?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Handle munged dial string. Patch from Aur?lien Degr?mont <adegremont@idealx.com>with...
[Samba/gebeck_regimport.git] / source3 / rpc_server / srv_samr_nt.c
blob446eff9045e3108dd3aa5f7dfe9e23c077223cc5
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Marc Jacobsen 1999,
8 * Copyright (C) Jeremy Allison 2001-2002,
9 * Copyright (C) Jean François Micouleau 1998-2001,
10 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002.
11 * Copyright (C) Gerald (Jerry) Carter 2003.
12 *
13 * This program is free software; you can redistribute it and/or modify
14 * it under the terms of the GNU General Public License as published by
15 * the Free Software Foundation; either version 2 of the License, or
16 * (at your option) any later version.
17 *
18 * This program is distributed in the hope that it will be useful,
19 * but WITHOUT ANY WARRANTY; without even the implied warranty of
20 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21 * GNU General Public License for more details.
22 *
23 * You should have received a copy of the GNU General Public License
24 * along with this program; if not, write to the Free Software
25 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 */
27
28 /*
29 * This is the implementation of the SAMR code.
30 */
31
32 #include "includes.h"
33
34 #undef DBGC_CLASS
35 #define DBGC_CLASS DBGC_RPC_SRV
36
37 extern DOM_SID global_sid_Builtin;
38
39 extern rid_name domain_group_rids[];
40 extern rid_name domain_alias_rids[];
41 extern rid_name builtin_alias_rids[];
42
43
44 typedef struct _disp_info {
45 BOOL user_dbloaded;
46 uint32 num_user_account;
47 SAM_ACCOUNT *disp_user_info;
48 BOOL group_dbloaded;
49 uint32 num_group_account;
50 DOMAIN_GRP *disp_group_info;
51 } DISP_INFO;
52
53 struct samr_info {
54 /* for use by the \PIPE\samr policy */
55 DOM_SID sid;
56 uint32 status; /* some sort of flag. best to record it. comes from opnum 0x39 */
57 uint32 acc_granted;
58 uint16 acb_mask;
59 BOOL all_machines;
60 DISP_INFO disp_info;
61
62 TALLOC_CTX *mem_ctx;
63 };
64
65 struct generic_mapping sam_generic_mapping = {GENERIC_RIGHTS_SAM_READ, GENERIC_RIGHTS_SAM_WRITE, GENERIC_RIGHTS_SAM_EXECUTE, GENERIC_RIGHTS_SAM_ALL_ACCESS};
66 struct generic_mapping dom_generic_mapping = {GENERIC_RIGHTS_DOMAIN_READ, GENERIC_RIGHTS_DOMAIN_WRITE, GENERIC_RIGHTS_DOMAIN_EXECUTE, GENERIC_RIGHTS_DOMAIN_ALL_ACCESS};
67 struct generic_mapping usr_generic_mapping = {GENERIC_RIGHTS_USER_READ, GENERIC_RIGHTS_USER_WRITE, GENERIC_RIGHTS_USER_EXECUTE, GENERIC_RIGHTS_USER_ALL_ACCESS};
68 struct generic_mapping grp_generic_mapping = {GENERIC_RIGHTS_GROUP_READ, GENERIC_RIGHTS_GROUP_WRITE, GENERIC_RIGHTS_GROUP_EXECUTE, GENERIC_RIGHTS_GROUP_ALL_ACCESS};
69 struct generic_mapping ali_generic_mapping = {GENERIC_RIGHTS_ALIAS_READ, GENERIC_RIGHTS_ALIAS_WRITE, GENERIC_RIGHTS_ALIAS_EXECUTE, GENERIC_RIGHTS_ALIAS_ALL_ACCESS};
70
71 static NTSTATUS samr_make_dom_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size);
72
73 /*******************************************************************
74 Checks if access to an object should be granted, and returns that
75 level of access for further checks.
76 ********************************************************************/
77
78 NTSTATUS access_check_samr_object(SEC_DESC *psd, NT_USER_TOKEN *nt_user_token, uint32 des_access,
79 uint32 *acc_granted, const char *debug)
80 {
81 NTSTATUS status = NT_STATUS_ACCESS_DENIED;
82
83 if (!se_access_check(psd, nt_user_token, des_access, acc_granted, &status)) {
84 *acc_granted = des_access;
85 if (geteuid() == sec_initial_uid()) {
86 DEBUG(4,("%s: ACCESS should be DENIED (requested: %#010x)\n",
87 debug, des_access));
88 DEBUGADD(4,("but overritten by euid == sec_initial_uid()\n"));
89 status = NT_STATUS_OK;
90 }
91 else {
92 DEBUG(2,("%s: ACCESS DENIED (requested: %#010x)\n",
93 debug, des_access));
94 }
95 }
96 return status;
97 }
98
99 /*******************************************************************
100 Checks if access to a function can be granted
101 ********************************************************************/
102
103 NTSTATUS access_check_samr_function(uint32 acc_granted, uint32 acc_required, const char *debug)
104 {
105 DEBUG(5,("%s: access check ((granted: %#010x; required: %#010x)\n",
106 debug, acc_granted, acc_required));
107 if ((acc_granted & acc_required) != acc_required) {
108 if (geteuid() == sec_initial_uid()) {
109 DEBUG(4,("%s: ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
110 debug, acc_granted, acc_required));
111 DEBUGADD(4,("but overwritten by euid == 0\n"));
112 return NT_STATUS_OK;
113 }
114 DEBUG(2,("%s: ACCESS DENIED (granted: %#010x; required: %#010x)\n",
115 debug, acc_granted, acc_required));
116 return NT_STATUS_ACCESS_DENIED;
117 }
118 return NT_STATUS_OK;
119 }
120
121
122 /*******************************************************************
123 Create a samr_info struct.
124 ********************************************************************/
125
126 static struct samr_info *get_samr_info_by_sid(DOM_SID *psid)
127 {
128 struct samr_info *info;
129 fstring sid_str;
130 TALLOC_CTX *mem_ctx;
131
132 if (psid) {
133 sid_to_string(sid_str, psid);
134 } else {
135 fstrcpy(sid_str,"(NULL)");
136 }
137
138 mem_ctx = talloc_init("samr_info for domain sid %s", sid_str);
139
140 if ((info = (struct samr_info *)talloc(mem_ctx, sizeof(struct samr_info))) == NULL)
141 return NULL;
142
143 ZERO_STRUCTP(info);
144 DEBUG(10,("get_samr_info_by_sid: created new info for sid %s\n", sid_str));
145 if (psid) {
146 sid_copy( &info->sid, psid);
147 } else {
148 DEBUG(10,("get_samr_info_by_sid: created new info for NULL sid.\n"));
149 }
150 info->mem_ctx = mem_ctx;
151 return info;
