].sid_type;
852 names_out[i].name = names[i].name;
853 names_out[i].sid_index = names[i].sid_index;
854 }
855
856 *r->out.domains = domains;
857 r->out.names->count = num_sids;
858 r->out.names->names = names_out;
859 *r->out.count = mapped_count;
860
861 return status;
862 }
863
864 /***************************************************************************
865 _lsa_LookupSids2
866 ***************************************************************************/
867
868 NTSTATUS _lsa_LookupSids2(pipes_struct *p,
869 struct lsa_LookupSids2 *r)
870 {
871 NTSTATUS status;
872 struct lsa_info *handle;
873 int num_sids = r->in.sids->num_sids;
874 uint32 mapped_count = 0;
875 struct lsa_RefDomainList *domains = NULL;
876 struct lsa_TranslatedName2 *names = NULL;
877 bool check_policy = true;
878
879 switch (p->hdr_req.opnum) {
880 case NDR_LSA_LOOKUPSIDS3:
881 check_policy = false;
882 break;
883 case NDR_LSA_LOOKUPSIDS2:
884 default:
885 check_policy = true;
886 }
887
888 if ((r->in.level < 1) || (r->in.level > 6)) {
889 return NT_STATUS_INVALID_PARAMETER;
890 }
891
892 if (check_policy) {
893 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
894 return NT_STATUS_INVALID_HANDLE;
895 }
896
897 /* check if the user has enough rights */
898 if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
899 return NT_STATUS_ACCESS_DENIED;
900 }
901 }
902
903 if (num_sids > MAX_LOOKUP_SIDS) {
904 DEBUG(5,("_lsa_LookupSids2: limit of %d exceeded, requested %d\n",
905 MAX_LOOKUP_SIDS, num_sids));
906 return NT_STATUS_NONE_MAPPED;
907 }
908
909 status = _lsa_lookup_sids_internal(p,
910 p->mem_ctx,
911 r->in.level,
912 num_sids,
913 r->in.sids->sids,
914 &domains,
915 &names,
916 &mapped_count);
917
918 *r->out.domains = domains;
919 r->out.names->count = num_sids;
920 r->out.names->names = names;
921 *r->out.count = mapped_count;
922
923 return status;
924 }
925
926 /***************************************************************************
927 _lsa_LookupSids3
928 ***************************************************************************/
929
930 NTSTATUS _lsa_LookupSids3(pipes_struct *p,
931 struct lsa_LookupSids3 *r)
932 {
933 struct lsa_LookupSids2 q;
934
935 /* No policy handle on this call. Restrict to crypto connections. */
936 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
937 DEBUG(0,("_lsa_LookupSids3: client %s not using schannel for netlogon\n",
938 get_remote_machine_name() ));
939 return NT_STATUS_INVALID_PARAMETER;
940 }
941
942 q.in.handle = NULL;
943 q.in.sids = r->in.sids;
944 q.in.level = r->in.level;
945 q.in.unknown1 = r->in.unknown1;
946 q.in.unknown2 = r->in.unknown2;
947 q.in.names = r->in.names;
948 q.in.count = r->in.count;
949
950 q.out.domains = r->out.domains;
951 q.out.names = r->out.names;
952 q.out.count = r->out.count;
953
954 return _lsa_LookupSids2(p, &q);
955 }
956
957 /***************************************************************************
958 ***************************************************************************/
959
960 static int lsa_lookup_level_to_flags(uint16 level)
961 {
962 int flags;
963
964 switch (level) {
965 case 1:
966 flags = LOOKUP_NAME_ALL;
967 break;
968 case 2:
969 flags = LOOKUP_NAME_DOMAIN|LOOKUP_NAME_REMOTE|LOOKUP_NAME_ISOLATED;
970 break;
971 case 3:
972 flags = LOOKUP_NAME_DOMAIN|LOOKUP_NAME_ISOLATED;
973 break;
974 case 4:
975 case 5:
976 case 6:
977 default:
978 flags = LOOKUP_NAME_NONE;
979 break;
980 }
981
982 return flags;
983 }
984
985 /***************************************************************************
986 _lsa_LookupNames
987 ***************************************************************************/
988
989 NTSTATUS _lsa_LookupNames(pipes_struct *p,
990 struct lsa_LookupNames *r)
991 {
992 NTSTATUS status = NT_STATUS_NONE_MAPPED;
993 struct lsa_info *handle;
994 struct lsa_String *names = r->in.names;
995 uint32 num_entries = r->in.num_names;
996 struct lsa_RefDomainList *domains = NULL;
997 struct lsa_TranslatedSid *rids = NULL;
998 uint32 mapped_count = 0;
999 int flags = 0;
1000
1001 if (num_entries > MAX_LOOKUP_SIDS) {
1002 num_entries = MAX_LOOKUP_SIDS;
1003 DEBUG(5,("_lsa_LookupNames: truncating name lookup list to %d\n",
1004 num_entries));
1005 }
1006
1007 flags = lsa_lookup_level_to_flags(r->in.level);
1008
1009 domains = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
1010 if (!domains) {
1011 return NT_STATUS_NO_MEMORY;
1012 }
1013
1014 if (num_entries) {
1015 rids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_TranslatedSid,
1016 num_entries);
1017 if (!rids) {
1018 return NT_STATUS_NO_MEMORY;
1019 }
1020 } else {
1021 rids = NULL;
1022 }
1023
1024 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
1025 status = NT_STATUS_INVALID_HANDLE;
1026 goto done;
1027 }
1028
1029 /* check if the user has enough rights */
1030 if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
1031 status = NT_STATUS_ACCESS_DENIED;
1032 goto done;
1033 }
1034
1035 /* set up the LSA Lookup RIDs response */
1036 become_root(); /* lookup_name can require root privs */
1037 status = lookup_lsa_rids(p->mem_ctx, domains, rids, num_entries,
1038 names, flags, &mapped_count);
1039 unbecome_root();
1040
1041 done:
1042
1043 if (NT_STATUS_IS_OK(status) && (num_entries != 0) ) {
1044 if (mapped_count == 0) {
1045 status = NT_STATUS_NONE_MAPPED;
1046 } else if (mapped_count != num_entries) {
1047 status = STATUS_SOME_UNMAPPED;
1048 }
1049 }
1050
1051 *r->out.count = mapped_count;
1052 *r->out.domains = domains;
1053 r->out.sids->sids = rids;
1054 r->out.sids->count = num_entries;
1055
1056 return status;
1057 }
1058
1059 /***************************************************************************
1060 _lsa_LookupNames2
1061 ***************************************************************************/
1062
1063 NTSTATUS _lsa_LookupNames2(pipes_struct *p,
1064 struct lsa_LookupNames2 *r)
1065 {
1066 NTSTATUS status;
1067 struct lsa_LookupNames q;
1068 struct lsa_TransSidArray2 *sid_array2 = r->in.sids;
1069 struct lsa_TransSidArray *sid_array = NULL;
1070 uint32_t i;
1071
1072 sid_array = TALLOC_ZERO_P(p->mem_ctx, struct lsa_TransSidArray);
1073 if (!sid_array) {
1074 return NT_STATUS_NO_MEMORY;
1075 }
1076
1077 q.in.handle = r->in.handle;
1078 q.in.num_names = r->in.num_names;
1079 q.in.names = r->in.names;
1080 q.in.level = r->in.level;
1081 q.in.sids = sid_array;
1082 q.in.count = r->in.count;
1083 /* we do not know what this is for */
1084 /* = r->in.unknown1; */
1085 /* = r->in.unknown2; */
1086
1087 q.out.domains = r->out.domains;
1088 q.out.sids = sid_array;
1089 q.out.count = r->out.count;
1090
1091 status = _lsa_LookupNames(p, &q);
1092
1093 sid_array2->sids = TALLOC_ARRAY(p->mem_ctx, struct lsa_TranslatedSid2, sid_array->count);
1094 if (!sid_array2->sids) {
1095 return NT_STATUS_NO_MEMORY;
1096 }
1097
