2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Jeremy Allison 2001, 2006.
8 * Copyright (C) Rafal Szczesniak 2002,
9 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
10 * Copyright (C) Simo Sorce 2003.
11 * Copyright (C) Gerald (Jerry) Carter 2005.
12 * Copyright (C) Volker Lendecke 2005.
13 * Copyright (C) Guenther Deschner 2008.
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 3 of the License, or
18 * (at your option) any later version.
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
23 * GNU General Public License for more details.
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, see <http://www.gnu.org/licenses/>.
29 /* This is the implementation of the lsa server code. */
34 #define DBGC_CLASS DBGC_RPC_SRV
43 const struct generic_mapping lsa_generic_mapping
= {
50 /***************************************************************************
51 init_lsa_ref_domain_list - adds a domain if it's not already in, returns the index.
52 ***************************************************************************/
54 static int init_lsa_ref_domain_list(TALLOC_CTX
*mem_ctx
,
55 struct lsa_RefDomainList
*ref
,
61 if (dom_name
!= NULL
) {
62 for (num
= 0; num
< ref
->count
; num
++) {
63 if (sid_equal(dom_sid
, ref
->domains
[num
].sid
)) {
71 if (num
>= MAX_REF_DOMAINS
) {
72 /* index not found, already at maximum domain limit */
77 ref
->max_size
= MAX_REF_DOMAINS
;
79 ref
->domains
= TALLOC_REALLOC_ARRAY(mem_ctx
, ref
->domains
,
80 struct lsa_DomainInfo
, ref
->count
);
85 ZERO_STRUCT(ref
->domains
[num
]);
87 init_lsa_StringLarge(&ref
->domains
[num
].name
, dom_name
);
88 ref
->domains
[num
].sid
= sid_dup_talloc(mem_ctx
, dom_sid
);
89 if (!ref
->domains
[num
].sid
) {
97 /*******************************************************************
98 Function to free the per handle data.
99 ********************************************************************/
101 static void free_lsa_info(void *ptr
)
103 struct lsa_info
*lsa
= (struct lsa_info
*)ptr
;
108 /***************************************************************************
109 initialize a lsa_DomainInfo structure.
110 ***************************************************************************/
112 static void init_dom_query_3(struct lsa_DomainInfo
*r
,
116 init_lsa_StringLarge(&r
->name
, name
);
120 /***************************************************************************
121 initialize a lsa_DomainInfo structure.
122 ***************************************************************************/
124 static void init_dom_query_5(struct lsa_DomainInfo
*r
,
128 init_lsa_StringLarge(&r
->name
, name
);
132 /***************************************************************************
133 lookup_lsa_rids. Must be called as root for lookup_name to work.
134 ***************************************************************************/
136 static NTSTATUS
lookup_lsa_rids(TALLOC_CTX
*mem_ctx
,
137 struct lsa_RefDomainList
*ref
,
138 struct lsa_TranslatedSid
*prid
,
139 uint32_t num_entries
,
140 struct lsa_String
*name
,
142 uint32_t *pmapped_count
)
144 uint32 mapped_count
, i
;
146 SMB_ASSERT(num_entries
<= MAX_LOOKUP_SIDS
);
151 for (i
= 0; i
< num_entries
; i
++) {
155 const char *full_name
;
157 enum lsa_SidType type
= SID_NAME_UNKNOWN
;
159 /* Split name into domain and user component */
161 full_name
= name
[i
].string
;
162 if (full_name
== NULL
) {
163 return NT_STATUS_NO_MEMORY
;
166 DEBUG(5, ("lookup_lsa_rids: looking up name %s\n", full_name
));
168 /* We can ignore the result of lookup_name, it will not touch
169 "type" if it's not successful */
171 lookup_name(mem_ctx
, full_name
, flags
, &domain
, NULL
,
176 case SID_NAME_DOM_GRP
:
177 case SID_NAME_DOMAIN
:
179 case SID_NAME_WKN_GRP
:
180 DEBUG(5, ("init_lsa_rids: %s found\n", full_name
));
181 /* Leave these unchanged */
184 /* Don't hand out anything but the list above */
185 DEBUG(5, ("init_lsa_rids: %s not found\n", full_name
));
186 type
= SID_NAME_UNKNOWN
;
193 if (type
!= SID_NAME_UNKNOWN
) {
194 sid_split_rid(&sid
, &rid
);
195 dom_idx
= init_lsa_ref_domain_list(mem_ctx
, ref
, domain
, &sid
);
199 init_lsa_translated_sid(&prid
[i
], type
, rid
, dom_idx
);
202 *pmapped_count
= mapped_count
;
206 /***************************************************************************
207 lookup_lsa_sids. Must be called as root for lookup_name to work.
208 ***************************************************************************/
210 static NTSTATUS
lookup_lsa_sids(TALLOC_CTX
*mem_ctx
,
211 struct lsa_RefDomainList
*ref
,
212 struct lsa_TranslatedSid3
*trans_sids
,
213 uint32_t num_entries
,
214 struct lsa_String
*name
,
216 uint32
*pmapped_count
)
218 uint32 mapped_count
, i
;
220 SMB_ASSERT(num_entries
<= MAX_LOOKUP_SIDS
);
225 for (i
= 0; i
< num_entries
; i
++) {
229 const char *full_name
;
231 enum lsa_SidType type
= SID_NAME_UNKNOWN
;
235 /* Split name into domain and user component */
237 full_name
= name
[i
].string
;
238 if (full_name
== NULL
) {
239 return NT_STATUS_NO_MEMORY
;
242 DEBUG(5, ("init_lsa_sids: looking up name %s\n", full_name
));
244 /* We can ignore the result of lookup_name, it will not touch
245 "type" if it's not successful */
247 lookup_name(mem_ctx
, full_name
, flags
, &domain
, NULL
,
252 case SID_NAME_DOM_GRP
:
253 case SID_NAME_DOMAIN
:
255 case SID_NAME_WKN_GRP
:
256 DEBUG(5, ("init_lsa_sids: %s found\n", full_name
));
257 /* Leave these unchanged */
260 /* Don't hand out anything but the list above */
261 DEBUG(5, ("init_lsa_sids: %s not found\n", full_name
));
262 type
= SID_NAME_UNKNOWN
;
269 if (type
!= SID_NAME_UNKNOWN
) {
271 sid_copy(&domain_sid
, &sid
);
272 sid_split_rid(&domain_sid
, &rid
);
273 dom_idx
= init_lsa_ref_domain_list(mem_ctx
, ref
, domain
, &domain_sid
);
277 /* Initialize the lsa_TranslatedSid3 return. */
278 trans_sids
[i
].sid_type
= type
;
279 trans_sids
[i
].sid
= sid_dup_talloc(mem_ctx
, &sid
);
280 trans_sids
[i
].sid_index
= dom_idx
;
283 *pmapped_count
= mapped_count
;
287 static NTSTATUS
lsa_get_generic_sd(TALLOC_CTX
*mem_ctx
, SEC_DESC
**sd
, size_t *sd_size
)
289 DOM_SID local_adm_sid
;
296 init_sec_ace(&ace
[0], &global_sid_World
, SEC_ACE_TYPE_ACCESS_ALLOWED
, LSA_POLICY_EXECUTE
, 0);
298 sid_copy(&adm_sid
, get_global_sam_sid());
299 sid_append_rid(&adm_sid
, DOMAIN_GROUP_RID_ADMINS
);
300 init_sec_ace(&ace
[1], &adm_sid
, SEC_ACE_TYPE_ACCESS_ALLOWED
, LSA_POLICY_ALL_ACCESS
, 0);
302 sid_copy(&local_adm_sid
, &global_sid_Builtin
);
303 sid_append_rid(&local_adm_sid
, BUILTIN_ALIAS_RID_ADMINS
);
304 init_sec_ace(&ace
[2], &local_adm_sid
, SEC_ACE_TYPE_ACCESS_ALLOWED
, LSA_POLICY_ALL_ACCESS
, 0);
306 if((psa
= make_sec_acl(mem_ctx
, NT4_ACL_REVISION
, 3, ace
)) == NULL
)
307 return NT_STATUS_NO_MEMORY
;
309 if((*sd
= make_sec_desc(mem_ctx
, SECURITY_DESCRIPTOR_REVISION_1
,
310 SEC_DESC_SELF_RELATIVE
, &adm_sid
, NULL
, NULL
,
311 psa
, sd_size
)) == NULL
)
312 return NT_STATUS_NO_MEMORY
;
317 #if 0 /* AD DC work in ongoing in Samba 4 */
319 /***************************************************************************
321 ***************************************************************************/
323 static void init_dns_dom_info(LSA_DNS_DOM_INFO
*r_l
, const char *nb_name
,
324 const char *dns_name
, const char *forest_name
,
325 struct GUID
*dom_guid
, DOM_SID
*dom_sid
)
327 if (nb_name
&& *nb_name
) {
328 init_unistr2(&r_l
->uni_nb_dom_name
, nb_name
, UNI_FLAGS_NONE
);
329 init_uni_hdr(&r_l
->hdr_nb_dom_name
, &r_l
->uni_nb_dom_name
);
330 r_l
->hdr_nb_dom_name
.uni_max_len
+= 2;
331 r_l
->uni_nb_dom_name
.uni_max_len
+= 1;
334 if (dns_name
&& *dns_name
) {
335 init_unistr2(&r_l
->uni_dns_dom_name
, dns_name
, UNI_FLAGS_NONE
);
336 init_uni_hdr(&r_l
->hdr_dns_dom_name
, &r_l
->uni_dns_dom_name
);
337 r_l
->hdr_dns_dom_name
.uni_max_len
+= 2;
338 r_l
->uni_dns_dom_name
.uni_max_len
+= 1;
341 if (forest_name
&& *forest_name
) {
342 init_unistr2(&r_l
->uni_forest_name
, forest_name
, UNI_FLAGS_NONE
);
343 init_uni_hdr(&r_l
->hdr_forest_name
, &r_l
->uni_forest_name
);
344 r_l
->hdr_forest_name
.uni_max_len
+= 2;
345 r_l
->uni_forest_name
.uni_max_len
+= 1;
348 /* how do we init the guid ? probably should write an init fn */
350 memcpy(&r_l
->dom_guid
, dom_guid
, sizeof(struct GUID
));
354 r_l
->ptr_dom_sid
= 1;
355 init_dom_sid2(&r_l
->dom_sid
, dom_sid