152 }
153
154 /*******************************************************************
155 Function to free the per handle data.
156 ********************************************************************/
157
158 static void free_samr_users(struct samr_info *info)
159 {
160 int i;
161
162 if (info->disp_info.user_dbloaded){
163 for (i=0; i<info->disp_info.num_user_account; i++) {
164 SAM_ACCOUNT *sam = &info->disp_info.disp_user_info[i];
165 /* Not really a free, actually a 'clear' */
166 pdb_free_sam(&sam);
167 }
168 }
169 info->disp_info.user_dbloaded=False;
170 info->disp_info.num_user_account=0;
171 }
172
173 /*******************************************************************
174 Function to free the per handle data.
175 ********************************************************************/
176
177 static void free_samr_db(struct samr_info *info)
178 {
179 /* Groups are talloced */
180
181 free_samr_users(info);
182
183 info->disp_info.group_dbloaded=False;
184 info->disp_info.num_group_account=0;
185 }
186
187 static void free_samr_info(void *ptr)
188 {
189 struct samr_info *info=(struct samr_info *) ptr;
190
191 free_samr_db(info);
192 talloc_destroy(info->mem_ctx);
193 }
194
195 /*******************************************************************
196 Ensure password info is never given out. Paranioa... JRA.
197 ********************************************************************/
198
199 static void samr_clear_sam_passwd(SAM_ACCOUNT *sam_pass)
200 {
201
202 if (!sam_pass)
203 return;
204
205 /* These now zero out the old password */
206
207 pdb_set_lanman_passwd(sam_pass, NULL, PDB_DEFAULT);
208 pdb_set_nt_passwd(sam_pass, NULL, PDB_DEFAULT);
209 }
210
211
212 static NTSTATUS load_sampwd_entries(struct samr_info *info, uint16 acb_mask, BOOL all_machines)
213 {
214 SAM_ACCOUNT *pwd = NULL;
215 SAM_ACCOUNT *pwd_array = NULL;
216 NTSTATUS nt_status = NT_STATUS_OK;
217 TALLOC_CTX *mem_ctx = info->mem_ctx;
218
219 DEBUG(10,("load_sampwd_entries\n"));
220
221 /* if the snapshoot is already loaded, return */
222 if ((info->disp_info.user_dbloaded==True)
223 && (info->acb_mask == acb_mask)
224 && (info->all_machines == all_machines)) {
225 DEBUG(10,("load_sampwd_entries: already in memory\n"));
226 return NT_STATUS_OK;
227 }
228
229 free_samr_users(info);
230
231 if (!pdb_setsampwent(False)) {
232 DEBUG(0, ("load_sampwd_entries: Unable to open passdb.\n"));
233 return NT_STATUS_ACCESS_DENIED;
234 }
235
236 for (; (NT_STATUS_IS_OK(nt_status = pdb_init_sam_talloc(mem_ctx, &pwd)))
237 && pdb_getsampwent(pwd) == True; pwd=NULL) {
238
239 if (all_machines) {
240 if (!((pdb_get_acct_ctrl(pwd) & ACB_WSTRUST)
241 || (pdb_get_acct_ctrl(pwd) & ACB_SVRTRUST))) {
242 DEBUG(5,("load_sampwd_entries: '%s' is not a machine account - ACB: %x - skipping\n", pdb_get_username(pwd), acb_mask));
243 pdb_free_sam(&pwd);
244 continue;
245 }
246 } else {
247 if (acb_mask != 0 && !(pdb_get_acct_ctrl(pwd) & acb_mask)) {
248 pdb_free_sam(&pwd);
249 DEBUG(5,(" acb_mask %x reject\n", acb_mask));
250 continue;
251 }
252 }
253
254 /* Realloc some memory for the array of ptr to the SAM_ACCOUNT structs */
255 if (info->disp_info.num_user_account % MAX_SAM_ENTRIES == 0) {
256
257 DEBUG(10,("load_sampwd_entries: allocating more memory\n"));
258 pwd_array=(SAM_ACCOUNT *)talloc_realloc(mem_ctx, info->disp_info.disp_user_info,
259 (info->disp_info.num_user_account+MAX_SAM_ENTRIES)*sizeof(SAM_ACCOUNT));
260
261 if (pwd_array==NULL)
262 return NT_STATUS_NO_MEMORY;
263
264 info->disp_info.disp_user_info=pwd_array;
265 }
266
267 /* Copy the SAM_ACCOUNT into the array */
268 info->disp_info.disp_user_info[info->disp_info.num_user_account]=*pwd;
269
270 DEBUG(10,("load_sampwd_entries: entry: %d\n", info->disp_info.num_user_account));
271
272 info->disp_info.num_user_account++;
273 }
274
275 pdb_endsampwent();
276
277 /* the snapshoot is in memory, we're ready to enumerate fast */
278
279 info->acb_mask = acb_mask;
280 info->all_machines = all_machines;
281 info->disp_info.user_dbloaded=True;
282
283 DEBUG(10,("load_sampwd_entries: done\n"));
284
285 return nt_status;
286 }
287
288 static NTSTATUS load_group_domain_entries(struct samr_info *info, DOM_SID *sid)
289 {
290 GROUP_MAP *map=NULL;
291 DOMAIN_GRP *grp_array = NULL;
292 uint32 group_entries = 0;
293 uint32 i;
294 TALLOC_CTX *mem_ctx = info->mem_ctx;
295
296 DEBUG(10,("load_group_domain_entries\n"));
297
298 /* if the snapshoot is already loaded, return */
299 if (info->disp_info.group_dbloaded==True) {
300 DEBUG(10,("load_group_domain_entries: already in memory\n"));
301 return NT_STATUS_OK;
302 }
303
304
305 become_root();
306
307 if (!pdb_enum_group_mapping(SID_NAME_DOM_GRP, &map, (int *)&group_entries, ENUM_ONLY_MAPPED)) {
308 DEBUG(1, ("load_group_domain_entries: pdb_enum_group_mapping() failed!\n"));
309 return NT_STATUS_NO_MEMORY;
310 }
311
312 unbecome_root();
313
314 info->disp_info.num_group_account=group_entries;
315
316 grp_array=(DOMAIN_GRP *)talloc(mem_ctx, info->disp_info.num_group_account*sizeof(DOMAIN_GRP));
317 if (group_entries!=0 && grp_array==NULL) {
318 DEBUG(1, ("load_group_domain_entries: talloc() failed for grp_array!\n"));
319 SAFE_FREE(map);
320 return NT_STATUS_NO_MEMORY;
321 }
322
323 info->disp_info.disp_group_info=grp_array;
324
325 for (i=0; i<group_entries; i++) {
326 fstrcpy(grp_array[i].name, map[i].nt_name);
327 fstrcpy(grp_array[i].comment, map[i].comment);
328 sid_split_rid(&map[i].sid, &grp_array[i].rid);
329 grp_array[i].attr=SID_NAME_DOM_GRP;
330 }
331
332 SAFE_FREE(map);
333
334 /* the snapshoot is in memory, we're ready to enumerate fast */
335
336 info->disp_info.group_dbloaded=True;
337
338 DEBUG(10,("load_group_domain_entries: done\n"));
339
340 return NT_STATUS_OK;