1098 for (i=0; i<sid_array->count; i++) {
1099 sid_array2->sids[i].sid_type = sid_array->sids[i].sid_type;
1100 sid_array2->sids[i].rid = sid_array->sids[i].rid;
1101 sid_array2->sids[i].sid_index = sid_array->sids[i].sid_index;
1102 sid_array2->sids[i].unknown = 0;
1103 }
1104
1105 r->out.sids = sid_array2;
1106
1107 return status;
1108 }
1109
1110 /***************************************************************************
1111 _lsa_LookupNames3
1112 ***************************************************************************/
1113
1114 NTSTATUS _lsa_LookupNames3(pipes_struct *p,
1115 struct lsa_LookupNames3 *r)
1116 {
1117 NTSTATUS status;
1118 struct lsa_info *handle;
1119 struct lsa_String *names = r->in.names;
1120 uint32 num_entries = r->in.num_names;
1121 struct lsa_RefDomainList *domains = NULL;
1122 struct lsa_TranslatedSid3 *trans_sids = NULL;
1123 uint32 mapped_count = 0;
1124 int flags = 0;
1125 bool check_policy = true;
1126
1127 switch (p->hdr_req.opnum) {
1128 case NDR_LSA_LOOKUPNAMES4:
1129 check_policy = false;
1130 break;
1131 case NDR_LSA_LOOKUPNAMES3:
1132 default:
1133 check_policy = true;
1134 }
1135
1136 if (num_entries > MAX_LOOKUP_SIDS) {
1137 num_entries = MAX_LOOKUP_SIDS;
1138 DEBUG(5,("_lsa_LookupNames3: truncating name lookup list to %d\n", num_entries));
1139 }
1140
1141 /* Probably the lookup_level is some sort of bitmask. */
1142 if (r->in.level == 1) {
1143 flags = LOOKUP_NAME_ALL;
1144 }
1145
1146 domains = TALLOC_ZERO_P(p->mem_ctx, struct lsa_RefDomainList);
1147 if (!domains) {
1148 return NT_STATUS_NO_MEMORY;
1149 }
1150
1151 if (num_entries) {
1152 trans_sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_TranslatedSid3,
1153 num_entries);
1154 if (!trans_sids) {
1155 return NT_STATUS_NO_MEMORY;
1156 }
1157 } else {
1158 trans_sids = NULL;
1159 }
1160
1161 if (check_policy) {
1162
1163 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle)) {
1164 status = NT_STATUS_INVALID_HANDLE;
1165 goto done;
1166 }
1167
1168 /* check if the user has enough rights */
1169 if (!(handle->access & LSA_POLICY_LOOKUP_NAMES)) {
1170 status = NT_STATUS_ACCESS_DENIED;
1171 goto done;
1172 }
1173 }
1174
1175 /* set up the LSA Lookup SIDs response */
1176 become_root(); /* lookup_name can require root privs */
1177 status = lookup_lsa_sids(p->mem_ctx, domains, trans_sids, num_entries,
1178 names, flags, &mapped_count);
1179 unbecome_root();
1180
1181 done:
1182
1183 if (NT_STATUS_IS_OK(status)) {
1184 if (mapped_count == 0) {
1185 status = NT_STATUS_NONE_MAPPED;
1186 } else if (mapped_count != num_entries) {
1187 status = STATUS_SOME_UNMAPPED;
1188 }
1189 }
1190
1191 *r->out.count = mapped_count;
1192 *r->out.domains = domains;
1193 r->out.sids->sids = trans_sids;
1194 r->out.sids->count = num_entries;
1195
1196 return status;
1197 }
1198
1199 /***************************************************************************
1200 _lsa_LookupNames4
1201 ***************************************************************************/
1202
1203 NTSTATUS _lsa_LookupNames4(pipes_struct *p,
1204 struct lsa_LookupNames4 *r)
1205 {
1206 struct lsa_LookupNames3 q;
1207
1208 /* No policy handle on this call. Restrict to crypto connections. */
1209 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1210 DEBUG(0,("_lsa_lookup_names4: client %s not using schannel for netlogon\n",
1211 get_remote_machine_name() ));
1212 return NT_STATUS_INVALID_PARAMETER;
1213 }
1214
1215 q.in.handle = NULL;
1216 q.in.num_names = r->in.num_names;
1217 q.in.names = r->in.names;
1218 q.in.level = r->in.level;
1219 q.in.unknown1 = r->in.unknown1;
1220 q.in.unknown2 = r->in.unknown2;
1221 q.in.sids = r->in.sids;
1222 q.in.count = r->in.count;
1223
1224 q.out.domains = r->out.domains;
1225 q.out.sids = r->out.sids;
1226 q.out.count = r->out.count;
1227
1228 return _lsa_LookupNames3(p, &q);
1229 }
1230
1231 /***************************************************************************
1232 _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
1233 ***************************************************************************/
1234
1235 NTSTATUS _lsa_Close(pipes_struct *p, struct lsa_Close *r)
1236 {
1237 if (!find_policy_by_hnd(p, r->in.handle, NULL)) {
1238 return NT_STATUS_INVALID_HANDLE;
1239 }
1240
1241 close_policy_hnd(p, r->in.handle);
1242 ZERO_STRUCTP(r->out.handle);
1243 return NT_STATUS_OK;
1244 }
1245
1246 /***************************************************************************
1247 ***************************************************************************/
1248
1249 NTSTATUS _lsa_OpenSecret(pipes_struct *p, struct lsa_OpenSecret *r)
1250 {
1251 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1252 }
1253
1254 /***************************************************************************
1255 ***************************************************************************/
1256
1257 NTSTATUS _lsa_OpenTrustedDomain(pipes_struct *p, struct lsa_OpenTrustedDomain *r)
1258 {
1259 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1260 }
1261
1262 /***************************************************************************
1263 ***************************************************************************/
1264
1265 NTSTATUS _lsa_CreateTrustedDomain(pipes_struct *p, struct lsa_CreateTrustedDomain *r)
1266 {
1267 return NT_STATUS_ACCESS_DENIED;
1268 }
1269
1270 /***************************************************************************
1271 ***************************************************************************/
1272
1273 NTSTATUS _lsa_CreateSecret(pipes_struct *p, struct lsa_CreateSecret *r)
1274 {
1275 return NT_STATUS_ACCESS_DENIED;
1276 }
1277
1278 /***************************************************************************
1279 ***************************************************************************/
1280
1281 NTSTATUS _lsa_SetSecret(pipes_struct *p, struct lsa_SetSecret *r)
1282 {
1283 return NT_STATUS_ACCESS_DENIED;
1284 }
1285
1286 /***************************************************************************
1287 _lsa_DeleteObject
1288 ***************************************************************************/
1289
1290 NTSTATUS _lsa_DeleteObject(pipes_struct *p,
1291 struct lsa_DeleteObject *r)
1292 {
1293 return NT_STATUS_ACCESS_DENIED;
1294 }
1295
1296 /***************************************************************************
1297 _lsa_EnumPrivs
1298 ***************************************************************************/
1299
1300 NTSTATUS _lsa_EnumPrivs(pipes_struct *p,
1301 struct lsa_EnumPrivs *r)
1302 {
1303 struct lsa_info *handle;
1304 uint32 i;
1305 uint32 enum_context = *r->in.resume_handle;
1306 int num_privs = count_all_privileges();
1307 struct lsa_PrivEntry *entries = NULL;
1308 LUID_ATTR luid;
1309
1310 /* remember that the enum_context starts at 0 and not 1 */
1311