);
358 #endif /* AD DC work in ongoing in Samba 4 */
361 /***************************************************************************
363 ***************************************************************************/
365 NTSTATUS
_lsa_OpenPolicy2(pipes_struct
*p
,
366 struct lsa_OpenPolicy2
*r
)
368 struct lsa_info
*info
;
369 SEC_DESC
*psd
= NULL
;
371 uint32 des_access
= r
->in
.access_mask
;
376 /* map the generic bits to the lsa policy ones */
377 se_map_generic(&des_access
, &lsa_generic_mapping
);
379 /* get the generic lsa policy SD until we store it */
380 lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
382 if(!se_access_check(psd
, p
->pipe_user
.nt_user_token
, des_access
, &acc_granted
, &status
)) {
383 if (p
->pipe_user
.ut
.uid
!= sec_initial_uid()) {
386 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
387 acc_granted
, des_access
));
388 DEBUGADD(4,("but overwritten by euid == 0\n"));
391 /* This is needed for lsa_open_account and rpcclient .... :-) */
393 if (p
->pipe_user
.ut
.uid
== sec_initial_uid())
394 acc_granted
= LSA_POLICY_ALL_ACCESS
;
396 /* associate the domain SID with the (unique) handle. */
397 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
398 return NT_STATUS_NO_MEMORY
;
401 sid_copy(&info
->sid
,get_global_sam_sid());
402 info
->access
= acc_granted
;
404 /* set up the LSA QUERY INFO response */
405 if (!create_policy_hnd(p
, r
->out
.handle
, free_lsa_info
, (void *)info
))
406 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
411 /***************************************************************************
413 ***************************************************************************/
415 NTSTATUS
_lsa_OpenPolicy(pipes_struct
*p
,
416 struct lsa_OpenPolicy
*r
)
418 struct lsa_info
*info
;
419 SEC_DESC
*psd
= NULL
;
421 uint32 des_access
= r
->in
.access_mask
;
426 /* map the generic bits to the lsa policy ones */
427 se_map_generic(&des_access
, &lsa_generic_mapping
);
429 /* get the generic lsa policy SD until we store it */
430 lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
432 if(!se_access_check(psd
, p
->pipe_user
.nt_user_token
, des_access
, &acc_granted
, &status
)) {
433 if (geteuid() != 0) {
436 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
437 acc_granted
, des_access
));
438 DEBUGADD(4,("but overwritten by euid == 0\n"));
439 acc_granted
= des_access
;
442 /* associate the domain SID with the (unique) handle. */
443 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
444 return NT_STATUS_NO_MEMORY
;
447 sid_copy(&info
->sid
,get_global_sam_sid());
448 info
->access
= acc_granted
;
450 /* set up the LSA QUERY INFO response */
451 if (!create_policy_hnd(p
, r
->out
.handle
, free_lsa_info
, (void *)info
))
452 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
457 /***************************************************************************
458 _lsa_EnumTrustDom - this needs fixing to do more than return NULL ! JRA.
460 ***************************************************************************/
462 NTSTATUS
_lsa_EnumTrustDom(pipes_struct
*p
,
463 struct lsa_EnumTrustDom
*r
)
465 struct lsa_info
*info
;
467 struct trustdom_info
**domains
;
468 struct lsa_DomainInfo
*lsa_domains
= NULL
;
472 * preferred length is set to 5 as a "our" preferred length
473 * nt sets this parameter to 2
474 * update (20.08.2002): it's not preferred length, but preferred size!
475 * it needs further investigation how to optimally choose this value
477 uint32 max_num_domains
=
478 r
->in
.max_size
< 5 ? r
->in
.max_size
: 10;
483 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
484 return NT_STATUS_INVALID_HANDLE
;
486 /* check if the user has enough rights */
487 if (!(info
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
488 return NT_STATUS_ACCESS_DENIED
;
491 nt_status
= pdb_enum_trusteddoms(p
->mem_ctx
, &num_domains
, &domains
);
494 if (!NT_STATUS_IS_OK(nt_status
)) {
498 if (*r
->in
.resume_handle
< num_domains
) {
499 num_thistime
= MIN(num_domains
, max_num_domains
);
501 nt_status
= STATUS_MORE_ENTRIES
;
503 if (*r
->in
.resume_handle
+ num_thistime
> num_domains
) {
504 num_thistime
= num_domains
- *r
->in
.resume_handle
;
505 nt_status
= NT_STATUS_OK
;
508 next_idx
= *r
->in
.resume_handle
+ num_thistime
;
511 next_idx
= 0xffffffff;
512 nt_status
= NT_STATUS_NO_MORE_ENTRIES
;
515 /* set up the lsa_enum_trust_dom response */
517 lsa_domains
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, struct lsa_DomainInfo
,
520 return NT_STATUS_NO_MEMORY
;
523 for (i
=0; i
<num_thistime
; i
++) {
524 init_lsa_StringLarge(&lsa_domains
[i
].name
, domains
[i
]->name
);
525 lsa_domains
[i
].sid
= &domains
[i
]->sid
;
528 *r
->out
.resume_handle
= next_idx
;
529 r
->out
.domains
->count
= num_thistime
;
530 r
->out
.domains
->domains
= lsa_domains
;
535 #define LSA_AUDIT_NUM_CATEGORIES_NT4 7
536 #define LSA_AUDIT_NUM_CATEGORIES_WIN2K 9
537 #define LSA_AUDIT_NUM_CATEGORIES LSA_AUDIT_NUM_CATEGORIES_NT4
539 /***************************************************************************
541 ***************************************************************************/
543 NTSTATUS
_lsa_QueryInfoPolicy(pipes_struct
*p
,
544 struct lsa_QueryInfoPolicy
*r
)
546 NTSTATUS status
= NT_STATUS_OK
;
547 struct lsa_info
*handle
;
551 union lsa_PolicyInformation
*info
= NULL
;
553 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
554 return NT_STATUS_INVALID_HANDLE
;
556 info
= TALLOC_ZERO_P(p
->mem_ctx
, union lsa_PolicyInformation
);
558 return NT_STATUS_NO_MEMORY
;
561 switch (r
->in
.level
) {
565 uint32 policy_def
= LSA_AUDIT_POLICY_ALL
;
567 /* check if the user has enough rights */
568 if (!(handle
->access
& LSA_POLICY_VIEW_AUDIT_INFORMATION
)) {
569 DEBUG(10,("_lsa_QueryInfoPolicy: insufficient access rights\n"));
570 return NT_STATUS_ACCESS_DENIED
;
573 /* fake info: We audit everything. ;) */
575 info
->audit_events
.auditing_mode
= true;
576 info
->audit_events
.count
= LSA_AUDIT_NUM_CATEGORIES
;
577 info
->audit_events
.settings
= TALLOC_ZERO_ARRAY(p
->mem_ctx
,
578 enum lsa_PolicyAuditPolicy
,
579 info
->audit_events
.count
);
580 if (!info
->audit_events
.settings
) {
581 return NT_STATUS_NO_MEMORY
;
584 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_ACCOUNT_MANAGEMENT
] = policy_def
;
585 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_FILE_AND_OBJECT_ACCESS
] = policy_def
;
586 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_LOGON
] = policy_def
;
587 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_PROCCESS_TRACKING
] = policy_def
;
588 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_SECURITY_POLICY_CHANGES
] = policy_def
;
589 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_SYSTEM
] = policy_def
;
590 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_USE_OF_USER_RIGHTS
] = policy_def
;
595 /* check if the user has enough rights */
596 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
597 return NT_STATUS_ACCESS_DENIED
;
599 /* Request PolicyPrimaryDomainInformation. */
600 switch (lp_server_role()) {
601 case ROLE_DOMAIN_PDC
:
602 case ROLE_DOMAIN_BDC
:
603 name
= get_global_sam_name();
604 sid
= sid_dup_talloc(p
->mem_ctx
, get_global_sam_sid());
606 return NT_STATUS_NO_MEMORY
;
609 case ROLE_DOMAIN_MEMBER
:
610 name
= lp_workgroup();
611 /* We need to return the Domain SID here. */
612 if (secrets_fetch_domain_sid(lp_workgroup(), &domain_sid
)) {
613 sid
= sid_dup_talloc(p
->mem_ctx
, &domain_sid
);
615 return NT_STATUS_NO_MEMORY
;
618 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
621 case ROLE_STANDALONE
:
622 name
= lp_workgroup();
626 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
628 init_dom_query_3(&info
->domain
, name
, sid
);
631 /* check if the user has enough rights */
632 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
633 return NT_STATUS_ACCESS_DENIED
;
635 /* Request PolicyAccountDomainInformation. */
636 name
= get_global_sam_name();
637 sid
= get_global_sam_sid();
639 init_dom_query_5(&info
->account_domain
, name
, sid
);
642 /* check if the user has enough rights */
643 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
644 return NT_STATUS_ACCESS_DENIED
;
646 switch (lp_server_role()) {
647 case ROLE_DOMAIN_BDC
:
649 * only a BDC is a backup controller
650 * of the domain, it controls.