341 }
342
343
344 /*******************************************************************
345 _samr_close_hnd
346 ********************************************************************/
347
348 NTSTATUS _samr_close_hnd(pipes_struct *p, SAMR_Q_CLOSE_HND *q_u, SAMR_R_CLOSE_HND *r_u)
349 {
350 r_u->status = NT_STATUS_OK;
351
352 /* close the policy handle */
353 if (!close_policy_hnd(p, &q_u->pol))
354 return NT_STATUS_OBJECT_NAME_INVALID;
355
356 DEBUG(5,("samr_reply_close_hnd: %d\n", __LINE__));
357
358 return r_u->status;
359 }
360
361 /*******************************************************************
362 samr_reply_open_domain
363 ********************************************************************/
364
365 NTSTATUS _samr_open_domain(pipes_struct *p, SAMR_Q_OPEN_DOMAIN *q_u, SAMR_R_OPEN_DOMAIN *r_u)
366 {
367 struct samr_info *info;
368 SEC_DESC *psd = NULL;
369 uint32 acc_granted;
370 uint32 des_access = q_u->flags;
371 size_t sd_size;
372 NTSTATUS status;
373
374 r_u->status = NT_STATUS_OK;
375
376 /* find the connection policy handle. */
377 if (!find_policy_by_hnd(p, &q_u->pol, (void**)&info))
378 return NT_STATUS_INVALID_HANDLE;
379
380 if (!NT_STATUS_IS_OK(status = access_check_samr_function(info->acc_granted, SA_RIGHT_SAM_OPEN_DOMAIN,"_samr_open_domain"))) {
381 return status;
382 }
383
384 /*check if access can be granted as requested by client. */
385 samr_make_dom_obj_sd(p->mem_ctx, &psd, &sd_size);
386 se_map_generic(&des_access,&dom_generic_mapping);
387
388 if (!NT_STATUS_IS_OK(status =
389 access_check_samr_object(psd, p->pipe_user.nt_user_token,
390 des_access, &acc_granted, "_samr_open_domain"))) {
391 return status;
392 }
393
394 /* associate the domain SID with the (unique) handle. */
395 if ((info = get_samr_info_by_sid(&q_u->dom_sid.sid))==NULL)
396 return NT_STATUS_NO_MEMORY;
397 info->acc_granted = acc_granted;
398
399 /* get a (unique) handle. open a policy on it. */
400 if (!create_policy_hnd(p, &r_u->domain_pol, free_samr_info, (void *)info))
401 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
402
403 DEBUG(5,("samr_open_domain: %d\n", __LINE__));
404
405 return r_u->status;
406 }
407
408 /*******************************************************************
409 _samr_get_usrdom_pwinfo
410 ********************************************************************/
411
412 NTSTATUS _samr_get_usrdom_pwinfo(pipes_struct *p, SAMR_Q_GET_USRDOM_PWINFO *q_u, SAMR_R_GET_USRDOM_PWINFO *r_u)
413 {
414 struct samr_info *info = NULL;
415
416 r_u->status = NT_STATUS_OK;
417
418 /* find the policy handle. open a policy on it. */
419 if (!find_policy_by_hnd(p, &q_u->user_pol, (void **)&info))
420 return NT_STATUS_INVALID_HANDLE;
421
422 if (!sid_check_is_in_our_domain(&info->sid))
423 return NT_STATUS_OBJECT_TYPE_MISMATCH;
424
425 init_samr_r_get_usrdom_pwinfo(r_u, NT_STATUS_OK);
426
427 DEBUG(5,("_samr_get_usrdom_pwinfo: %d\n", __LINE__));
428
429 /*
430 * NT sometimes return NT_STATUS_ACCESS_DENIED
431 * I don't know yet why.
432 */
433
434 return r_u->status;
435 }
436
437 /*******************************************************************
438 samr_make_dom_obj_sd
439 ********************************************************************/
440
441 static NTSTATUS samr_make_dom_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size)
442 {
443 extern DOM_SID global_sid_World;
444 DOM_SID adm_sid;
445 DOM_SID act_sid;
446
447 SEC_ACE ace[3];
448 SEC_ACCESS mask;
449
450 SEC_ACL *psa = NULL;
451
452 sid_copy(&adm_sid, &global_sid_Builtin);
453 sid_append_rid(&adm_sid, BUILTIN_ALIAS_RID_ADMINS);
454
455 sid_copy(&act_sid, &global_sid_Builtin);
456 sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
457
458 /*basic access for every one*/
459 init_sec_access(&mask, GENERIC_RIGHTS_DOMAIN_EXECUTE | GENERIC_RIGHTS_DOMAIN_READ);
460 init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
461
462 /*full access for builtin aliases Administrators and Account Operators*/
463 init_sec_access(&mask, GENERIC_RIGHTS_DOMAIN_ALL_ACCESS);
464 init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
465 init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
466
467 if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
468 return NT_STATUS_NO_MEMORY;
469
470 if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, psa, sd_size)) == NULL)
471 return NT_STATUS_NO_MEMORY;
472
473 return NT_STATUS_OK;
474 }
475
476 /*******************************************************************
477 samr_make_usr_obj_sd
478 ********************************************************************/
479
480 static NTSTATUS samr_make_usr_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size, DOM_SID *usr_sid)
481 {
482 extern DOM_SID global_sid_World;
483 DOM_SID adm_sid;
484 DOM_SID act_sid;
485
486 SEC_ACE ace[4];
487 SEC_ACCESS mask;
488
489 SEC_ACL *psa = NULL;
490
491 sid_copy(&adm_sid, &global_sid_Builtin);
492 sid_append_rid(&adm_sid, BUILTIN_ALIAS_RID_ADMINS);
493
494 sid_copy(&act_sid, &global_sid_Builtin);
495 sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
496
497 /*basic access for every one*/
498 init_sec_access(&mask, GENERIC_RIGHTS_USER_EXECUTE | GENERIC_RIGHTS_USER_READ);
499 init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
500
501 /*full access for builtin aliases Administrators and Account Operators*/
502 init_sec_access(&mask, GENERIC_RIGHTS_USER_ALL_ACCESS);
503 init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
504 init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
505
506 /*extended access for the user*/
507 init_sec_access(&mask,READ_CONTROL_ACCESS | SA_RIGHT_USER_CHANGE_PASSWORD | SA_RIGHT_USER_SET_LOC_COM);
508 init_sec_ace(&ace[3], usr_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