1312 if ( enum_context >= num_privs )
1313 return NT_STATUS_NO_MORE_ENTRIES;
1314
1315 DEBUG(10,("_lsa_EnumPrivs: enum_context:%d total entries:%d\n",
1316 enum_context, num_privs));
1317
1318 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1319 return NT_STATUS_INVALID_HANDLE;
1320
1321 /* check if the user has enough rights
1322 I don't know if it's the right one. not documented. */
1323
1324 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1325 return NT_STATUS_ACCESS_DENIED;
1326
1327 if (num_privs) {
1328 entries = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_PrivEntry, num_privs);
1329 if (!entries) {
1330 return NT_STATUS_NO_MEMORY;
1331 }
1332 } else {
1333 entries = NULL;
1334 }
1335
1336 for (i = 0; i < num_privs; i++) {
1337 if( i < enum_context) {
1338
1339 init_lsa_StringLarge(&entries[i].name, NULL);
1340
1341 entries[i].luid.low = 0;
1342 entries[i].luid.high = 0;
1343 } else {
1344
1345 init_lsa_StringLarge(&entries[i].name, privs[i].name);
1346
1347 luid = get_privilege_luid( &privs[i].se_priv );
1348
1349 entries[i].luid.low = luid.luid.low;
1350 entries[i].luid.high = luid.luid.high;
1351 }
1352 }
1353
1354 enum_context = num_privs;
1355
1356 *r->out.resume_handle = enum_context;
1357 r->out.privs->count = num_privs;
1358 r->out.privs->privs = entries;
1359
1360 return NT_STATUS_OK;
1361 }
1362
1363 /***************************************************************************
1364 _lsa_LookupPrivDisplayName
1365 ***************************************************************************/
1366
1367 NTSTATUS _lsa_LookupPrivDisplayName(pipes_struct *p,
1368 struct lsa_LookupPrivDisplayName *r)
1369 {
1370 struct lsa_info *handle;
1371 const char *description;
1372 struct lsa_StringLarge *lsa_name;
1373
1374 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1375 return NT_STATUS_INVALID_HANDLE;
1376
1377 /* check if the user has enough rights */
1378
1379 /*
1380 * I don't know if it's the right one. not documented.
1381 */
1382 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1383 return NT_STATUS_ACCESS_DENIED;
1384
1385 DEBUG(10,("_lsa_LookupPrivDisplayName: name = %s\n", r->in.name->string));
1386
1387 description = get_privilege_dispname(r->in.name->string);
1388 if (!description) {
1389 DEBUG(10,("_lsa_LookupPrivDisplayName: doesn't exist\n"));
1390 return NT_STATUS_NO_SUCH_PRIVILEGE;
1391 }
1392
1393 DEBUG(10,("_lsa_LookupPrivDisplayName: display name = %s\n", description));
1394
1395 lsa_name = TALLOC_ZERO_P(p->mem_ctx, struct lsa_StringLarge);
1396 if (!lsa_name) {
1397 return NT_STATUS_NO_MEMORY;
1398 }
1399
1400 init_lsa_StringLarge(lsa_name, description);
1401
1402 *r->out.returned_language_id = r->in.language_id;
1403 *r->out.disp_name = lsa_name;
1404
1405 return NT_STATUS_OK;
1406 }
1407
1408 /***************************************************************************
1409 _lsa_EnumAccounts
1410 ***************************************************************************/
1411
1412 NTSTATUS _lsa_EnumAccounts(pipes_struct *p,
1413 struct lsa_EnumAccounts *r)
1414 {
1415 struct lsa_info *handle;
1416 DOM_SID *sid_list;
1417 int i, j, num_entries;
1418 NTSTATUS status;
1419 struct lsa_SidPtr *sids = NULL;
1420
1421 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1422 return NT_STATUS_INVALID_HANDLE;
1423
1424 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1425 return NT_STATUS_ACCESS_DENIED;
1426
1427 sid_list = NULL;
1428 num_entries = 0;
1429
1430 /* The only way we can currently find out all the SIDs that have been
1431 privileged is to scan all privileges */
1432
1433 status = privilege_enumerate_accounts(&sid_list, &num_entries);
1434 if (!NT_STATUS_IS_OK(status)) {
1435 return status;
1436 }
1437
1438 if (*r->in.resume_handle >= num_entries) {
1439 return NT_STATUS_NO_MORE_ENTRIES;
1440 }
1441
1442 if (num_entries - *r->in.resume_handle) {
1443 sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_SidPtr,
1444 num_entries - *r->in.resume_handle);
1445 if (!sids) {
1446 SAFE_FREE(sid_list);
1447 return NT_STATUS_NO_MEMORY;
1448 }
1449
1450 for (i = *r->in.resume_handle, j = 0; i < num_entries; i++, j++) {
1451 sids[j].sid = sid_dup_talloc(p->mem_ctx, &sid_list[i]);
1452 if (!sids[j].sid) {
1453 SAFE_FREE(sid_list);
1454 return NT_STATUS_NO_MEMORY;
1455 }
1456 }
1457 }
1458
1459 talloc_free(sid_list);
1460
1461 *r->out.resume_handle = num_entries;
1462 r->out.sids->num_sids = num_entries;
1463 r->out.sids->sids = sids;
1464
1465 return NT_STATUS_OK;
1466 }
1467
1468 /***************************************************************************
1469 _lsa_GetUserName
1470 ***************************************************************************/
1471
1472 NTSTATUS _lsa_GetUserName(pipes_struct *p,
1473 struct lsa_GetUserName *r)
1474 {
1475 const char *username, *domname;
1476 struct lsa_String *account_name = NULL;
1477 struct lsa_String *authority_name = NULL;
1478
1479 if (r->in.account_name &&
1480 *r->in.account_name) {
1481 return NT_STATUS_INVALID_PARAMETER;
1482 }
1483
1484 if (r->in.authority_name &&
1485 *r->in.authority_name) {
1486 return NT_STATUS_INVALID_PARAMETER;
1487 }
1488
1489 if (p->server_info->guest) {
1490 /*
1491 * I'm 99% sure this is not the right place to do this,
1492 * global_sid_Anonymous should probably be put into the token
1493 * instead of the guest id -- vl
1494 */
1495 if (!lookup_sid(p->mem_ctx, &global_sid_Anonymous,
1496 &domname, &username, NULL)) {
1497 return NT_STATUS_NO_MEMORY;
1498 }
1499 } else {
1500 username = p->server_info->sanitized_username;
1501 domname = pdb_get_domain(p->server_info->sam_account);
1502 }
1503
1504 account_name = TALLOC_ZERO_P(p->mem_ctx, struct lsa_String);
1505 if (!account_name) {
1506 return NT_STATUS_NO_MEMORY;
1507 }
1508 init_lsa_String(account_name, username);
1509
1510 if (r->out.authority_name) {
1511 authority_name = TALLOC_ZERO_P(p->mem_ctx, struct lsa_String);
1512 if (!authority_name) {
1513 return NT_STATUS_NO_MEMORY;
1514 }
1515 init_lsa_String(authority_name, domname);
1516 }
1517
1518 *r->out.account_name = account_name;
1519 if (r->out.authority_name) {
1520 *r->out.authority_name = authority_name;
1521 }
1522
1523 return NT_STATUS_OK;
1524 }
1525
1526 /***************************************************************************
1527 _lsa_CreateAccount
1528 ***************************************************************************/
1529
1530 NTSTATUS _lsa_CreateAccount(pipes_struct *p,
1531 struct lsa_CreateAccount *r)
1532 {
1533 struct lsa_info *handle;
1534 struct lsa_info *info;
1535
1536 /* find the connection policy handle. */
1537 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1538 return NT_STATUS_INVALID_HANDLE;
1539
1540 /* check if the user has enough rights */
1541
1542 /*
1543 * I don't know if it's the right one. not documented.