656 * any other role is a primary
657 * of the domain, it controls.
664 DEBUG(0,("_lsa_QueryInfoPolicy: unknown info level in Lsa Query: %d\n",
666 status
= NT_STATUS_INVALID_INFO_CLASS
;
675 /***************************************************************************
676 _lsa_lookup_sids_internal
677 ***************************************************************************/
679 static NTSTATUS
_lsa_lookup_sids_internal(pipes_struct
*p
,
681 uint16_t level
, /* input */
682 int num_sids
, /* input */
683 struct lsa_SidPtr
*sid
, /* input */
684 struct lsa_RefDomainList
**pp_ref
, /* input/output */
685 struct lsa_TranslatedName2
**pp_names
,/* input/output */
686 uint32_t *pp_mapped_count
) /* input/output */
690 const DOM_SID
**sids
= NULL
;
691 struct lsa_RefDomainList
*ref
= NULL
;
692 uint32 mapped_count
= 0;
693 struct lsa_dom_info
*dom_infos
= NULL
;
694 struct lsa_name_info
*name_infos
= NULL
;
695 struct lsa_TranslatedName2
*names
= NULL
;
697 *pp_mapped_count
= 0;
705 sids
= TALLOC_ARRAY(p
->mem_ctx
, const DOM_SID
*, num_sids
);
706 ref
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_RefDomainList
);
708 if (sids
== NULL
|| ref
== NULL
) {
709 return NT_STATUS_NO_MEMORY
;
712 for (i
=0; i
<num_sids
; i
++) {
713 sids
[i
] = sid
[i
].sid
;
716 status
= lookup_sids(p
->mem_ctx
, num_sids
, sids
, level
,
717 &dom_infos
, &name_infos
);
719 if (!NT_STATUS_IS_OK(status
)) {
723 names
= TALLOC_ARRAY(p
->mem_ctx
, struct lsa_TranslatedName2
, num_sids
);
725 return NT_STATUS_NO_MEMORY
;
728 for (i
=0; i
<MAX_REF_DOMAINS
; i
++) {
730 if (!dom_infos
[i
].valid
) {
734 if (init_lsa_ref_domain_list(mem_ctx
, ref
,
736 &dom_infos
[i
].sid
) != i
) {
737 DEBUG(0, ("Domain %s mentioned twice??\n",
739 return NT_STATUS_INTERNAL_ERROR
;
743 for (i
=0; i
<num_sids
; i
++) {
744 struct lsa_name_info
*name
= &name_infos
[i
];
746 if (name
->type
== SID_NAME_UNKNOWN
) {
749 /* Unknown sids should return the string
750 * representation of the SID. Windows 2003 behaves
751 * rather erratic here, in many cases it returns the
752 * RID as 8 bytes hex, in others it returns the full
753 * SID. We (Jerry/VL) could not figure out which the
754 * hard cases are, so leave it with the SID. */
755 name
->name
= talloc_asprintf(p
->mem_ctx
, "%s",
758 if (name
->name
== NULL
) {
759 return NT_STATUS_NO_MEMORY
;
765 init_lsa_translated_name2(&names
[i
], name
->type
,
766 name
->name
, name
->dom_idx
, 0);
769 status
= NT_STATUS_NONE_MAPPED
;
770 if (mapped_count
> 0) {
771 status
= (mapped_count
< num_sids
) ?
772 STATUS_SOME_UNMAPPED
: NT_STATUS_OK
;
775 DEBUG(10, ("num_sids %d, mapped_count %d, status %s\n",
776 num_sids
, mapped_count
, nt_errstr(status
)));
778 *pp_mapped_count
= mapped_count
;
785 /***************************************************************************
787 ***************************************************************************/
789 NTSTATUS
_lsa_LookupSids(pipes_struct
*p
,
790 struct lsa_LookupSids
*r
)
793 struct lsa_info
*handle
;
794 int num_sids
= r
->in
.sids
->num_sids
;
795 uint32 mapped_count
= 0;
796 struct lsa_RefDomainList
*domains
= NULL
;
797 struct lsa_TranslatedName
*names_out
= NULL
;
798 struct lsa_TranslatedName2
*names
= NULL
;
801 if ((r
->in
.level
< 1) || (r
->in
.level
> 6)) {
802 return NT_STATUS_INVALID_PARAMETER
;
805 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
)) {
806 return NT_STATUS_INVALID_HANDLE
;
809 /* check if the user has enough rights */
810 if (!(handle
->access
& LSA_POLICY_LOOKUP_NAMES
)) {
811 return NT_STATUS_ACCESS_DENIED
;
814 if (num_sids
> MAX_LOOKUP_SIDS
) {
815 DEBUG(5,("_lsa_LookupSids: limit of %d exceeded, requested %d\n",
816 MAX_LOOKUP_SIDS
, num_sids
));
817 return NT_STATUS_NONE_MAPPED
;
820 status
= _lsa_lookup_sids_internal(p
,
829 /* Convert from lsa_TranslatedName2 to lsa_TranslatedName */
830 names_out
= TALLOC_ARRAY(p
->mem_ctx
, struct lsa_TranslatedName
,
833 return NT_STATUS_NO_MEMORY
;
836 for (i
=0; i
<num_sids
; i
++) {
837 names_out
[i
].sid_type
= names
[i
].sid_type
;
838 names_out
[i
].name
= names
[i
].name
;
839 names_out
[i
].sid_index
= names
[i
].sid_index
;
842 *r
->out
.domains
= domains
;
843 r
->out
.names
->count
= num_sids
;
844 r
->out
.names
->names
= names_out
;
845 *r
->out
.count
= mapped_count
;
850 /***************************************************************************
852 ***************************************************************************/
854 NTSTATUS
_lsa_LookupSids2(pipes_struct
*p
,
855 struct lsa_LookupSids2
*r
)
858 struct lsa_info
*handle
;
859 int num_sids
= r
->in
.sids
->num_sids
;
860 uint32 mapped_count
= 0;
861 struct lsa_RefDomainList
*domains
= NULL
;
862 struct lsa_TranslatedName2
*names
= NULL
;
863 bool check_policy
= true;
865 switch (p
->hdr_req
.opnum
) {
866 case NDR_LSA_LOOKUPSIDS3
:
867 check_policy
= false;
869 case NDR_LSA_LOOKUPSIDS2
:
874 if ((r
->in
.level
< 1) || (r
->in
.level
> 6)) {
875 return NT_STATUS_INVALID_PARAMETER
;
879 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
)) {
880 return NT_STATUS_INVALID_HANDLE
;
883 /* check if the user has enough rights */
884 if (!(handle
->access
& LSA_POLICY_LOOKUP_NAMES
)) {
885 return NT_STATUS_ACCESS_DENIED
;
889 if (num_sids
> MAX_LOOKUP_SIDS
) {
890 DEBUG(5,("_lsa_LookupSids2: limit of %d exceeded, requested %d\n",
891 MAX_LOOKUP_SIDS
, num_sids
));
892 return NT_STATUS_NONE_MAPPED
;
895 status
= _lsa_lookup_sids_internal(p
,
904 *r
->out
.domains
= domains
;
905 r
->out
.names
->count
= num_sids
;
906 r
->out
.names
->names
= names
;
907 *r
->out
.count
= mapped_count
;
912 /***************************************************************************
914 ***************************************************************************/
916 NTSTATUS
_lsa_LookupSids3(pipes_struct
*p
,
917 struct lsa_LookupSids3
*r
)
919 struct lsa_LookupSids2 q
;
921 /* No policy handle on this call. Restrict to crypto connections. */
922 if (p
->auth
.auth_type
!= PIPE_AUTH_TYPE_SCHANNEL
) {
923 DEBUG(0,("_lsa_LookupSids3: client %s not using schannel for netlogon\n",
924 get_remote_machine_name() ));
925 return NT_STATUS_INVALID_PARAMETER
;
929 q
.in
.sids
= r
->in
.sids
;
930 q
.in
.level
= r
->in
.level
;
931 q
.in
.unknown1
= r
->in
.unknown1
;
932 q
.in
.unknown2
= r
->in
.unknown2
;
933 q
.in
.names
= r
->in
.names
;
934 q
.in
.count
= r
->in
.count
;
936 q
.out
.domains
= r
->out
.domains
;
937 q
.out
.names
= r
->out
.names
;
938 q
.out
.count
= r
->out
.count
;
940 return _lsa_LookupSids2(p
, &q
);
943 /***************************************************************************
944 ***************************************************************************/
946 static int lsa_lookup_level_to_flags(uint16 level
)
952 flags
= LOOKUP_NAME_ALL
;
955 flags
= LOOKUP_NAME_DOMAIN
|LOOKUP_NAME_REMOTE
|LOOKUP_NAME_ISOLATED
;
958 flags
= LOOKUP_NAME_DOMAIN
|LOOKUP_NAME_ISOLATED
;
964 flags
= LOOKUP_NAME_NONE
;
971 /***************************************************************************
973 ***************************************************************************/
975 NTSTATUS
_lsa_LookupNames(pipes_struct
*p
,
976 struct lsa_LookupNames
*r
)
978 NTSTATUS status
= NT_STATUS_NONE_MAPPED
;
979 struct lsa_info
*handle
;
980 struct lsa_String
*names
= r
->in
.names
;
981 uint32 num_entries
= r
->in
.num_names
;
982 struct lsa_RefDomainList
*domains
= NULL
;
983 struct lsa_TranslatedSid
*rids
= NULL
;
984 uint32 mapped_count
= 0;
987 if (num_entries
> MAX_LOOKUP_SIDS
) {
988 num_entries
= MAX_LOOKUP_SIDS
;
989 DEBUG(5,("_lsa_LookupNames: truncating name lookup list to %d\n",
993 flags
= lsa_lookup_level_to_flags(r
->in
.level
);
995 domains
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_RefDomainList
);
997 return NT_STATUS_NO_MEMORY
;
1001 rids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, struct lsa_TranslatedSid
,
1004 return NT_STATUS_NO_MEMORY
;
1010 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
)) {
1011 status
= NT_STATUS_INVALID_HANDLE
;
1015 /* check if the user has enough rights */
1016 if (!(handle
->access
& LSA_POLICY_LOOKUP_NAMES
)) {
1017 status
= NT_STATUS_ACCESS_DENIED
;
1021 /* set up the LSA Lookup RIDs response */
1022 become_root(); /* lookup_name can require root privs */
1023 status
= lookup_lsa_rids(p
->mem_ctx
, domains
, rids
, num_entries
,
1024 names
, flags
, &mapped_count
);
1029 if (NT_STATUS_IS_OK(status
) && (num_entries
!= 0) ) {
1030 if (mapped_count
== 0) {
1031 status
= NT_STATUS_NONE_MAPPED
;
1032 } else if (mapped_count
!= num_entries
) {
1033 status
= STATUS_SOME_UNMAPPED
;
1037 *r
->out
.count
= mapped_count
;
1038 *r
->out
.domains
= domains
;
1039 r
->out
.sids
->sids
= rids
;
1040 r
->out
.sids
->count
= num_entries
;
1045 /***************************************************************************
1047 ***************************************************************************/