509
510 if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 4, ace)) == NULL)
511 return NT_STATUS_NO_MEMORY;
512
513 if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, psa, sd_size)) == NULL)
514 return NT_STATUS_NO_MEMORY;
515
516 return NT_STATUS_OK;
517 }
518
519 /*******************************************************************
520 samr_make_grp_obj_sd
521 ********************************************************************/
522
523 static NTSTATUS samr_make_grp_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size)
524 {
525 extern DOM_SID global_sid_World;
526 DOM_SID adm_sid;
527 DOM_SID act_sid;
528
529 SEC_ACE ace[3];
530 SEC_ACCESS mask;
531
532 SEC_ACL *psa = NULL;
533
534 sid_copy(&adm_sid, &global_sid_Builtin);
535 sid_append_rid(&adm_sid, BUILTIN_ALIAS_RID_ADMINS);
536
537 sid_copy(&act_sid, &global_sid_Builtin);
538 sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
539
540 /*basic access for every one*/
541 init_sec_access(&mask, GENERIC_RIGHTS_GROUP_EXECUTE | GENERIC_RIGHTS_GROUP_READ);
542 init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
543
544 /*full access for builtin aliases Administrators and Account Operators*/
545 init_sec_access(&mask, GENERIC_RIGHTS_GROUP_ALL_ACCESS);
546 init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
547 init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
548
549 if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
550 return NT_STATUS_NO_MEMORY;
551
552 if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, psa, sd_size)) == NULL)
553 return NT_STATUS_NO_MEMORY;
554
555 return NT_STATUS_OK;
556 }
557
558 /*******************************************************************
559 samr_make_ali_obj_sd
560 ********************************************************************/
561
562 static NTSTATUS samr_make_ali_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size)
563 {
564 extern DOM_SID global_sid_World;
565 DOM_SID adm_sid;
566 DOM_SID act_sid;
567
568 SEC_ACE ace[3];
569 SEC_ACCESS mask;
570
571 SEC_ACL *psa = NULL;
572
573 sid_copy(&adm_sid, &global_sid_Builtin);
574 sid_append_rid(&adm_sid, BUILTIN_ALIAS_RID_ADMINS);
575
576 sid_copy(&act_sid, &global_sid_Builtin);
577 sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
578
579 /*basic access for every one*/
580 init_sec_access(&mask, GENERIC_RIGHTS_ALIAS_EXECUTE | GENERIC_RIGHTS_ALIAS_READ);
581 init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
582
583 /*full access for builtin aliases Administrators and Account Operators*/
584 init_sec_access(&mask, GENERIC_RIGHTS_ALIAS_ALL_ACCESS);
585 init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
586 init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
587
588 if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
589 return NT_STATUS_NO_MEMORY;
590
591 if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, psa, sd_size)) == NULL)
592 return NT_STATUS_NO_MEMORY;
593
594 return NT_STATUS_OK;
595 }
596
597 static BOOL get_lsa_policy_samr_sid(pipes_struct *p, POLICY_HND *pol, DOM_SID *sid, uint32 *acc_granted)
598 {
599 struct samr_info *info = NULL;
600
601 /* find the policy handle. open a policy on it. */
602 if (!find_policy_by_hnd(p, pol, (void **)&info))
603 return False;
604
605 if (!info)
606 return False;
607
608 *sid = info->sid;
609 *acc_granted = info->acc_granted;
610 return True;
611 }
612
613 /*******************************************************************
614 _samr_set_sec_obj
615 ********************************************************************/
616
617 NTSTATUS _samr_set_sec_obj(pipes_struct *p, SAMR_Q_SET_SEC_OBJ *q_u, SAMR_R_SET_SEC_OBJ *r_u)
618 {
619 DEBUG(0,("_samr_set_sec_obj: Not yet implemented!\n"));
620 return NT_STATUS_NOT_IMPLEMENTED;
621 }
622
623
624 /*******************************************************************
625 _samr_query_sec_obj
626 ********************************************************************/
627
628 NTSTATUS _samr_query_sec_obj(pipes_struct *p, SAMR_Q_QUERY_SEC_OBJ *q_u, SAMR_R_QUERY_SEC_OBJ *r_u)
629 {
630 DOM_SID pol_sid;
631 fstring str_sid;
632 SEC_DESC * psd = NULL;
633 size_t sd_size;
634 uint32 acc_granted;
635
636 r_u->status = NT_STATUS_OK;
637
638 /* Get the SID. */
639 if (!get_lsa_policy_samr_sid(p, &q_u->user_pol, &pol_sid, &acc_granted))
640 return NT_STATUS_INVALID_HANDLE;
641
642
643
644 DEBUG(10,("_samr_query_sec_obj: querying security on SID: %s\n", sid_to_string(str_sid, &pol_sid)));
645
646 /* Check what typ of SID is beeing queried (e.g Domain SID, User SID, Group SID) */
647
648 /* To query the security of the SAM it self an invalid SID with S-0-0 is passed to this function */
649 if (pol_sid.sid_rev_num == 0)
650 {
651 DEBUG(5,("_samr_query_sec_obj: querying security on SAM\n"));
652 r_u->status = samr_make_sam_obj_sd(p->mem_ctx, &psd, &sd_size);
653 }
654 else if (sid_equal(&pol_sid,get_global_sam_sid())) /* check if it is our domain SID */
655
656 {
657 DEBUG(5,("_samr_query_sec_obj: querying security on Domain with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
658 r_u->status = samr_make_dom_obj_sd(p->mem_ctx, &psd, &sd_size);
659 }
660 else if (sid_equal(&pol_sid,&global_sid_Builtin)) /* check if it is the Builtin Domain */
661 {
662 /* TODO: Builtin probably needs a different SD with restricted write access*/
663 DEBUG(5,("_samr_query_sec_obj: querying security on Builtin Domain with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
664 r_u->status = samr_make_dom_obj_sd(p->mem_ctx, &psd, &sd_size);
665 }
666 else if (sid_check_is_in_our_domain(&pol_sid) ||
667 sid_check_is_in_builtin(&pol_sid))
668 {
669 /* TODO: different SDs have to be generated for aliases groups and users.