1544 * but guessed with rpcclient.
1545 */
1546 if (!(handle->access & LSA_POLICY_GET_PRIVATE_INFORMATION))
1547 return NT_STATUS_ACCESS_DENIED;
1548
1549 /* check to see if the pipe_user is a Domain Admin since
1550 account_pol.tdb was already opened as root, this is all we have */
1551
1552 if ( p->pipe_user.ut.uid != sec_initial_uid()
1553 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1554 return NT_STATUS_ACCESS_DENIED;
1555
1556 if ( is_privileged_sid( r->in.sid ) )
1557 return NT_STATUS_OBJECT_NAME_COLLISION;
1558
1559 /* associate the user/group SID with the (unique) handle. */
1560
1561 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
1562 return NT_STATUS_NO_MEMORY;
1563
1564 ZERO_STRUCTP(info);
1565 info->sid = *r->in.sid;
1566 info->access = r->in.access_mask;
1567
1568 /* get a (unique) handle. open a policy on it. */
1569 if (!create_policy_hnd(p, r->out.acct_handle, free_lsa_info, (void *)info))
1570 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1571
1572 return privilege_create_account( &info->sid );
1573 }
1574
1575
1576 /***************************************************************************
1577 _lsa_OpenAccount
1578 ***************************************************************************/
1579
1580 NTSTATUS _lsa_OpenAccount(pipes_struct *p,
1581 struct lsa_OpenAccount *r)
1582 {
1583 struct lsa_info *handle;
1584 struct lsa_info *info;
1585
1586 /* find the connection policy handle. */
1587 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1588 return NT_STATUS_INVALID_HANDLE;
1589
1590 /* check if the user has enough rights */
1591
1592 /*
1593 * I don't know if it's the right one. not documented.
1594 * but guessed with rpcclient.
1595 */
1596 if (!(handle->access & LSA_POLICY_GET_PRIVATE_INFORMATION))
1597 return NT_STATUS_ACCESS_DENIED;
1598
1599 /* TODO: Fis the parsing routine before reenabling this check! */
1600 #if 0
1601 if (!lookup_sid(&handle->sid, dom_name, name, &type))
1602 return NT_STATUS_ACCESS_DENIED;
1603 #endif
1604 /* associate the user/group SID with the (unique) handle. */
1605 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
1606 return NT_STATUS_NO_MEMORY;
1607
1608 ZERO_STRUCTP(info);
1609 info->sid = *r->in.sid;
1610 info->access = r->in.access_mask;
1611
1612 /* get a (unique) handle. open a policy on it. */
1613 if (!create_policy_hnd(p, r->out.acct_handle, free_lsa_info, (void *)info))
1614 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1615
1616 return NT_STATUS_OK;
1617 }
1618
1619 /***************************************************************************
1620 _lsa_EnumPrivsAccount
1621 For a given SID, enumerate all the privilege this account has.
1622 ***************************************************************************/
1623
1624 NTSTATUS _lsa_EnumPrivsAccount(pipes_struct *p,
1625 struct lsa_EnumPrivsAccount *r)
1626 {
1627 NTSTATUS status = NT_STATUS_OK;
1628 struct lsa_info *info=NULL;
1629 SE_PRIV mask;
1630 PRIVILEGE_SET privileges;
1631 struct lsa_PrivilegeSet *priv_set = NULL;
1632 struct lsa_LUIDAttribute *luid_attrs = NULL;
1633 int i;
1634
1635 /* find the connection policy handle. */
1636 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1637 return NT_STATUS_INVALID_HANDLE;
1638
1639 if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1640 return NT_STATUS_ACCESS_DENIED;
1641
1642 if ( !get_privileges_for_sids( &mask, &info->sid, 1 ) )
1643 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1644
1645 privilege_set_init( &privileges );
1646
1647 if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
1648
1649 DEBUG(10,("_lsa_EnumPrivsAccount: %s has %d privileges\n",
1650 sid_string_dbg(&info->sid),
1651 privileges.count));
1652
1653 priv_set = TALLOC_ZERO_P(p->mem_ctx, struct lsa_PrivilegeSet);
1654 if (!priv_set) {
1655 status = NT_STATUS_NO_MEMORY;
1656 goto done;
1657 }
1658
1659 luid_attrs = TALLOC_ZERO_ARRAY(p->mem_ctx,
1660 struct lsa_LUIDAttribute,
1661 privileges.count);
1662 if (!luid_attrs) {
1663 status = NT_STATUS_NO_MEMORY;
1664 goto done;
1665 }
1666
1667 for (i=0; i<privileges.count; i++) {
1668 luid_attrs[i].luid.low = privileges.set[i].luid.low;
1669 luid_attrs[i].luid.high = privileges.set[i].luid.high;
1670 luid_attrs[i].attribute = privileges.set[i].attr;
1671 }
1672
1673 priv_set->count = privileges.count;
1674 priv_set->unknown = 0;
1675 priv_set->set = luid_attrs;
1676
1677 *r->out.privs = priv_set;
1678 } else {
1679 status = NT_STATUS_NO_SUCH_PRIVILEGE;
1680 }
1681
1682 done:
1683 privilege_set_free( &privileges );
1684
1685 return status;
1686 }
1687
1688 /***************************************************************************
1689 _lsa_GetSystemAccessAccount
1690 ***************************************************************************/
1691
1692 NTSTATUS _lsa_GetSystemAccessAccount(pipes_struct *p,
1693 struct lsa_GetSystemAccessAccount *r)
1694 {
1695 struct lsa_info *info=NULL;
1696
1697 /* find the connection policy handle. */
1698
1699 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1700 return NT_STATUS_INVALID_HANDLE;
1701
1702 if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1703 return NT_STATUS_ACCESS_DENIED;
1704
1705 if (!lookup_sid(p->mem_ctx, &info->sid, NULL, NULL, NULL))
1706 return NT_STATUS_ACCESS_DENIED;
1707
1708 /*
1709 0x01 -> Log on locally
1710 0x02 -> Access this computer from network
1711 0x04 -> Log on as a batch job
1712 0x10 -> Log on as a service
1713
1714 they can be ORed together
1715 */
1716
1717 *r->out.access_mask = PR_LOG_ON_LOCALLY | PR_ACCESS_FROM_NETWORK;
1718
1719 return NT_STATUS_OK;
1720 }
1721
1722 /***************************************************************************
1723 update the systemaccount information
1724 ***************************************************************************/
1725
1726 NTSTATUS _lsa_SetSystemAccessAccount(pipes_struct *p,
1727 struct lsa_SetSystemAccessAccount *r)
1728 {
1729 struct lsa_info *info=NULL;
1730 GROUP_MAP map;
1731
1732 /* find the connection policy handle. */
1733 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1734 return NT_STATUS_INVALID_HANDLE;
1735
1736 /* check to see if the pipe_user is a Domain Admin since
1737 account_pol.tdb was already opened as root, this is all we have */
1738
1739 if ( p->pipe_user.ut.uid != sec_initial_uid()
1740 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1741 return NT_STATUS_ACCESS_DENIED;
1742
1743 if (!pdb_getgrsid(&map, info->sid))
1744 return NT_STATUS_NO_SUCH_GROUP;
1745
1746 return pdb_update_group_mapping_entry(&map);
1747 }
1748
1749 /***************************************************************************