1049 NTSTATUS
_lsa_LookupNames2(pipes_struct
*p
,
1050 struct lsa_LookupNames2
*r
)
1053 struct lsa_LookupNames q
;
1054 struct lsa_TransSidArray2
*sid_array2
= r
->in
.sids
;
1055 struct lsa_TransSidArray
*sid_array
= NULL
;
1058 sid_array
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_TransSidArray
);
1060 return NT_STATUS_NO_MEMORY
;
1063 q
.in
.handle
= r
->in
.handle
;
1064 q
.in
.num_names
= r
->in
.num_names
;
1065 q
.in
.names
= r
->in
.names
;
1066 q
.in
.level
= r
->in
.level
;
1067 q
.in
.sids
= sid_array
;
1068 q
.in
.count
= r
->in
.count
;
1069 /* we do not know what this is for */
1070 /* = r->in.unknown1; */
1071 /* = r->in.unknown2; */
1073 q
.out
.domains
= r
->out
.domains
;
1074 q
.out
.sids
= sid_array
;
1075 q
.out
.count
= r
->out
.count
;
1077 status
= _lsa_LookupNames(p
, &q
);
1079 sid_array2
->sids
= TALLOC_ARRAY(p
->mem_ctx
, struct lsa_TranslatedSid2
, sid_array
->count
);
1080 if (!sid_array2
->sids
) {
1081 return NT_STATUS_NO_MEMORY
;
1084 for (i
=0; i
<sid_array
->count
; i
++) {
1085 sid_array2
->sids
[i
].sid_type
= sid_array
->sids
[i
].sid_type
;
1086 sid_array2
->sids
[i
].rid
= sid_array
->sids
[i
].rid
;
1087 sid_array2
->sids
[i
].sid_index
= sid_array
->sids
[i
].sid_index
;
1088 sid_array2
->sids
[i
].unknown
= 0;
1091 r
->out
.sids
= sid_array2
;
1096 /***************************************************************************
1098 ***************************************************************************/
1100 NTSTATUS
_lsa_LookupNames3(pipes_struct
*p
,
1101 struct lsa_LookupNames3
*r
)
1104 struct lsa_info
*handle
;
1105 struct lsa_String
*names
= r
->in
.names
;
1106 uint32 num_entries
= r
->in
.num_names
;
1107 struct lsa_RefDomainList
*domains
= NULL
;
1108 struct lsa_TranslatedSid3
*trans_sids
= NULL
;
1109 uint32 mapped_count
= 0;
1111 bool check_policy
= true;
1113 switch (p
->hdr_req
.opnum
) {
1114 case NDR_LSA_LOOKUPNAMES4
:
1115 check_policy
= false;
1117 case NDR_LSA_LOOKUPNAMES3
:
1119 check_policy
= true;
1122 if (num_entries
> MAX_LOOKUP_SIDS
) {
1123 num_entries
= MAX_LOOKUP_SIDS
;
1124 DEBUG(5,("_lsa_LookupNames3: truncating name lookup list to %d\n", num_entries
));
1127 /* Probably the lookup_level is some sort of bitmask. */
1128 if (r
->in
.level
== 1) {
1129 flags
= LOOKUP_NAME_ALL
;
1132 domains
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_RefDomainList
);
1134 return NT_STATUS_NO_MEMORY
;
1138 trans_sids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, struct lsa_TranslatedSid3
,
1141 return NT_STATUS_NO_MEMORY
;
1149 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
)) {
1150 status
= NT_STATUS_INVALID_HANDLE
;
1154 /* check if the user has enough rights */
1155 if (!(handle
->access
& LSA_POLICY_LOOKUP_NAMES
)) {
1156 status
= NT_STATUS_ACCESS_DENIED
;
1161 /* set up the LSA Lookup SIDs response */
1162 become_root(); /* lookup_name can require root privs */
1163 status
= lookup_lsa_sids(p
->mem_ctx
, domains
, trans_sids
, num_entries
,
1164 names
, flags
, &mapped_count
);
1169 if (NT_STATUS_IS_OK(status
)) {
1170 if (mapped_count
== 0) {
1171 status
= NT_STATUS_NONE_MAPPED
;
1172 } else if (mapped_count
!= num_entries
) {
1173 status
= STATUS_SOME_UNMAPPED
;
1177 *r
->out
.count
= mapped_count
;
1178 *r
->out
.domains
= domains
;
1179 r
->out
.sids
->sids
= trans_sids
;
1180 r
->out
.sids
->count
= num_entries
;
1185 /***************************************************************************
1187 ***************************************************************************/
1189 NTSTATUS
_lsa_LookupNames4(pipes_struct
*p
,
1190 struct lsa_LookupNames4
*r
)
1192 struct lsa_LookupNames3 q
;
1194 /* No policy handle on this call. Restrict to crypto connections. */
1195 if (p
->auth
.auth_type
!= PIPE_AUTH_TYPE_SCHANNEL
) {
1196 DEBUG(0,("_lsa_lookup_names4: client %s not using schannel for netlogon\n",
1197 get_remote_machine_name() ));
1198 return NT_STATUS_INVALID_PARAMETER
;
1202 q
.in
.num_names
= r
->in
.num_names
;
1203 q
.in
.names
= r
->in
.names
;
1204 q
.in
.level
= r
->in
.level
;
1205 q
.in
.unknown1
= r
->in
.unknown1
;
1206 q
.in
.unknown2
= r
->in
.unknown2
;
1207 q
.in
.sids
= r
->in
.sids
;
1208 q
.in
.count
= r
->in
.count
;
1210 q
.out
.domains
= r
->out
.domains
;
1211 q
.out
.sids
= r
->out
.sids
;
1212 q
.out
.count
= r
->out
.count
;
1214 return _lsa_LookupNames3(p
, &q
);
1217 /***************************************************************************
1218 _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
1219 ***************************************************************************/
1221 NTSTATUS
_lsa_Close(pipes_struct
*p
, struct lsa_Close
*r
)
1223 if (!find_policy_by_hnd(p
, r
->in
.handle
, NULL
)) {
1224 return NT_STATUS_INVALID_HANDLE
;
1227 close_policy_hnd(p
, r
->in
.handle
);
1228 ZERO_STRUCTP(r
->out
.handle
);
1229 return NT_STATUS_OK
;
1232 /***************************************************************************
1233 ***************************************************************************/
1235 NTSTATUS
_lsa_OpenSecret(pipes_struct
*p
, struct lsa_OpenSecret
*r
)
1237 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1240 /***************************************************************************
1241 ***************************************************************************/
1243 NTSTATUS
_lsa_OpenTrustedDomain(pipes_struct
*p
, struct lsa_OpenTrustedDomain
*r
)
1245 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1248 /***************************************************************************
1249 ***************************************************************************/
1251 NTSTATUS
_lsa_CreateTrustedDomain(pipes_struct
*p
, struct lsa_CreateTrustedDomain
*r
)
1253 return NT_STATUS_ACCESS_DENIED
;
1256 /***************************************************************************
1257 ***************************************************************************/
1259 NTSTATUS
_lsa_CreateSecret(pipes_struct
*p
, struct lsa_CreateSecret
*r
)
1261 return NT_STATUS_ACCESS_DENIED
;
1264 /***************************************************************************
1265 ***************************************************************************/
1267 NTSTATUS
_lsa_SetSecret(pipes_struct
*p
, struct lsa_SetSecret
*r
)
1269 return NT_STATUS_ACCESS_DENIED
;
1272 /***************************************************************************
1274 ***************************************************************************/
1276 NTSTATUS
_lsa_DeleteObject(pipes_struct
*p
,
1277 struct lsa_DeleteObject
*r
)
1279 return NT_STATUS_ACCESS_DENIED
;
1282 /***************************************************************************
1284 ***************************************************************************/
1286 NTSTATUS
_lsa_EnumPrivs(pipes_struct
*p
,
1287 struct lsa_EnumPrivs
*r
)
1289 struct lsa_info
*handle
;
1291 uint32 enum_context
= *r
->in
.resume_handle
;
1292 int num_privs
= count_all_privileges();
1293 struct lsa_PrivEntry
*entries
= NULL
;
1296 /* remember that the enum_context starts at 0 and not 1 */
1298 if ( enum_context
>= num_privs
)
1299 return NT_STATUS_NO_MORE_ENTRIES
;
1301 DEBUG(10,("_lsa_EnumPrivs: enum_context:%d total entries:%d\n",
1302 enum_context
, num_privs
));
1304 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
1305 return NT_STATUS_INVALID_HANDLE
;
1307 /* check if the user has enough rights
1308 I don't know if it's the right one. not documented. */
1310 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1311 return NT_STATUS_ACCESS_DENIED
;
1314 entries
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, struct lsa_PrivEntry
, num_privs
);
1316 return NT_STATUS_NO_MEMORY
;
1322 for (i
= 0; i
< num_privs
; i
++) {
1323 if( i
< enum_context
) {
1325 init_lsa_StringLarge(&entries
[i
].name
, NULL
);
1327 entries
[i
].luid
.low
= 0;
1328 entries
[i
].luid
.high
= 0;
1331 init_lsa_StringLarge(&entries
[i
].name
, privs
[i
].name
);
1333 luid
= get_privilege_luid( &privs
[i
].se_priv
);
1335 entries
[i
].luid
.low
= luid
.luid
.low
;
1336 entries
[i
].luid
.high
= luid
.luid
.high
;
1340 enum_context
= num_privs
;
1342 *r
->out
.resume_handle
= enum_context
;
1343 r
->out
.privs
->count
= num_privs
;
1344 r
->out
.privs
->privs
= entries
;
1346 return NT_STATUS_OK
;
1349 /***************************************************************************
1350 _lsa_LookupPrivDisplayName
1351 ***************************************************************************/
1353 NTSTATUS
_lsa_LookupPrivDisplayName(pipes_struct
*p
,
1354 struct lsa_LookupPrivDisplayName
*r
)
1356 struct lsa_info
*handle
;
1357 const char *description
;
1358 struct lsa_StringLarge
*lsa_name
;
1360 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
1361 return NT_STATUS_INVALID_HANDLE
;
1363 /* check if the user has enough rights */
1366 * I don't know if it's the right one. not documented.