670 Currently all three get a default user SD */
671 DEBUG(10,("_samr_query_sec_obj: querying security on Object with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
672 r_u->status = samr_make_usr_obj_sd(p->mem_ctx, &psd,&sd_size, &pol_sid);
673 }
674 else return NT_STATUS_OBJECT_TYPE_MISMATCH;
675
676 if ((r_u->buf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
677 return NT_STATUS_NO_MEMORY;
678
679 if (NT_STATUS_IS_OK(r_u->status))
680 r_u->ptr = 1;
681
682 return r_u->status;
683 }
684
685 /*******************************************************************
686 makes a SAM_ENTRY / UNISTR2* structure from a user list.
687 ********************************************************************/
688
689 static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp, UNISTR2 **uni_name_pp,
690 uint32 num_entries, uint32 start_idx, SAM_ACCOUNT *disp_user_info,
691 DOM_SID *domain_sid)
692 {
693 uint32 i;
694 SAM_ENTRY *sam;
695 UNISTR2 *uni_name;
696 SAM_ACCOUNT *pwd = NULL;
697 UNISTR2 uni_temp_name;
698 const char *temp_name;
699 const DOM_SID *user_sid;
700 uint32 user_rid;
701 fstring user_sid_string;
702 fstring domain_sid_string;
703
704 *sam_pp = NULL;
705 *uni_name_pp = NULL;
706
707 if (num_entries == 0)
708 return NT_STATUS_OK;
709
710 sam = (SAM_ENTRY *)talloc_zero(ctx, sizeof(SAM_ENTRY)*num_entries);
711
712 uni_name = (UNISTR2 *)talloc_zero(ctx, sizeof(UNISTR2)*num_entries);
713
714 if (sam == NULL || uni_name == NULL) {
715 DEBUG(0, ("make_user_sam_entry_list: talloc_zero failed!\n"));
716 return NT_STATUS_NO_MEMORY;
717 }
718
719 for (i = 0; i < num_entries; i++) {
720 pwd = &disp_user_info[i+start_idx];
721 temp_name = pdb_get_username(pwd);
722 init_unistr2(&uni_temp_name, temp_name, UNI_STR_TERMINATE);
723 user_sid = pdb_get_user_sid(pwd);
724
725 if (!sid_peek_check_rid(domain_sid, user_sid, &user_rid)) {
726 DEBUG(0, ("make_user_sam_entry_list: User %s has SID %s, which conflicts with "
727 "the domain sid %s. Failing operation.\n",
728 temp_name,
729 sid_to_string(user_sid_string, user_sid),
730 sid_to_string(domain_sid_string, domain_sid)));
731 return NT_STATUS_UNSUCCESSFUL;
732 }
733
734 init_sam_entry(&sam[i], &uni_temp_name, user_rid);
735 copy_unistr2(&uni_name[i], &uni_temp_name);
736 }
737
738 *sam_pp = sam;
739 *uni_name_pp = uni_name;
740 return NT_STATUS_OK;
741 }
742
743 /*******************************************************************
744 samr_reply_enum_dom_users
745 ********************************************************************/
746
747 NTSTATUS _samr_enum_dom_users(pipes_struct *p, SAMR_Q_ENUM_DOM_USERS *q_u,
748 SAMR_R_ENUM_DOM_USERS *r_u)
749 {
750 struct samr_info *info = NULL;
751 uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
752 int num_account;
753 uint32 enum_context=q_u->start_idx;
754 uint32 max_size=q_u->max_size;
755 uint32 temp_size;
756 enum remote_arch_types ra_type = get_remote_arch();
757 int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
758 uint32 max_entries = max_sam_entries;
759 DOM_SID domain_sid;
760
761 r_u->status = NT_STATUS_OK;
762
763 /* find the policy handle. open a policy on it. */
764 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
765 return NT_STATUS_INVALID_HANDLE;
766
767 domain_sid = info->sid;
768
769 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted,
770 SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
771 "_samr_enum_dom_users"))) {
772 return r_u->status;
773 }
774
775 DEBUG(5,("_samr_enum_dom_users: %d\n", __LINE__));
776
777 become_root();
778 r_u->status=load_sampwd_entries(info, q_u->acb_mask, False);
779 unbecome_root();
780
781 if (!NT_STATUS_IS_OK(r_u->status))
782 return r_u->status;
783
784 num_account = info->disp_info.num_user_account;
785
786 if (enum_context > num_account) {
787 DEBUG(5, ("_samr_enum_dom_users: enumeration handle over total entries\n"));
788 return NT_STATUS_OK;
789 }
790
791 /* verify we won't overflow */
792 if (max_entries > num_account-enum_context) {
793 max_entries = num_account-enum_context;
794 DEBUG(5, ("_samr_enum_dom_users: only %d entries to return\n", max_entries));
795 }
796
797 /* calculate the size and limit on the number of entries we will return */
798 temp_size=max_entries*struct_size;
799
800 if (temp_size>max_size) {
801 max_entries=MIN((max_size/struct_size),max_entries);;
802 DEBUG(5, ("_samr_enum_dom_users: buffer size limits to only %d entries\n", max_entries));
803 }
804
805 /*
806 * Note from JRA. total_entries is not being used here. Currently if there is a
807 * large user base then it looks like NT will enumerate until get_sampwd_entries
808 * returns False due to num_entries being zero. This will cause an access denied
809 * return. I don't think this is right and needs further investigation. Note that
810 * this is also the same in the TNG code (I don't think that has been tested with
811 * a very large user list as MAX_SAM_ENTRIES is set to 600).
812 *
813 * I also think that one of the 'num_entries' return parameters is probably
814 * the "max entries" parameter - but in the TNG code they're all currently set to the same
815 * value (again I think this is wrong).
816 */
817
818 r_u->status = make_user_sam_entry_list(p->mem_ctx, &r_u->sam, &r_u->uni_acct_name,
819 max_entries, enum_context,
820 info->disp_info.disp_user_info,
821 &domain_sid);
822
823 if (!NT_STATUS_IS_OK(r_u->status))
824 return r_u->status;
825
826 if (enum_context+max_entries < num_account)
827 r_u->status = STATUS_MORE_ENTRIES;
828
829 DEBUG(5, ("_samr_enum_dom_users: %d\n", __LINE__));
830
831 init_samr_r_enum_dom_users(r_u, q_u->start_idx + max_entries, max_entries);
832
833 DEBUG(5,("_samr_enum_dom_users: %d\n", __LINE__));
834
835 return r_u->status;
836 }
837
838 /*******************************************************************
839 makes a SAM_ENTRY / UNISTR2* structure from a group list.