1750 _lsa_AddPrivilegesToAccount
1751 For a given SID, add some privileges.
1752 ***************************************************************************/
1753
1754 NTSTATUS _lsa_AddPrivilegesToAccount(pipes_struct *p,
1755 struct lsa_AddPrivilegesToAccount *r)
1756 {
1757 struct lsa_info *info = NULL;
1758 SE_PRIV mask;
1759 struct lsa_PrivilegeSet *set = NULL;
1760
1761 /* find the connection policy handle. */
1762 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1763 return NT_STATUS_INVALID_HANDLE;
1764
1765 /* check to see if the pipe_user is root or a Domain Admin since
1766 account_pol.tdb was already opened as root, this is all we have */
1767
1768 if ( p->pipe_user.ut.uid != sec_initial_uid()
1769 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1770 {
1771 return NT_STATUS_ACCESS_DENIED;
1772 }
1773
1774 set = r->in.privs;
1775 if ( !privilege_set_to_se_priv( &mask, set ) )
1776 return NT_STATUS_NO_SUCH_PRIVILEGE;
1777
1778 if ( !grant_privilege( &info->sid, &mask ) ) {
1779 DEBUG(3,("_lsa_AddPrivilegesToAccount: grant_privilege(%s) failed!\n",
1780 sid_string_dbg(&info->sid) ));
1781 DEBUG(3,("Privilege mask:\n"));
1782 dump_se_priv( DBGC_ALL, 3, &mask );
1783 return NT_STATUS_NO_SUCH_PRIVILEGE;
1784 }
1785
1786 return NT_STATUS_OK;
1787 }
1788
1789 /***************************************************************************
1790 _lsa_RemovePrivilegesFromAccount
1791 For a given SID, remove some privileges.
1792 ***************************************************************************/
1793
1794 NTSTATUS _lsa_RemovePrivilegesFromAccount(pipes_struct *p,
1795 struct lsa_RemovePrivilegesFromAccount *r)
1796 {
1797 struct lsa_info *info = NULL;
1798 SE_PRIV mask;
1799 struct lsa_PrivilegeSet *set = NULL;
1800
1801 /* find the connection policy handle. */
1802 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1803 return NT_STATUS_INVALID_HANDLE;
1804
1805 /* check to see if the pipe_user is root or a Domain Admin since
1806 account_pol.tdb was already opened as root, this is all we have */
1807
1808 if ( p->pipe_user.ut.uid != sec_initial_uid()
1809 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1810 {
1811 return NT_STATUS_ACCESS_DENIED;
1812 }
1813
1814 set = r->in.privs;
1815
1816 if ( !privilege_set_to_se_priv( &mask, set ) )
1817 return NT_STATUS_NO_SUCH_PRIVILEGE;
1818
1819 if ( !revoke_privilege( &info->sid, &mask ) ) {
1820 DEBUG(3,("_lsa_RemovePrivilegesFromAccount: revoke_privilege(%s) failed!\n",
1821 sid_string_dbg(&info->sid) ));
1822 DEBUG(3,("Privilege mask:\n"));
1823 dump_se_priv( DBGC_ALL, 3, &mask );
1824 return NT_STATUS_NO_SUCH_PRIVILEGE;
1825 }
1826
1827 return NT_STATUS_OK;
1828 }
1829
1830 /***************************************************************************
1831 _lsa_QuerySecurity
1832 ***************************************************************************/
1833
1834 NTSTATUS _lsa_QuerySecurity(pipes_struct *p,
1835 struct lsa_QuerySecurity *r)
1836 {
1837 struct lsa_info *handle=NULL;
1838 SEC_DESC *psd = NULL;
1839 size_t sd_size;
1840 NTSTATUS status;
1841
1842 /* find the connection policy handle. */
1843 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
1844 return NT_STATUS_INVALID_HANDLE;
1845
1846 /* check if the user has enough rights */
1847 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1848 return NT_STATUS_ACCESS_DENIED;
1849
1850 switch (r->in.sec_info) {
1851 case 1:
1852 /* SD contains only the owner */
1853
1854 status=lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
1855 if(!NT_STATUS_IS_OK(status))
1856 return NT_STATUS_NO_MEMORY;
1857
1858
1859 if((*r->out.sdbuf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1860 return NT_STATUS_NO_MEMORY;
1861 break;
1862 case 4:
1863 /* SD contains only the ACL */
1864
1865 status=lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
1866 if(!NT_STATUS_IS_OK(status))
1867 return NT_STATUS_NO_MEMORY;
1868
1869 if((*r->out.sdbuf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1870 return NT_STATUS_NO_MEMORY;
1871 break;
1872 default:
1873 return NT_STATUS_INVALID_LEVEL;
1874 }
1875
1876 return status;
1877 }
1878
1879 #if 0 /* AD DC work in ongoing in Samba 4 */
1880
1881 /***************************************************************************
1882 ***************************************************************************/
1883
1884 NTSTATUS _lsa_query_info2(pipes_struct *p, LSA_Q_QUERY_INFO2 *q_u, LSA_R_QUERY_INFO2 *r_u)
1885 {
1886 struct lsa_info *handle;
1887 const char *nb_name;
1888 char *dns_name = NULL;
1889 char *forest_name = NULL;
1890 DOM_SID *sid = NULL;
1891 struct GUID guid;
1892 fstring dnsdomname;
1893
1894 ZERO_STRUCT(guid);
1895 r_u->status = NT_STATUS_OK;
1896
1897 if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&handle))
1898 return NT_STATUS_INVALID_HANDLE;
1899
1900 switch (q_u->info_class) {
1901 case 0x0c:
1902 /* check if the user has enough rights */
1903 if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
1904 return NT_STATUS_ACCESS_DENIED;
1905
1906 /* Request PolicyPrimaryDomainInformation. */
1907 switch (lp_server_role()) {
1908 case ROLE_DOMAIN_PDC:
1909 case ROLE_DOMAIN_BDC:
1910 nb_name = get_global_sam_name();
1911 /* ugly temp hack for these next two */
1912
1913 /* This should be a 'netbios domain -> DNS domain' mapping */
1914 dnsdomname = get_mydnsdomname(p->mem_ctx);
1915 if (!dnsdomname || !*dnsdomname) {
1916 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1917 }
1918 strlower_m(dnsdomname);
1919
1920 dns_name = dnsdomname;
1921 forest_name = dnsdomname;
1922
1923 sid = get_global_sam_sid();
1924 secrets_fetch_domain_guid(lp_workgroup(), &guid);
1925 break;
1926 default:
1927 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1928 }
1929 init_dns_dom_info(&r_u->info.dns_dom_info, nb_name, dns_name,
1930 forest_name,&guid,sid);
1931 break;
1932 default:
1933 DEBUG(0,("_lsa_query_info2: unknown info level in Lsa Query: %d\n", q_u->info_class));
1934 r_u->status = NT_STATUS_INVALID_INFO_CLASS;
1935 break;
1936 }
1937
1938 if (NT_STATUS_IS_OK(r_u->status)) {
1939 r_u->ptr = 0x1;
1940 r_u->info_class = q_u->info_class;
1941 }
1942
1943 return r_u->status;
1944 }
1945 #endif /* AD DC work in ongoing in Samba 4 */
1946
1947 /***************************************************************************
1948 _lsa_AddAccountRights
1949 ***************************************************************************/
1950
1951 NTSTATUS _lsa_AddAccountRights(pipes_struct *p,