1368 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1369 return NT_STATUS_ACCESS_DENIED
;
1371 DEBUG(10,("_lsa_LookupPrivDisplayName: name = %s\n", r
->in
.name
->string
));
1373 description
= get_privilege_dispname(r
->in
.name
->string
);
1375 DEBUG(10,("_lsa_LookupPrivDisplayName: doesn't exist\n"));
1376 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1379 DEBUG(10,("_lsa_LookupPrivDisplayName: display name = %s\n", description
));
1381 lsa_name
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_StringLarge
);
1383 return NT_STATUS_NO_MEMORY
;
1386 init_lsa_StringLarge(lsa_name
, description
);
1388 *r
->out
.returned_language_id
= r
->in
.language_id
;
1389 *r
->out
.disp_name
= lsa_name
;
1391 return NT_STATUS_OK
;
1394 /***************************************************************************
1396 ***************************************************************************/
1398 NTSTATUS
_lsa_EnumAccounts(pipes_struct
*p
,
1399 struct lsa_EnumAccounts
*r
)
1401 struct lsa_info
*handle
;
1403 int i
, j
, num_entries
;
1405 struct lsa_SidPtr
*sids
= NULL
;
1407 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
1408 return NT_STATUS_INVALID_HANDLE
;
1410 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1411 return NT_STATUS_ACCESS_DENIED
;
1416 /* The only way we can currently find out all the SIDs that have been
1417 privileged is to scan all privileges */
1419 status
= privilege_enumerate_accounts(&sid_list
, &num_entries
);
1420 if (!NT_STATUS_IS_OK(status
)) {
1424 if (*r
->in
.resume_handle
>= num_entries
) {
1425 return NT_STATUS_NO_MORE_ENTRIES
;
1428 if (num_entries
- *r
->in
.resume_handle
) {
1429 sids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, struct lsa_SidPtr
,
1430 num_entries
- *r
->in
.resume_handle
);
1432 SAFE_FREE(sid_list
);
1433 return NT_STATUS_NO_MEMORY
;
1436 for (i
= *r
->in
.resume_handle
, j
= 0; i
< num_entries
; i
++, j
++) {
1437 sids
[j
].sid
= sid_dup_talloc(p
->mem_ctx
, &sid_list
[i
]);
1439 SAFE_FREE(sid_list
);
1440 return NT_STATUS_NO_MEMORY
;
1445 talloc_free(sid_list
);
1447 *r
->out
.resume_handle
= num_entries
;
1448 r
->out
.sids
->num_sids
= num_entries
;
1449 r
->out
.sids
->sids
= sids
;
1451 return NT_STATUS_OK
;
1454 /***************************************************************************
1456 ***************************************************************************/
1458 NTSTATUS
_lsa_GetUserName(pipes_struct
*p
,
1459 struct lsa_GetUserName
*r
)
1461 const char *username
, *domname
;
1462 struct lsa_String
*account_name
= NULL
;
1463 struct lsa_String
*authority_name
= NULL
;
1465 if (p
->server_info
->guest
) {
1467 * I'm 99% sure this is not the right place to do this,
1468 * global_sid_Anonymous should probably be put into the token
1469 * instead of the guest id -- vl
1471 if (!lookup_sid(p
->mem_ctx
, &global_sid_Anonymous
,
1472 &domname
, &username
, NULL
)) {
1473 return NT_STATUS_NO_MEMORY
;
1476 username
= p
->server_info
->sanitized_username
;
1477 domname
= pdb_get_domain(p
->server_info
->sam_account
);
1480 account_name
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_String
);
1481 if (!account_name
) {
1482 return NT_STATUS_NO_MEMORY
;
1485 authority_name
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_String
);
1486 if (!authority_name
) {
1487 return NT_STATUS_NO_MEMORY
;
1490 init_lsa_String(account_name
, username
);
1491 init_lsa_String(authority_name
, domname
);
1493 *r
->out
.account_name
= account_name
;
1494 *r
->out
.authority_name
= authority_name
;
1496 return NT_STATUS_OK
;
1499 /***************************************************************************
1501 ***************************************************************************/
1503 NTSTATUS
_lsa_CreateAccount(pipes_struct
*p
,
1504 struct lsa_CreateAccount
*r
)
1506 struct lsa_info
*handle
;
1507 struct lsa_info
*info
;
1509 /* find the connection policy handle. */
1510 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
1511 return NT_STATUS_INVALID_HANDLE
;
1513 /* check if the user has enough rights */
1516 * I don't know if it's the right one. not documented.
1517 * but guessed with rpcclient.
1519 if (!(handle
->access
& LSA_POLICY_GET_PRIVATE_INFORMATION
))
1520 return NT_STATUS_ACCESS_DENIED
;
1522 /* check to see if the pipe_user is a Domain Admin since
1523 account_pol.tdb was already opened as root, this is all we have */
1525 if ( !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1526 return NT_STATUS_ACCESS_DENIED
;
1528 if ( is_privileged_sid( r
->in
.sid
) )
1529 return NT_STATUS_OBJECT_NAME_COLLISION
;
1531 /* associate the user/group SID with the (unique) handle. */
1533 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
1534 return NT_STATUS_NO_MEMORY
;
1537 info
->sid
= *r
->in
.sid
;
1538 info
->access
= r
->in
.access_mask
;
1540 /* get a (unique) handle. open a policy on it. */
1541 if (!create_policy_hnd(p
, r
->out
.acct_handle
, free_lsa_info
, (void *)info
))
1542 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1544 return privilege_create_account( &info
->sid
);
1548 /***************************************************************************
1550 ***************************************************************************/
1552 NTSTATUS
_lsa_OpenAccount(pipes_struct
*p
,
1553 struct lsa_OpenAccount
*r
)
1555 struct lsa_info
*handle
;
1556 struct lsa_info
*info
;
1558 /* find the connection policy handle. */
1559 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
1560 return NT_STATUS_INVALID_HANDLE
;
1562 /* check if the user has enough rights */
1565 * I don't know if it's the right one. not documented.
1566 * but guessed with rpcclient.