840 ********************************************************************/
841
842 static void make_group_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp, UNISTR2 **uni_name_pp,
843 uint32 num_sam_entries, DOMAIN_GRP *grp)
844 {
845 uint32 i;
846 SAM_ENTRY *sam;
847 UNISTR2 *uni_name;
848
849 *sam_pp = NULL;
850 *uni_name_pp = NULL;
851
852 if (num_sam_entries == 0)
853 return;
854
855 sam = (SAM_ENTRY *)talloc_zero(ctx, sizeof(SAM_ENTRY)*num_sam_entries);
856
857 uni_name = (UNISTR2 *)talloc_zero(ctx, sizeof(UNISTR2)*num_sam_entries);
858
859 if (sam == NULL || uni_name == NULL) {
860 DEBUG(0, ("NULL pointers in SAMR_R_QUERY_DISPINFO\n"));
861 return;
862 }
863
864 for (i = 0; i < num_sam_entries; i++) {
865 /*
866 * JRA. I think this should include the null. TNG does not.
867 */
868 init_unistr2(&uni_name[i], grp[i].name, UNI_STR_TERMINATE);
869 init_sam_entry(&sam[i], &uni_name[i], grp[i].rid);
870 }
871
872 *sam_pp = sam;
873 *uni_name_pp = uni_name;
874 }
875
876 /*******************************************************************
877 Get the group entries - similar to get_sampwd_entries().
878 ********************************************************************/
879
880 static NTSTATUS get_group_alias_entries(TALLOC_CTX *ctx, DOMAIN_GRP **d_grp, DOM_SID *sid, uint32 start_idx,
881 uint32 *p_num_entries, uint32 max_entries)
882 {
883 fstring sid_str;
884 uint32 num_entries = 0;
885 int i;
886 GROUP_MAP smap;
887 GROUP_MAP *map = NULL;
888
889 sid_to_string(sid_str, sid);
890 DEBUG(5, ("get_group_alias_entries: enumerating aliases on SID: %s\n", sid_str));
891
892 *p_num_entries = 0;
893
894 /* well-known aliases */
895 if (sid_equal(sid, &global_sid_Builtin) && !lp_hide_local_users()) {
896
897 pdb_enum_group_mapping(SID_NAME_WKN_GRP, &map, (int *)&num_entries, ENUM_ONLY_MAPPED);
898
899 if (num_entries != 0) {
900 *d_grp=(DOMAIN_GRP *)talloc_zero(ctx, num_entries*sizeof(DOMAIN_GRP));
901 if (*d_grp==NULL)
902 return NT_STATUS_NO_MEMORY;
903
904 for(i=0; i<num_entries && i<max_entries; i++) {
905 fstrcpy((*d_grp)[i].name, map[i+start_idx].nt_name);
906 sid_split_rid(&map[i+start_idx].sid, &(*d_grp)[i].rid);
907
908 }
909 }
910 SAFE_FREE(map);
911
912 } else if (sid_equal(sid, get_global_sam_sid()) && !lp_hide_local_users()) {
913 struct sys_grent *glist;
914 struct sys_grent *grp;
915 gid_t winbind_gid_low, winbind_gid_high;
916 BOOL winbind_groups_exist = lp_idmap_gid(&winbind_gid_low, &winbind_gid_high);
917
918 /* local aliases */
919 /* we return the UNIX groups here. This seems to be the right */
920 /* thing to do, since NT member servers return their local */
921 /* groups in the same situation. */
922
923 /* use getgrent_list() to retrieve the list of groups to avoid
924 * problems with getgrent possible infinite loop by internal
925 * libc grent structures overwrites by called functions */
926 grp = glist = getgrent_list();
927 if (grp == NULL)
928 return NT_STATUS_NO_MEMORY;
929
930 for (; (num_entries < max_entries) && (grp != NULL); grp = grp->next) {
931 uint32 trid;
932
933 if(!pdb_getgrgid(&smap, grp->gr_gid))
934 continue;
935
936 if (smap.sid_name_use!=SID_NAME_ALIAS) {
937 continue;
938 }
939
940 sid_split_rid(&smap.sid, &trid);
941
942 if (!sid_equal(sid, &smap.sid))
943 continue;
944
945 /* Don't return winbind groups as they are not local! */
946 if (winbind_groups_exist && (grp->gr_gid >= winbind_gid_low)&&(grp->gr_gid <= winbind_gid_high)) {
947 DEBUG(10,("get_group_alias_entries: not returing %s, not local.\n", smap.nt_name ));
948 continue;
949 }
950
951 /* Don't return user private groups... */
952
953 if (Get_Pwnam(smap.nt_name) != 0) {
954 DEBUG(10,("get_group_alias_entries: not returing %s, clashes with user.\n", smap.nt_name ));
955 continue;
956 }
957
958 for( i = 0; i < num_entries; i++)
959 if ( (*d_grp)[i].rid == trid )
960 break;
961
962 if ( i < num_entries ) {
963 continue; /* rid was there, dup! */
964 }
965
966 /* JRA - added this for large group db enumeration... */
967
968 if (start_idx > 0) {
969 /* skip the requested number of entries.
970 not very efficient, but hey...
971 */
972 start_idx--;
973 continue;
974 }
975
976 *d_grp=talloc_realloc(ctx,*d_grp, (num_entries+1)*sizeof(DOMAIN_GRP));
977 if (*d_grp==NULL) {
978 grent_free(glist);
979 return NT_STATUS_NO_MEMORY;
980 }
981
982 fstrcpy((*d_grp)[num_entries].name, smap.nt_name);
983 (*d_grp)[num_entries].rid = trid;
984 num_entries++;
985 DEBUG(10,("get_group_alias_entries: added entry %d, rid:%d\n", num_entries, trid));
986 }
987
988 grent_free(glist);
989 }
990
991 *p_num_entries = num_entries;
992
993 DEBUG(10,("get_group_alias_entries: returning %d entries\n", *p_num_entries));
994
995 if (num_entries >= max_entries)
996 return STATUS_MORE_ENTRIES;
997 return NT_STATUS_OK;