1952 struct lsa_AddAccountRights *r)
1953 {
1954 struct lsa_info *info = NULL;
1955 int i = 0;
1956 DOM_SID sid;
1957
1958 /* find the connection policy handle. */
1959 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
1960 return NT_STATUS_INVALID_HANDLE;
1961
1962 /* check to see if the pipe_user is a Domain Admin since
1963 account_pol.tdb was already opened as root, this is all we have */
1964
1965 if ( p->pipe_user.ut.uid != sec_initial_uid()
1966 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1967 {
1968 return NT_STATUS_ACCESS_DENIED;
1969 }
1970
1971 /* according to an NT4 PDC, you can add privileges to SIDs even without
1972 call_lsa_create_account() first. And you can use any arbitrary SID. */
1973
1974 sid_copy( &sid, r->in.sid );
1975
1976 for ( i=0; i < r->in.rights->count; i++ ) {
1977
1978 const char *privname = r->in.rights->names[i].string;
1979
1980 /* only try to add non-null strings */
1981
1982 if ( !privname )
1983 continue;
1984
1985 if ( !grant_privilege_by_name( &sid, privname ) ) {
1986 DEBUG(2,("_lsa_AddAccountRights: Failed to add privilege [%s]\n",
1987 privname ));
1988 return NT_STATUS_NO_SUCH_PRIVILEGE;
1989 }
1990 }
1991
1992 return NT_STATUS_OK;
1993 }
1994
1995 /***************************************************************************
1996 _lsa_RemoveAccountRights
1997 ***************************************************************************/
1998
1999 NTSTATUS _lsa_RemoveAccountRights(pipes_struct *p,
2000 struct lsa_RemoveAccountRights *r)
2001 {
2002 struct lsa_info *info = NULL;
2003 int i = 0;
2004 DOM_SID sid;
2005 const char *privname = NULL;
2006
2007 /* find the connection policy handle. */
2008 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2009 return NT_STATUS_INVALID_HANDLE;
2010
2011 /* check to see if the pipe_user is a Domain Admin since
2012 account_pol.tdb was already opened as root, this is all we have */
2013
2014 if ( p->pipe_user.ut.uid != sec_initial_uid()
2015 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
2016 {
2017 return NT_STATUS_ACCESS_DENIED;
2018 }
2019
2020 sid_copy( &sid, r->in.sid );
2021
2022 if ( r->in.remove_all ) {
2023 if ( !revoke_all_privileges( &sid ) )
2024 return NT_STATUS_ACCESS_DENIED;
2025
2026 return NT_STATUS_OK;
2027 }
2028
2029 for ( i=0; i < r->in.rights->count; i++ ) {
2030
2031 privname = r->in.rights->names[i].string;
2032
2033 /* only try to add non-null strings */
2034
2035 if ( !privname )
2036 continue;
2037
2038 if ( !revoke_privilege_by_name( &sid, privname ) ) {
2039 DEBUG(2,("_lsa_RemoveAccountRights: Failed to revoke privilege [%s]\n",
2040 privname ));
2041 return NT_STATUS_NO_SUCH_PRIVILEGE;
2042 }
2043 }
2044
2045 return NT_STATUS_OK;
2046 }
2047
2048 /*******************************************************************
2049 ********************************************************************/
2050
2051 static NTSTATUS init_lsa_right_set(TALLOC_CTX *mem_ctx,
2052 struct lsa_RightSet *r,
2053 PRIVILEGE_SET *privileges)
2054 {
2055 uint32 i;
2056 const char *privname;
2057 const char **privname_array = NULL;
2058 int num_priv = 0;
2059
2060 for (i=0; i<privileges->count; i++) {
2061
2062 privname = luid_to_privilege_name(&privileges->set[i].luid);
2063 if (privname) {
2064 if (!add_string_to_array(mem_ctx, privname,
2065 &privname_array, &num_priv)) {
2066 return NT_STATUS_NO_MEMORY;
2067 }
2068 }
2069 }
2070
2071 if (num_priv) {
2072
2073 r->names = TALLOC_ZERO_ARRAY(mem_ctx, struct lsa_StringLarge,
2074 num_priv);
2075 if (!r->names) {
2076 return NT_STATUS_NO_MEMORY;
2077 }
2078
2079 for (i=0; i<num_priv; i++) {
2080 init_lsa_StringLarge(&r->names[i], privname_array[i]);
2081 }
2082
2083 r->count = num_priv;
2084 }
2085
2086 return NT_STATUS_OK;
2087 }
2088
2089 /***************************************************************************
2090 _lsa_EnumAccountRights
2091 ***************************************************************************/
2092
2093 NTSTATUS _lsa_EnumAccountRights(pipes_struct *p,
2094 struct lsa_EnumAccountRights *r)
2095 {
2096 NTSTATUS status;
2097 struct lsa_info *info = NULL;
2098 DOM_SID sid;
2099 PRIVILEGE_SET privileges;
2100 SE_PRIV mask;
2101
2102 /* find the connection policy handle. */
2103
2104 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2105 return NT_STATUS_INVALID_HANDLE;
2106
2107 if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
2108 return NT_STATUS_ACCESS_DENIED;
2109
2110 /* according to an NT4 PDC, you can add privileges to SIDs even without
2111 call_lsa_create_account() first. And you can use any arbitrary SID. */
2112
2113 sid_copy( &sid, r->in.sid );
2114
2115 if ( !get_privileges_for_sids( &mask, &sid, 1 ) )
2116 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2117
2118 privilege_set_init( &privileges );
2119
2120 if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
2121
2122 DEBUG(10,("_lsa_EnumAccountRights: %s has %d privileges\n",
2123 sid_string_dbg(&sid), privileges.count));
2124
2125 status = init_lsa_right_set(p->mem_ctx, r->out.rights, &privileges);
2126 } else {
2127 status = NT_STATUS_NO_SUCH_PRIVILEGE;
2128 }
2129
2130 privilege_set_free( &privileges );
2131
2132 return status;
2133 }
2134
2135 /***************************************************************************
2136 _lsa_LookupPrivValue
2137 ***************************************************************************/
2138
2139 NTSTATUS _lsa_LookupPrivValue(pipes_struct *p,
2140 struct lsa_LookupPrivValue *r)
2141 {
2142 struct lsa_info *info = NULL;
2143 const char *name = NULL;
2144 LUID_ATTR priv_luid;
2145 SE_PRIV mask;
2146
2147 /* find the connection policy handle. */
2148
2149 if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
2150 return NT_STATUS_INVALID_HANDLE;
2151
2152 if (!(info->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
2153 return NT_STATUS_ACCESS_DENIED;
2154
2155 name = r->in.name->string;
2156
2157 DEBUG(10,("_lsa_lookup_priv_value: name = %s\n", name));
2158
2159 if ( !se_priv_from_name( name, &mask ) )
2160 return NT_STATUS_NO_SUCH_PRIVILEGE;
2161
2162 priv_luid = get_privilege_luid( &mask );
2163
2164 r->out.luid->low = priv_luid.luid.low;
2165 r->out.luid->high = priv_luid.luid.high;
2166
2167 return NT_STATUS_OK;
2168 }
2169
2170 /*
2171 * From here on the server routines are just dummy ones to make smbd link with
2172 * librpc/gen_ndr/srv_lsa.c. These routines are actually never called, we are
2173 * pulling the server stubs across one by one.