1568 if (!(handle
->access
& LSA_POLICY_GET_PRIVATE_INFORMATION
))
1569 return NT_STATUS_ACCESS_DENIED
;
1571 /* TODO: Fis the parsing routine before reenabling this check! */
1573 if (!lookup_sid(&handle
->sid
, dom_name
, name
, &type
))
1574 return NT_STATUS_ACCESS_DENIED
;
1576 /* associate the user/group SID with the (unique) handle. */
1577 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
1578 return NT_STATUS_NO_MEMORY
;
1581 info
->sid
= *r
->in
.sid
;
1582 info
->access
= r
->in
.access_mask
;
1584 /* get a (unique) handle. open a policy on it. */
1585 if (!create_policy_hnd(p
, r
->out
.acct_handle
, free_lsa_info
, (void *)info
))
1586 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1588 return NT_STATUS_OK
;
1591 /***************************************************************************
1592 _lsa_EnumPrivsAccount
1593 For a given SID, enumerate all the privilege this account has.
1594 ***************************************************************************/
1596 NTSTATUS
_lsa_EnumPrivsAccount(pipes_struct
*p
,
1597 struct lsa_EnumPrivsAccount
*r
)
1599 NTSTATUS status
= NT_STATUS_OK
;
1600 struct lsa_info
*info
=NULL
;
1602 PRIVILEGE_SET privileges
;
1603 struct lsa_PrivilegeSet
*priv_set
= NULL
;
1604 struct lsa_LUIDAttribute
*luid_attrs
= NULL
;
1607 /* find the connection policy handle. */
1608 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1609 return NT_STATUS_INVALID_HANDLE
;
1611 if ( !get_privileges_for_sids( &mask
, &info
->sid
, 1 ) )
1612 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1614 privilege_set_init( &privileges
);
1616 if ( se_priv_to_privilege_set( &privileges
, &mask
) ) {
1618 DEBUG(10,("_lsa_EnumPrivsAccount: %s has %d privileges\n",
1619 sid_string_dbg(&info
->sid
),
1622 priv_set
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_PrivilegeSet
);
1624 status
= NT_STATUS_NO_MEMORY
;
1628 luid_attrs
= TALLOC_ZERO_ARRAY(p
->mem_ctx
,
1629 struct lsa_LUIDAttribute
,
1632 status
= NT_STATUS_NO_MEMORY
;
1636 for (i
=0; i
<privileges
.count
; i
++) {
1637 luid_attrs
[i
].luid
.low
= privileges
.set
[i
].luid
.low
;
1638 luid_attrs
[i
].luid
.high
= privileges
.set
[i
].luid
.high
;
1639 luid_attrs
[i
].attribute
= privileges
.set
[i
].attr
;
1642 priv_set
->count
= privileges
.count
;
1643 priv_set
->unknown
= 0;
1644 priv_set
->set
= luid_attrs
;
1646 *r
->out
.privs
= priv_set
;
1648 status
= NT_STATUS_NO_SUCH_PRIVILEGE
;
1652 privilege_set_free( &privileges
);
1657 /***************************************************************************
1658 _lsa_GetSystemAccessAccount
1659 ***************************************************************************/
1661 NTSTATUS
_lsa_GetSystemAccessAccount(pipes_struct
*p
,
1662 struct lsa_GetSystemAccessAccount
*r
)
1664 struct lsa_info
*info
=NULL
;
1666 /* find the connection policy handle. */
1668 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1669 return NT_STATUS_INVALID_HANDLE
;
1671 if (!lookup_sid(p
->mem_ctx
, &info
->sid
, NULL
, NULL
, NULL
))
1672 return NT_STATUS_ACCESS_DENIED
;
1675 0x01 -> Log on locally
1676 0x02 -> Access this computer from network
1677 0x04 -> Log on as a batch job
1678 0x10 -> Log on as a service
1680 they can be ORed together
1683 *r
->out
.access_mask
= PR_LOG_ON_LOCALLY
| PR_ACCESS_FROM_NETWORK
;
1685 return NT_STATUS_OK
;
1688 /***************************************************************************
1689 update the systemaccount information
1690 ***************************************************************************/
1692 NTSTATUS
_lsa_SetSystemAccessAccount(pipes_struct
*p
,
1693 struct lsa_SetSystemAccessAccount
*r
)
1695 struct lsa_info
*info
=NULL
;
1698 /* find the connection policy handle. */
1699 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1700 return NT_STATUS_INVALID_HANDLE
;
1702 /* check to see if the pipe_user is a Domain Admin since
1703 account_pol.tdb was already opened as root, this is all we have */
1705 if ( !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1706 return NT_STATUS_ACCESS_DENIED
;
1708 if (!pdb_getgrsid(&map
, info
->sid
))
1709 return NT_STATUS_NO_SUCH_GROUP
;
1711 return pdb_update_group_mapping_entry(&map
);
1714 /***************************************************************************
1715 _lsa_AddPrivilegesToAccount
1716 For a given SID, add some privileges.
1717 ***************************************************************************/
1719 NTSTATUS
_lsa_AddPrivilegesToAccount(pipes_struct
*p
,
1720 struct lsa_AddPrivilegesToAccount
*r
)
1722 struct lsa_info
*info
= NULL
;
1724 struct lsa_PrivilegeSet
*set
= NULL
;
1726 /* find the connection policy handle. */
1727 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1728 return NT_STATUS_INVALID_HANDLE
;
1730 /* check to see if the pipe_user is root or a Domain Admin since
1731 account_pol.tdb was already opened as root, this is all we have */
1733 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
1734 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1736 return NT_STATUS_ACCESS_DENIED
;
1740 if ( !privilege_set_to_se_priv( &mask
, set
) )
1741 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1743 if ( !grant_privilege( &info
->sid
, &mask
) ) {
1744 DEBUG(3,("_lsa_AddPrivilegesToAccount: grant_privilege(%s) failed!\n",
1745 sid_string_dbg(&info
->sid
) ));
1746 DEBUG(3,("Privilege mask:\n"));
1747 dump_se_priv( DBGC_ALL
, 3, &mask
);
1748 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1751 return NT_STATUS_OK
;
1754 /***************************************************************************
1755 _lsa_RemovePrivilegesFromAccount
1756 For a given SID, remove some privileges.
1757 ***************************************************************************/
1759 NTSTATUS
_lsa_RemovePrivilegesFromAccount(pipes_struct
*p
,
1760 struct lsa_RemovePrivilegesFromAccount
*r
)
1762 struct lsa_info
*info
= NULL
;
1764 struct lsa_PrivilegeSet
*set
= NULL
;
1766 /* find the connection policy handle. */
1767 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1768 return NT_STATUS_INVALID_HANDLE
;
1770 /* check to see if the pipe_user is root or a Domain Admin since
1771 account_pol.tdb was already opened as root, this is all we have */
1773 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
1774 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1776 return NT_STATUS_ACCESS_DENIED
;
1781 if ( !privilege_set_to_se_priv( &mask
, set
) )
1782 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1784 if ( !revoke_privilege( &info
->sid
, &mask
) ) {
1785 DEBUG(3,("_lsa_RemovePrivilegesFromAccount: revoke_privilege(%s) failed!\n",
1786 sid_string_dbg(&info
->sid
) ));
1787 DEBUG(3,("Privilege mask:\n"));
1788 dump_se_priv( DBGC_ALL
, 3, &mask
);
1789 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1792 return NT_STATUS_OK
;
1795 /***************************************************************************
1797 ***************************************************************************/
1799 NTSTATUS
_lsa_QuerySecurity(pipes_struct
*p
,
1800 struct lsa_QuerySecurity
*r
)
1802 struct lsa_info
*handle
=NULL
;
1803 SEC_DESC
*psd
= NULL
;
1807 /* find the connection policy handle. */
1808 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
1809 return NT_STATUS_INVALID_HANDLE
;
1811 /* check if the user has enough rights */
1812 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1813 return NT_STATUS_ACCESS_DENIED
;
1816 switch (r
->in
.sec_info
) {
1818 /* SD contains only the owner */
1820 status
=lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
1821 if(!NT_STATUS_IS_OK(status
))
1822 return NT_STATUS_NO_MEMORY
;
1825 if((*r
->out
.sdbuf
= make_sec_desc_buf(p
->mem_ctx
, sd_size
, psd
)) == NULL
)
1826 return NT_STATUS_NO_MEMORY
;
1829 /* SD contains only the ACL */
1831 status
=lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
1832 if(!NT_STATUS_IS_OK(status
))
1833 return NT_STATUS_NO_MEMORY
;
1835 if((*r