998 }
999
1000 /*******************************************************************
1001 Get the group entries - similar to get_sampwd_entries().
1002 ********************************************************************/
1003
1004 static NTSTATUS get_group_domain_entries(TALLOC_CTX *ctx, DOMAIN_GRP **d_grp, DOM_SID *sid, uint32 start_idx,
1005 uint32 *p_num_entries, uint32 max_entries)
1006 {
1007 GROUP_MAP *map=NULL;
1008 int i;
1009 uint32 group_entries = 0;
1010 uint32 num_entries = 0;
1011
1012 *p_num_entries = 0;
1013
1014 /* access checks for the users were performed higher up. become/unbecome_root()
1015 needed for some passdb backends to enumerate groups */
1016
1017 become_root();
1018 pdb_enum_group_mapping(SID_NAME_DOM_GRP, &map, (int *)&group_entries, ENUM_ONLY_MAPPED);
1019 unbecome_root();
1020
1021 num_entries=group_entries-start_idx;
1022
1023 /* limit the number of entries */
1024 if (num_entries>max_entries) {
1025 DEBUG(5,("Limiting to %d entries\n", max_entries));
1026 num_entries=max_entries;
1027 }
1028
1029 *d_grp=(DOMAIN_GRP *)talloc_zero(ctx, num_entries*sizeof(DOMAIN_GRP));
1030 if (num_entries!=0 && *d_grp==NULL){
1031 SAFE_FREE(map);
1032 return NT_STATUS_NO_MEMORY;
1033 }
1034
1035 for (i=0; i<num_entries; i++) {
1036 fstrcpy((*d_grp)[i].name, map[i+start_idx].nt_name);
1037 fstrcpy((*d_grp)[i].comment, map[i+start_idx].comment);
1038 sid_split_rid(&map[i+start_idx].sid, &(*d_grp)[i].rid);
1039 (*d_grp)[i].attr=SID_NAME_DOM_GRP;
1040 }
1041
1042 SAFE_FREE(map);
1043
1044 *p_num_entries = num_entries;
1045
1046 return NT_STATUS_OK;
1047 }
1048
1049 /*******************************************************************
1050 samr_reply_enum_dom_groups
1051 ********************************************************************/
1052
1053 NTSTATUS _samr_enum_dom_groups(pipes_struct *p, SAMR_Q_ENUM_DOM_GROUPS *q_u, SAMR_R_ENUM_DOM_GROUPS *r_u)
1054 {
1055 DOMAIN_GRP *grp=NULL;
1056 uint32 num_entries;
1057 DOM_SID sid;
1058 uint32 acc_granted;
1059
1060 r_u->status = NT_STATUS_OK;
1061
1062 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
1063 return NT_STATUS_INVALID_HANDLE;
1064
1065 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_ENUM_ACCOUNTS, "_samr_enum_dom_groups"))) {
1066 return r_u->status;
1067 }
1068
1069 DEBUG(5,("samr_reply_enum_dom_groups: %d\n", __LINE__));
1070
1071 /* the domain group array is being allocated in the function below */
1072 if (!NT_STATUS_IS_OK(r_u->status = get_group_domain_entries(p->mem_ctx, &grp, &sid, q_u->start_idx, &num_entries, MAX_SAM_ENTRIES))) {
1073 return r_u->status;
1074 }
1075
1076 make_group_sam_entry_list(p->mem_ctx, &r_u->sam, &r_u->uni_grp_name, num_entries, grp);
1077
1078 init_samr_r_enum_dom_groups(r_u, q_u->start_idx, num_entries);
1079
1080 DEBUG(5,("samr_enum_dom_groups: %d\n", __LINE__));
1081
1082 return r_u->status;
1083 }
1084
1085
1086 /*******************************************************************
1087 samr_reply_enum_dom_aliases
1088 ********************************************************************/
1089
1090 NTSTATUS _samr_enum_dom_aliases(pipes_struct *p, SAMR_Q_ENUM_DOM_ALIASES *q_u, SAMR_R_ENUM_DOM_ALIASES *r_u)
1091 {
1092 DOMAIN_GRP *grp=NULL;
1093 uint32 num_entries = 0;
1094 fstring sid_str;
1095 DOM_SID sid;
1096 NTSTATUS status;
1097 uint32 acc_granted;
1098
1099 r_u->status = NT_STATUS_OK;
1100
1101 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
1102 return NT_STATUS_INVALID_HANDLE;
1103
1104 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_ENUM_ACCOUNTS, "_samr_enum_dom_aliases"))) {
1105 return r_u->status;
1106 }
1107
1108 sid_to_string(sid_str, &sid);
1109 DEBUG(5,("samr_reply_enum_dom_aliases: sid %s\n", sid_str));
1110
1111 status = get_group_alias_entries(p->mem_ctx, &grp, &sid, q_u->start_idx,
1112 &num_entries, MAX_SAM_ENTRIES);
1113 if (NT_STATUS_IS_ERR(status)) return status;
1114
1115 make_group_sam_entry_list(p->mem_ctx, &r_u->sam, &r_u->uni_grp_name, num_entries, grp);
1116
1117 /*safe_free(grp);*/
1118
1119 init_samr_r_enum_dom_aliases(r_u, q_u->start_idx + num_entries, num_entries);
1120
1121 DEBUG(5,("samr_enum_dom_aliases: %d\n", __LINE__));
1122
1123 return r_u->status;
1124 }
1125
1126 /*******************************************************************
1127 samr_reply_query_dispinfo
1128 ********************************************************************/
1129
1130 NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u,
1131 SAMR_R_QUERY_DISPINFO *r_u)
1132 {
1133 struct samr_info *info = NULL;
1134 uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
1135
1136 uint32 max_entries=q_u->max_entries;
1137 uint32 enum_context=q_u->start_idx;
1138 uint32 max_size=q_u->max_size;
1139
1140 SAM_DISPINFO_CTR *ctr;
1141 uint32 temp_size=0, total_data_size=0;
1142 NTSTATUS disp_ret;
1143 uint32 num_account = 0;
1144 enum remote_arch_types ra_type = get_remote_arch();
1145 int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
1146 DOM_SID domain_sid;
1147
1148 DEBUG(5, ("samr_reply_query_dispinfo: %d\n", __LINE__));
1149 r_u->status = NT_STATUS_OK;
1150
1151 /* find the policy handle. open a policy on it. */
1152 if (!find_policy_by_hnd(p, &q_u->domain_pol, (void **)&info))
1153 return NT_STATUS_INVALID_HANDLE;
1154
1155 domain_sid = info->sid;
1156
1157 /*
1158 * calculate how many entries we will return.