2174 */
2175
2176 NTSTATUS _lsa_Delete(pipes_struct *p, struct lsa_Delete *r)
2177 {
2178 p->rng_fault_state = True;
2179 return NT_STATUS_NOT_IMPLEMENTED;
2180 }
2181
2182 NTSTATUS _lsa_SetSecObj(pipes_struct *p, struct lsa_SetSecObj *r)
2183 {
2184 p->rng_fault_state = True;
2185 return NT_STATUS_NOT_IMPLEMENTED;
2186 }
2187
2188 NTSTATUS _lsa_ChangePassword(pipes_struct *p, struct lsa_ChangePassword *r)
2189 {
2190 p->rng_fault_state = True;
2191 return NT_STATUS_NOT_IMPLEMENTED;
2192 }
2193
2194 NTSTATUS _lsa_SetInfoPolicy(pipes_struct *p, struct lsa_SetInfoPolicy *r)
2195 {
2196 p->rng_fault_state = True;
2197 return NT_STATUS_NOT_IMPLEMENTED;
2198 }
2199
2200 NTSTATUS _lsa_ClearAuditLog(pipes_struct *p, struct lsa_ClearAuditLog *r)
2201 {
2202 p->rng_fault_state = True;
2203 return NT_STATUS_NOT_IMPLEMENTED;
2204 }
2205
2206 NTSTATUS _lsa_GetQuotasForAccount(pipes_struct *p, struct lsa_GetQuotasForAccount *r)
2207 {
2208 p->rng_fault_state = True;
2209 return NT_STATUS_NOT_IMPLEMENTED;
2210 }
2211
2212 NTSTATUS _lsa_SetQuotasForAccount(pipes_struct *p, struct lsa_SetQuotasForAccount *r)
2213 {
2214 p->rng_fault_state = True;
2215 return NT_STATUS_NOT_IMPLEMENTED;
2216 }
2217
2218 NTSTATUS _lsa_QueryTrustedDomainInfo(pipes_struct *p, struct lsa_QueryTrustedDomainInfo *r)
2219 {
2220 p->rng_fault_state = True;
2221 return NT_STATUS_NOT_IMPLEMENTED;
2222 }
2223
2224 NTSTATUS _lsa_SetInformationTrustedDomain(pipes_struct *p, struct lsa_SetInformationTrustedDomain *r)
2225 {
2226 p->rng_fault_state = True;
2227 return NT_STATUS_NOT_IMPLEMENTED;
2228 }
2229
2230 NTSTATUS _lsa_QuerySecret(pipes_struct *p, struct lsa_QuerySecret *r)
2231 {
2232 p->rng_fault_state = True;
2233 return NT_STATUS_NOT_IMPLEMENTED;
2234 }
2235
2236 NTSTATUS _lsa_LookupPrivName(pipes_struct *p, struct lsa_LookupPrivName *r)
2237 {
2238 p->rng_fault_state = True;
2239 return NT_STATUS_NOT_IMPLEMENTED;
2240 }
2241
2242 NTSTATUS _lsa_EnumAccountsWithUserRight(pipes_struct *p, struct lsa_EnumAccountsWithUserRight *r)
2243 {
2244 p->rng_fault_state = True;
2245 return NT_STATUS_NOT_IMPLEMENTED;
2246 }
2247
2248 NTSTATUS _lsa_QueryTrustedDomainInfoBySid(pipes_struct *p, struct lsa_QueryTrustedDomainInfoBySid *r)
2249 {
2250 p->rng_fault_state = True;
2251 return NT_STATUS_NOT_IMPLEMENTED;
2252 }
2253
2254 NTSTATUS _lsa_SetTrustedDomainInfo(pipes_struct *p, struct lsa_SetTrustedDomainInfo *r)
2255 {
2256 p->rng_fault_state = True;
2257 return NT_STATUS_NOT_IMPLEMENTED;
2258 }
2259
2260 NTSTATUS _lsa_DeleteTrustedDomain(pipes_struct *p, struct lsa_DeleteTrustedDomain *r)
2261 {
2262 p->rng_fault_state = True;
2263 return NT_STATUS_NOT_IMPLEMENTED;
2264 }
2265
2266 NTSTATUS _lsa_StorePrivateData(pipes_struct *p, struct lsa_StorePrivateData *r)
2267 {
2268 p->rng_fault_state = True;
2269 return NT_STATUS_NOT_IMPLEMENTED;
2270 }
2271
2272 NTSTATUS _lsa_RetrievePrivateData(pipes_struct *p, struct lsa_RetrievePrivateData *r)
2273 {
2274 p->rng_fault_state = True;
2275 return NT_STATUS_NOT_IMPLEMENTED;
2276 }
2277
2278 NTSTATUS _lsa_QueryInfoPolicy2(pipes_struct *p, struct lsa_QueryInfoPolicy2 *r)
2279 {
2280 p->rng_fault_state = True;
2281 return NT_STATUS_NOT_IMPLEMENTED;
2282 }
2283
2284 NTSTATUS _lsa_SetInfoPolicy2(pipes_struct *p, struct lsa_SetInfoPolicy2 *r)
2285 {
2286 p->rng_fault_state = True;
2287 return NT_STATUS_NOT_IMPLEMENTED;
2288 }
2289
2290 NTSTATUS _lsa_QueryTrustedDomainInfoByName(pipes_struct *p, struct lsa_QueryTrustedDomainInfoByName *r)
2291 {
2292 p->rng_fault_state = True;
2293 return NT_STATUS_NOT_IMPLEMENTED;
2294 }
2295
2296 NTSTATUS _lsa_SetTrustedDomainInfoByName(pipes_struct *p, struct lsa_SetTrustedDomainInfoByName *r)
2297 {
2298 p->rng_fault_state = True;
2299 return NT_STATUS_NOT_IMPLEMENTED;
2300 }
2301
2302 NTSTATUS _lsa_EnumTrustedDomainsEx(pipes_struct *p, struct lsa_EnumTrustedDomainsEx *r)
2303 {
2304 p->rng_fault_state = True;
2305 return NT_STATUS_NOT_IMPLEMENTED;
2306 }
2307
2308 NTSTATUS _lsa_CreateTrustedDomainEx(pipes_struct *p, struct lsa_CreateTrustedDomainEx *r)
2309 {
2310 p->rng_fault_state = True;
2311 return NT_STATUS_NOT_IMPLEMENTED;
2312 }
2313
2314 NTSTATUS _lsa_CloseTrustedDomainEx(pipes_struct *p, struct lsa_CloseTrustedDomainEx *r)
2315 {
2316 p->rng_fault_state = True;
2317 return NT_STATUS_NOT_IMPLEMENTED;
2318 }
2319
2320 NTSTATUS _lsa_QueryDomainInformationPolicy(pipes_struct *p, struct lsa_QueryDomainInformationPolicy *r)