->out
.sdbuf
= make_sec_desc_buf(p
->mem_ctx
, sd_size
, psd
)) == NULL
)
1836 return NT_STATUS_NO_MEMORY
;
1839 return NT_STATUS_INVALID_LEVEL
;
1845 #if 0 /* AD DC work in ongoing in Samba 4 */
1847 /***************************************************************************
1848 ***************************************************************************/
1850 NTSTATUS
_lsa_query_info2(pipes_struct
*p
, LSA_Q_QUERY_INFO2
*q_u
, LSA_R_QUERY_INFO2
*r_u
)
1852 struct lsa_info
*handle
;
1853 const char *nb_name
;
1854 char *dns_name
= NULL
;
1855 char *forest_name
= NULL
;
1856 DOM_SID
*sid
= NULL
;
1861 r_u
->status
= NT_STATUS_OK
;
1863 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1864 return NT_STATUS_INVALID_HANDLE
;
1866 switch (q_u
->info_class
) {
1868 /* check if the user has enough rights */
1869 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1870 return NT_STATUS_ACCESS_DENIED
;
1872 /* Request PolicyPrimaryDomainInformation. */
1873 switch (lp_server_role()) {
1874 case ROLE_DOMAIN_PDC
:
1875 case ROLE_DOMAIN_BDC
:
1876 nb_name
= get_global_sam_name();
1877 /* ugly temp hack for these next two */
1879 /* This should be a 'netbios domain -> DNS domain' mapping */
1880 dnsdomname
= get_mydnsdomname(p
->mem_ctx
);
1881 if (!dnsdomname
|| !*dnsdomname
) {
1882 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
1884 strlower_m(dnsdomname
);
1886 dns_name
= dnsdomname
;
1887 forest_name
= dnsdomname
;
1889 sid
= get_global_sam_sid();
1890 secrets_fetch_domain_guid(lp_workgroup(), &guid
);
1893 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
1895 init_dns_dom_info(&r_u
->info
.dns_dom_info
, nb_name
, dns_name
,
1896 forest_name
,&guid
,sid
);
1899 DEBUG(0,("_lsa_query_info2: unknown info level in Lsa Query: %d\n", q_u
->info_class
));
1900 r_u
->status
= NT_STATUS_INVALID_INFO_CLASS
;
1904 if (NT_STATUS_IS_OK(r_u
->status
)) {
1906 r_u
->info_class
= q_u
->info_class
;
1911 #endif /* AD DC work in ongoing in Samba 4 */
1913 /***************************************************************************
1914 _lsa_AddAccountRights
1915 ***************************************************************************/
1917 NTSTATUS
_lsa_AddAccountRights(pipes_struct
*p
,
1918 struct lsa_AddAccountRights
*r
)
1920 struct lsa_info
*info
= NULL
;
1924 /* find the connection policy handle. */
1925 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1926 return NT_STATUS_INVALID_HANDLE
;
1928 /* check to see if the pipe_user is a Domain Admin since
1929 account_pol.tdb was already opened as root, this is all we have */
1931 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
1932 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1934 return NT_STATUS_ACCESS_DENIED
;
1937 /* according to an NT4 PDC, you can add privileges to SIDs even without
1938 call_lsa_create_account() first. And you can use any arbitrary SID. */
1940 sid_copy( &sid
, r
->in
.sid
);
1942 for ( i
=0; i
< r
->in
.rights
->count
; i
++ ) {
1944 const char *privname
= r
->in
.rights
->names
[i
].string
;
1946 /* only try to add non-null strings */
1951 if ( !grant_privilege_by_name( &sid
, privname
) ) {
1952 DEBUG(2,("_lsa_AddAccountRights: Failed to add privilege [%s]\n",
1954 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1958 return NT_STATUS_OK
;
1961 /***************************************************************************
1962 _lsa_RemoveAccountRights
1963 ***************************************************************************/
1965 NTSTATUS
_lsa_RemoveAccountRights(pipes_struct
*p
,
1966 struct lsa_RemoveAccountRights
*r
)
1968 struct lsa_info
*info
= NULL
;
1971 const char *privname
= NULL
;
1973 /* find the connection policy handle. */
1974 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1975 return NT_STATUS_INVALID_HANDLE
;
1977 /* check to see if the pipe_user is a Domain Admin since
1978 account_pol.tdb was already opened as root, this is all we have */
1980 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
1981 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1983 return NT_STATUS_ACCESS_DENIED
;
1986 sid_copy( &sid
, r
->in
.sid
);
1988 if ( r
->in
.remove_all
) {
1989 if ( !revoke_all_privileges( &sid
) )
1990 return NT_STATUS_ACCESS_DENIED
;
1992 return NT_STATUS_OK
;
1995 for ( i
=0; i
< r
->in
.rights
->count
; i
++ ) {
1997 privname
= r
->in
.rights
->names
[i
].string
;
1999 /* only try to add non-null strings */
2004 if ( !revoke_privilege_by_name( &sid
, privname
) ) {
2005 DEBUG(2,("_lsa_RemoveAccountRights: Failed to revoke privilege [%s]\n",
2007 return NT_STATUS_NO_SUCH_PRIVILEGE
;
2011 return NT_STATUS_OK
;
2014 /*******************************************************************
2015 ********************************************************************/
2017 static NTSTATUS
init_lsa_right_set(TALLOC_CTX
*mem_ctx
,
2018 struct lsa_RightSet
*r
,
2019 PRIVILEGE_SET
*privileges
)
2022 const char *privname
;
2023 const char **privname_array
= NULL
;
2026 for (i
=0; i
<privileges
->count
; i
++) {
2028 privname
= luid_to_privilege_name(&privileges
->set
[i
].luid
);
2030 if (!add_string_to_array(mem_ctx
, privname
,
2031 &privname_array
, &num_priv
)) {
2032 return NT_STATUS_NO_MEMORY
;
2039 r
->names
= TALLOC_ZERO_ARRAY(mem_ctx
, struct lsa_StringLarge
,
2042 return NT_STATUS_NO_MEMORY
;
2045 for (i
=0; i
<num_priv
; i
++) {
2046 init_lsa_StringLarge(&r
->names
[i
], privname_array
[i
]);
2049 r
->count
= num_priv
;
2052 return NT_STATUS_OK
;
2055 /***************************************************************************
2056 _lsa_EnumAccountRights
2057 ***************************************************************************/
2059 NTSTATUS
_lsa_EnumAccountRights(pipes_struct
*p
,
2060 struct lsa_EnumAccountRights
*r
)
2063 struct lsa_info
*info
= NULL
;
2065 PRIVILEGE_SET privileges
;
2068 /* find the connection policy handle. */
2070 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
2071 return NT_STATUS_INVALID_HANDLE
;
2073 /* according to an NT4 PDC, you can add privileges to SIDs even without
2074 call_lsa_create_account() first. And you can use any arbitrary SID. */
2076 sid_copy( &sid
, r
->in
.sid
);
2078 if ( !get_privileges_for_sids( &mask
, &sid
, 1 ) )
2079 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
2081 privilege_set_init( &privileges
);
2083 if ( se_priv_to_privilege_set( &privileges
, &mask
) ) {
2085 DEBUG(10,("_lsa_EnumAccountRights: %s has %d privileges\n",
2086 sid_string_dbg(&sid
), privileges
.count
));
2088 status
= init_lsa_right_set(p
->mem_ctx
, r
->out
.rights
, &privileges
);
2090 status
= NT_STATUS_NO_SUCH_PRIVILEGE
;
2093 privilege_set_free( &privileges
);
2098 /***************************************************************************
2099 _lsa_LookupPrivValue
2100 ***************************************************************************/
2102 NTSTATUS
_lsa_LookupPrivValue(pipes_struct
*p
,
2103 struct lsa_LookupPrivValue
*r
)
2105 struct lsa_info
*info
= NULL
;
2106 const char *name
= NULL
;
2107 LUID_ATTR priv_luid
;
2110 /* find the connection policy handle. */
2112 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
2113 return NT_STATUS_INVALID_HANDLE
;
2115 name
= r
->in
.name
->string
;
2117 DEBUG(10,("_lsa_lookup_priv_value: name = %s\n", name
));
2119 if ( !se_priv_from_name( name
, &mask
) )
2120 return NT_STATUS_NO_SUCH_PRIVILEGE
;
2122 priv_luid
= get_privilege_luid( &mask
);
2124 r
->out
.luid
->low
= priv_luid
.luid
.low
;
2125 r
->out
.luid
->high
= priv_luid
.luid
.high
;
2127 return NT_STATUS_OK
;
2131 * From here on the server routines are just dummy ones to make smbd link with
2132 * librpc/gen_ndr/srv_lsa.c. These routines are actually never called, we are
2133 * pulling the server stubs across one by one.
2136 NTSTATUS
_lsa_Delete(pipes_struct
*p
, struct lsa_Delete
*r
)
2138 p
->rng_fault_state
= True
;
2139 return NT_STATUS_NOT_IMPLEMENTED
;
2142 NTSTATUS
_lsa_SetSecObj(pipes_struct
*p
, struct lsa_SetSecObj
*r
)
2144 p
->rng_fault_state
= True
;
2145 return NT_STATUS_NOT_IMPLEMENTED
;
2148 NTSTATUS
_lsa_ChangePassword(pipes_struct
*p
, struct lsa_ChangePassword
*r
)
2150 p
->rng_fault_state
= True
;
2151 return NT_STATUS_NOT_IMPLEMENTED
;
2154 NTSTATUS
_lsa_SetInfoPolicy(pipes_struct
*p
, struct lsa_SetInfoPolicy
*r
)
2156 p
->rng_fault_state
= True
;
2157 return NT_STATUS_NOT_IMPLEMENTED
;
2160 NTSTATUS
_lsa_ClearAuditLog(pipes_struct
*p
, struct lsa_ClearAuditLog
*r
)
2162 p
->rng_fault_state
= True
;
2163 return NT_STATUS_NOT_IMPLEMENTED
;
2166 NTSTATUS
_lsa_GetQuotasForAccount(pipes_struct
*p
, struct lsa_GetQuotasForAccount
*r
)
2168 p
->rng_fault_state
= True
;
2169 return NT_STATUS_NOT_IMPLEMENTED
;
2172 NTSTATUS
_lsa_SetQuotasForAccount(pipes_struct
*p
, struct lsa_SetQuotasForAccount
*r
)
2174 p
->rng_fault_state
= True
;
2175 return NT_STATUS_NOT_IMPLEMENTED
;
2178 NTSTATUS
_lsa_QueryTrustedDomainInfo(pipes_struct
*p
, struct lsa_QueryTrustedDomainInfo
*r
)
2180 p
->rng_fault_state
= True
;
2181 return NT_STATUS_NOT_IMPLEMENTED
;
2184 NTSTATUS
_lsa_SetInformationTrustedDomain(pipes_struct
*p
, struct lsa_SetInformationTrustedDomain
*r
)
2186 p
->rng_fault_state
= True
;
2187 return NT_STATUS_NOT_IMPLEMENTED
;
2190 NTSTATUS
_lsa_QuerySecret(pipes_struct
*p
, struct lsa_QuerySecret
*r
)
2192 p
->rng_fault_state
= True
;
2193 return NT_STATUS_NOT_IMPLEMENTED
;
2196 NTSTATUS
_lsa_LookupPrivName(pipes_struct
*p
, struct lsa_LookupPrivName
*r
)
2198 p
->rng_fault_state
= True
;
2199 return NT_STATUS_NOT_IMPLEMENTED
;
2202 NTSTATUS
_lsa_EnumAccountsWithUserRight(pipes_struct
*p
, struct lsa_EnumAccountsWithUserRight
*r
)
2204 p
->rng_fault_state
= True
;
2205 return NT_STATUS_NOT_IMPLEMENTED
;
2208 NTSTATUS
_lsa_QueryTrustedDomainInfoBySid(pipes_struct
*p
, struct lsa_QueryTrustedDomainInfoBySid
*r
)
2210 p
->rng_fault_state
= True
;
2211 return NT_STATUS_NOT_IMPLEMENTED
;
2214 NTSTATUS
_lsa_SetTrustedDomainInfo(pipes_struct
*p
, struct lsa_SetTrustedDomainInfo
*r
)
2216 p
->rng_fault_state
= True
;
2217 return NT_STATUS_NOT_IMPLEMENTED
;
2220 NTSTATUS
_lsa_DeleteTrustedDomain(pipes_struct
*p
, struct lsa_DeleteTrustedDomain
*r
)
2222 p
->rng_fault_state
= True
;
2223 return NT_STATUS_NOT_IMPLEMENTED
;
2226 NTSTATUS
_lsa_StorePrivateData(pipes_struct
*p
, struct lsa_StorePrivateData
*r
)
2228 p
->rng_fault_state
= True
;
2229 return NT_STATUS_NOT_IMPLEMENTED
;
2232 NTSTATUS
_lsa_RetrievePrivateData(pipes_struct
*p
, struct lsa_RetrievePrivateData
*r
)
2234 p
->rng_fault_state
= True
;
2235 return NT_STATUS_NOT_IMPLEMENTED
;
2238 NTSTATUS
_lsa_QueryInfoPolicy2(pipes_struct
*p
, struct lsa_QueryInfoPolicy2
*r
)
2240 p
->rng_fault_state
= True
;
2241 return NT_STATUS_NOT_IMPLEMENTED
;
2244 NTSTATUS
_lsa_SetInfoPolicy2(pipes_struct
*p
, struct lsa_SetInfoPolicy2
*r
)
2246 p
->rng_fault_state
= True
;
2247 return NT_STATUS_NOT_IMPLEMENTED
;
2250 NTSTATUS
_lsa_QueryTrustedDomainInfoByName(pipes_struct
*p
, struct lsa_QueryTrustedDomainInfoByName
*r
)
2252 p
->rng_fault_state
= True
;
2253 return NT_STATUS_NOT_IMPLEMENTED
;
2256 NTSTATUS
_lsa_SetTrustedDomainInfoByName(pipes_struct
*p
, struct lsa_SetTrustedDomainInfoByName
*r
)
2258 p
->rng_fault_state
= True
;
2259 return NT_STATUS_NOT_IMPLEMENTED
;
2262 NTSTATUS
_lsa_EnumTrustedDomainsEx(pipes_struct
*p
, struct lsa_EnumTrustedDomainsEx
*r
)
2264 p
->rng_fault_state
= True
;
2265 return NT_STATUS_NOT_IMPLEMENTED
;
2268 NTSTATUS
_lsa_CreateTrustedDomainEx(pipes_struct
*p
, struct lsa_CreateTrustedDomainEx
*r
)
2270 p
->rng_fault_state
= True
;
2271 return NT_STATUS_NOT_IMPLEMENTED
;
2274 NTSTATUS
_lsa_CloseTrustedDomainEx(pipes_struct
*p
, struct lsa_CloseTrustedDomainEx
*r
)
2276 p
->rng_fault_state
= True
;
2277 return NT_STATUS_NOT_IMPLEMENTED
;
2280 NTSTATUS
_lsa_QueryDomainInformationPolicy(pipes_struct
*p
, struct lsa_QueryDomainInformationPolicy
*r
)
2282 p
->rng_fault_state
= True
;
2283 return NT_STATUS_NOT_IMPLEMENTED
;
2286 NTSTATUS
_lsa_SetDomainInformationPolicy(pipes_struct
*p
, struct lsa_SetDomainInformationPolicy
*r
)
2288 p
->rng_fault_state
= True
;
2289 return NT_STATUS_NOT_IMPLEMENTED
;
2292 NTSTATUS
_lsa_OpenTrustedDomainByName(pipes_struct
*p
, struct lsa_OpenTrustedDomainByName
*r
)
2294 p
->rng_fault_state
= True
;
2295 return NT_STATUS_NOT_IMPLEMENTED
;
2298 NTSTATUS
_lsa_TestCall(pipes_struct
*p
, struct lsa_TestCall
*r
)
2300 p
->rng_fault_state
= True
;
2301 return NT_STATUS_NOT_IMPLEMENTED
;
2304 NTSTATUS
_lsa_CreateTrustedDomainEx2(pipes_struct
*p
, struct lsa_CreateTrustedDomainEx2
*r
)
2306 p
->rng_fault_state
= True
;
2307 return NT_STATUS_NOT_IMPLEMENTED
;
2310 NTSTATUS
_lsa_CREDRWRITE(pipes_struct
*p
, struct lsa_CREDRWRITE
*r
)
2312 p
->rng_fault_state
= True
;
2313 return NT_STATUS_NOT_IMPLEMENTED
;
2316 NTSTATUS
_lsa_CREDRREAD(pipes_struct
*p
, struct lsa_CREDRREAD
*r
)
2318 p
->rng_fault_state
= True
;
2319 return NT_STATUS_NOT_IMPLEMENTED
;
2322 NTSTATUS
_lsa_CREDRENUMERATE(pipes_struct
*p
, struct lsa_CREDRENUMERATE
*r
)
2324 p
->rng_fault_state
= True
;
2325 return NT_STATUS_NOT_IMPLEMENTED
;
2328 NTSTATUS
_lsa_CREDRWRITEDOMAINCREDENTIALS(pipes_struct
*p
, struct lsa_CREDRWRITEDOMAINCREDENTIALS
*r
)
2330 p
->rng_fault_state
= True
;
2331 return NT_STATUS_NOT_IMPLEMENTED
;
2334 NTSTATUS
_lsa_CREDRREADDOMAINCREDENTIALS(pipes_struct
*p
, struct lsa_CREDRREADDOMAINCREDENTIALS
*r
)
2336 p
->rng_fault_state
= True
;
2337 return NT_STATUS_NOT_IMPLEMENTED
;
2340 NTSTATUS
_lsa_CREDRDELETE(pipes_struct
*p
, struct lsa_CREDRDELETE
*r
)
2342 p
->rng_fault_state
= True
;
2343 return NT_STATUS_NOT_IMPLEMENTED
;
2346 NTSTATUS
_lsa_CREDRGETTARGETINFO(pipes_struct
*p
, struct lsa_CREDRGETTARGETINFO
*r
)
2348 p
->rng_fault_state
= True
;
2349 return NT_STATUS_NOT_IMPLEMENTED
;
2352 NTSTATUS
_lsa_CREDRPROFILELOADED(pipes_struct
*p
, struct lsa_CREDRPROFILELOADED
*r
)
2354 p
->rng_fault_state
= True
;
2355 return NT_STATUS_NOT_IMPLEMENTED
;
2358 NTSTATUS
_lsa_CREDRGETSESSIONTYPES(pipes_struct
*p
, struct lsa_CREDRGETSESSIONTYPES
*r
)
2360 p
->rng_fault_state
= True
;
2361 return NT_STATUS_NOT_IMPLEMENTED
;
2364 NTSTATUS
_lsa_LSARREGISTERAUDITEVENT(pipes_struct
*p
, struct lsa_LSARREGISTERAUDITEVENT
*r
)
2366 p
->rng_fault_state
= True
;
2367 return NT_STATUS_NOT_IMPLEMENTED
;
2370 NTSTATUS
_lsa_LSARGENAUDITEVENT(pipes_struct
*p
, struct lsa_LSARGENAUDITEVENT
*r
)
2372 p
->rng_fault_state
= True
;
2373 return NT_STATUS_NOT_IMPLEMENTED
;
2376 NTSTATUS
_lsa_LSARUNREGISTERAUDITEVENT(pipes_struct
*p
, struct lsa_LSARUNREGISTERAUDITEVENT
*r
)
2378 p
->rng_fault_state
= True
;
2379 return NT_STATUS_NOT_IMPLEMENTED
;
2382 NTSTATUS
_lsa_lsaRQueryForestTrustInformation(pipes_struct
*p
, struct lsa_lsaRQueryForestTrustInformation
*r
)
2384 p
->rng_fault_state
= True
;
2385 return NT_STATUS_NOT_IMPLEMENTED
;
2388 NTSTATUS
_lsa_LSARSETFORESTTRUSTINFORMATION(pipes_struct
*p
, struct lsa_LSARSETFORESTTRUSTINFORMATION
*r
)
2390 p
->rng_fault_state
= True
;
2391 return NT_STATUS_NOT_IMPLEMENTED
;
2394 NTSTATUS
_lsa_CREDRRENAME(pipes_struct
*p
, struct lsa_CREDRRENAME
*r
)
2396 p
->rng_fault_state
= True
;
2397 return NT_STATUS_NOT_IMPLEMENTED
;
2400 NTSTATUS
_lsa_LSAROPENPOLICYSCE(pipes_struct
*p
, struct lsa_LSAROPENPOLICYSCE
*r
)
2402 p
->rng_fault_state
= True
;
2403 return NT_STATUS_NOT_IMPLEMENTED
;
2406 NTSTATUS
_lsa_LSARADTREGISTERSECURITYEVENTSOURCE(pipes_struct
*p
, struct lsa_LSARADTREGISTERSECURITYEVENTSOURCE
*r
)
2408 p
->rng_fault_state
= True
;
2409 return NT_STATUS_NOT_IMPLEMENTED
;
2412 NTSTATUS
_lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE(pipes_struct
*p
, struct lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE
*r
)
2414 p
->rng_fault_state
= True
;
2415 return NT_STATUS_NOT_IMPLEMENTED
;
2418 NTSTATUS
_lsa_LSARADTREPORTSECURITYEVENT(pipes_struct
*p
, struct lsa_LSARADTREPORTSECURITYEVENT
*r
)
2420 p
->rng_fault_state
= True
;
2421 return NT_STATUS_NOT_IMPLEMENTED
;