2321 {
2322 p->rng_fault_state = True;
2323 return NT_STATUS_NOT_IMPLEMENTED;
2324 }
2325
2326 NTSTATUS _lsa_SetDomainInformationPolicy(pipes_struct *p, struct lsa_SetDomainInformationPolicy *r)
2327 {
2328 p->rng_fault_state = True;
2329 return NT_STATUS_NOT_IMPLEMENTED;
2330 }
2331
2332 NTSTATUS _lsa_OpenTrustedDomainByName(pipes_struct *p, struct lsa_OpenTrustedDomainByName *r)
2333 {
2334 p->rng_fault_state = True;
2335 return NT_STATUS_NOT_IMPLEMENTED;
2336 }
2337
2338 NTSTATUS _lsa_TestCall(pipes_struct *p, struct lsa_TestCall *r)
2339 {
2340 p->rng_fault_state = True;
2341 return NT_STATUS_NOT_IMPLEMENTED;
2342 }
2343
2344 NTSTATUS _lsa_CreateTrustedDomainEx2(pipes_struct *p, struct lsa_CreateTrustedDomainEx2 *r)
2345 {
2346 p->rng_fault_state = True;
2347 return NT_STATUS_NOT_IMPLEMENTED;
2348 }
2349
2350 NTSTATUS _lsa_CREDRWRITE(pipes_struct *p, struct lsa_CREDRWRITE *r)
2351 {
2352 p->rng_fault_state = True;
2353 return NT_STATUS_NOT_IMPLEMENTED;
2354 }
2355
2356 NTSTATUS _lsa_CREDRREAD(pipes_struct *p, struct lsa_CREDRREAD *r)
2357 {
2358 p->rng_fault_state = True;
2359 return NT_STATUS_NOT_IMPLEMENTED;
2360 }
2361
2362 NTSTATUS _lsa_CREDRENUMERATE(pipes_struct *p, struct lsa_CREDRENUMERATE *r)
2363 {
2364 p->rng_fault_state = True;
2365 return NT_STATUS_NOT_IMPLEMENTED;
2366 }
2367
2368 NTSTATUS _lsa_CREDRWRITEDOMAINCREDENTIALS(pipes_struct *p, struct lsa_CREDRWRITEDOMAINCREDENTIALS *r)
2369 {
2370 p->rng_fault_state = True;
2371 return NT_STATUS_NOT_IMPLEMENTED;
2372 }
2373
2374 NTSTATUS _lsa_CREDRREADDOMAINCREDENTIALS(pipes_struct *p, struct lsa_CREDRREADDOMAINCREDENTIALS *r)
2375 {
2376 p->rng_fault_state = True;
2377 return NT_STATUS_NOT_IMPLEMENTED;
2378 }
2379
2380 NTSTATUS _lsa_CREDRDELETE(pipes_struct *p, struct lsa_CREDRDELETE *r)
2381 {
2382 p->rng_fault_state = True;
2383 return NT_STATUS_NOT_IMPLEMENTED;
2384 }
2385
2386 NTSTATUS _lsa_CREDRGETTARGETINFO(pipes_struct *p, struct lsa_CREDRGETTARGETINFO *r)
2387 {
2388 p->rng_fault_state = True;
2389 return NT_STATUS_NOT_IMPLEMENTED;
2390 }
2391
2392 NTSTATUS _lsa_CREDRPROFILELOADED(pipes_struct *p, struct lsa_CREDRPROFILELOADED *r)
2393 {
2394 p->rng_fault_state = True;
2395 return NT_STATUS_NOT_IMPLEMENTED;
2396 }
2397
2398 NTSTATUS _lsa_CREDRGETSESSIONTYPES(pipes_struct *p, struct lsa_CREDRGETSESSIONTYPES *r)
2399 {
2400 p->rng_fault_state = True;
2401 return NT_STATUS_NOT_IMPLEMENTED;
2402 }
2403
2404 NTSTATUS _lsa_LSARREGISTERAUDITEVENT(pipes_struct *p, struct lsa_LSARREGISTERAUDITEVENT *r)
2405 {
2406 p->rng_fault_state = True;
2407 return NT_STATUS_NOT_IMPLEMENTED;
2408 }
2409
2410 NTSTATUS _lsa_LSARGENAUDITEVENT(pipes_struct *p, struct lsa_LSARGENAUDITEVENT *r)
2411 {
2412 p->rng_fault_state = True;
2413 return NT_STATUS_NOT_IMPLEMENTED;
2414 }
2415
2416 NTSTATUS _lsa_LSARUNREGISTERAUDITEVENT(pipes_struct *p, struct lsa_LSARUNREGISTERAUDITEVENT *r)
2417 {
2418 p->rng_fault_state = True;
2419 return NT_STATUS_NOT_IMPLEMENTED;
2420 }
2421
2422 NTSTATUS _lsa_lsaRQueryForestTrustInformation(pipes_struct *p, struct lsa_lsaRQueryForestTrustInformation *r)
2423 {
2424 p->rng_fault_state = True;
2425 return NT_STATUS_NOT_IMPLEMENTED;
2426 }
2427
2428 NTSTATUS _lsa_LSARSETFORESTTRUSTINFORMATION(pipes_struct *p, struct lsa_LSARSETFORESTTRUSTINFORMATION *r)
2429 {
2430 p->rng_fault_state = True;
2431 return NT_STATUS_NOT_IMPLEMENTED;
2432 }
2433
2434 NTSTATUS _lsa_CREDRRENAME(pipes_struct *p, struct lsa_CREDRRENAME *r)
2435 {
2436 p->rng_fault_state = True;
2437 return NT_STATUS_NOT_IMPLEMENTED;
2438 }
2439
2440 NTSTATUS _lsa_LSAROPENPOLICYSCE(pipes_struct *p, struct lsa_LSAROPENPOLICYSCE *r)
2441 {
2442 p->rng_fault_state = True;
2443 return NT_STATUS_NOT_IMPLEMENTED;
2444 }
2445
2446 NTSTATUS _lsa_LSARADTREGISTERSECURITYEVENTSOURCE(pipes_struct *p, struct lsa_LSARADTREGISTERSECURITYEVENTSOURCE *r)
2447 {
2448 p->rng_fault_state = True;
2449 return NT_STATUS_NOT_IMPLEMENTED;
2450 }
2451
2452 NTSTATUS _lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE(pipes_struct *p, struct lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE *r)
2453 {
2454 p->rng_fault_state = True;
2455 return NT_STATUS_NOT_IMPLEMENTED;
2456 }
2457
2458 NTSTATUS _lsa_LSARADTREPORTSECURITYEVENT(pipes_struct *p, struct lsa_LSARADTREPORTSECURITYEVENT *r)
2459 {
2460 p->rng_fault_state = True;
2461 return NT_STATUS_NOT_IMPLEMENTED;
2462 }