1159 * based on
1160 * - the number of entries the client asked
1161 * - our limit on that
1162 * - the starting point (enumeration context)
1163 * - the buffer size the client will accept
1164 */
1165
1166 /*
1167 * We are a lot more like W2K. Instead of reading the SAM
1168 * each time to find the records we need to send back,
1169 * we read it once and link that copy to the sam handle.
1170 * For large user list (over the MAX_SAM_ENTRIES)
1171 * it's a definitive win.
1172 * second point to notice: between enumerations
1173 * our sam is now the same as it's a snapshoot.
1174 * third point: got rid of the static SAM_USER_21 struct
1175 * no more intermediate.
1176 * con: it uses much more memory, as a full copy is stored
1177 * in memory.
1178 *
1179 * If you want to change it, think twice and think
1180 * of the second point , that's really important.
1181 *
1182 * JFM, 12/20/2001
1183 */
1184
1185 /* Get what we need from the password database */
1186 switch (q_u->switch_level) {
1187 case 0x1:
1188 /* When playing with usrmgr, this is necessary
1189 if you want immediate refresh after editing
1190 a user. I would like to do this after the
1191 setuserinfo2, but we do not have access to
1192 the domain handle in that call, only to the
1193 user handle. Where else does this hurt?
1194 -- Volker
1195 */
1196 #if 0
1197 /* We cannot do this here - it kills performace. JRA. */
1198 free_samr_users(info);
1199 #endif
1200 case 0x2:
1201 case 0x4:
1202 become_root();
1203 /* Level 2 is for all machines, otherwise only 'normal' users */
1204 r_u->status=load_sampwd_entries(info, ACB_NORMAL, q_u->switch_level==2);
1205 unbecome_root();
1206 if (!NT_STATUS_IS_OK(r_u->status)) {
1207 DEBUG(5, ("_samr_query_dispinfo: load_sampwd_entries failed\n"));
1208 return r_u->status;
1209 }
1210 num_account = info->disp_info.num_user_account;
1211 break;
1212 case 0x3:
1213 case 0x5:
1214 r_u->status = load_group_domain_entries(info, &info->sid);
1215 if (!NT_STATUS_IS_OK(r_u->status))
1216 return r_u->status;
1217 num_account = info->disp_info.num_group_account;
1218 break;
1219 default:
1220 DEBUG(0,("_samr_query_dispinfo: Unknown info level (%u)\n", (unsigned int)q_u->switch_level ));
1221 return NT_STATUS_INVALID_INFO_CLASS;
1222 }
1223
1224 /* first limit the number of entries we will return */
1225 if(max_entries > max_sam_entries) {
1226 DEBUG(5, ("samr_reply_query_dispinfo: client requested %d entries, limiting to %d\n", max_entries, max_sam_entries));
1227 max_entries = max_sam_entries;
1228 }
1229
1230 if (enum_context > num_account) {
1231 DEBUG(5, ("samr_reply_query_dispinfo: enumeration handle over total entries\n"));
1232 return NT_STATUS_NO_MORE_ENTRIES;
1233 }
1234
1235 /* verify we won't overflow */
1236 if (max_entries > num_account-enum_context) {
1237 max_entries = num_account-enum_context;
1238 DEBUG(5, ("samr_reply_query_dispinfo: only %d entries to return\n", max_entries));
1239 }
1240
1241 /* calculate the size and limit on the number of entries we will return */
1242 temp_size=max_entries*struct_size;
1243
1244 if (temp_size>max_size) {
1245 max_entries=MIN((max_size/struct_size),max_entries);;
1246 DEBUG(5, ("samr_reply_query_dispinfo: buffer size limits to only %d entries\n", max_entries));
1247 }
1248
1249 if (!(ctr = (SAM_DISPINFO_CTR *)talloc_zero(p->mem_ctx,sizeof(SAM_DISPINFO_CTR))))
1250 return NT_STATUS_NO_MEMORY;
1251
1252 ZERO_STRUCTP(ctr);
1253
1254 /* Now create reply structure */
1255 switch (q_u->switch_level) {
1256 case 0x1:
1257 if (max_entries) {
1258 if (!(ctr->sam.info1 = (SAM_DISPINFO_1 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_1))))
1259 return NT_STATUS_NO_MEMORY;
1260 }
1261 disp_ret = init_sam_dispinfo_1(p->mem_ctx, ctr->sam.info1, max_entries, enum_context,
1262 info->disp_info.disp_user_info, &domain_sid);
1263 if (!NT_STATUS_IS_OK(disp_ret))
1264 return disp_ret;
1265 break;
1266 case 0x2:
1267 if (max_entries) {
1268 if (!(ctr->sam.info2 = (SAM_DISPINFO_2 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_2))))
1269 return NT_STATUS_NO_MEMORY;
1270 }
1271 disp_ret = init_sam_dispinfo_2(p->mem_ctx, ctr->sam.info2, max_entries, enum_context,
1272 info->disp_info.disp_user_info, &domain_sid);
1273 if (!NT_STATUS_IS_OK(disp_ret))
1274 return disp_ret;
1275 break;
1276 case 0x3:
1277 if (max_entries) {
1278 if (!(ctr->sam.info3 = (SAM_DISPINFO_3 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_3))))
1279 return NT_STATUS_NO_MEMORY;
1280 }
1281 disp_ret = init_sam_dispinfo_3(p->mem_ctx, ctr->sam.info3, max_entries, enum_context, info->disp_info.disp_group_info);
1282 if (!NT_STATUS_IS_OK(disp_ret))
1283 return disp_ret;
1284 break;
1285 case 0x4:
1286 if (max_entries) {
1287 if (!(ctr->sam.info4 = (SAM_DISPINFO_4 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_4))))
1288 return NT_STATUS_NO_MEMORY;
1289 }
1290 disp_ret = init_sam_dispinfo_4(p->mem_ctx, ctr->sam.info4, max_entries, enum_context, info->disp_info.disp_user_info);
1291 if (!NT_STATUS_IS_OK(disp_ret))
1292 return disp_ret;
1293 break;
1294 case 0x5:
1295 if (max_entries) {
1296 if (!(ctr->sam.info5 = (SAM_DISPINFO_5 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_5))))
1297 return NT_STATUS_NO_MEMORY;
1298 }
1299 disp_ret = init_sam_dispinfo_5(p->mem_ctx, ctr->sam.info5, max_entries, enum_context, info->disp_info.disp_group_info);
1300 if (!NT_STATUS_IS_OK(disp_ret))
1301 return disp_ret;
1302 break;
1303
1304 default:
1305 ctr->sam.info = NULL;
1306 return NT_STATUS_INVALID_INFO_CLASS;
1307 }
1308
1309 /* calculate the total size */
1310 total_data_size=num_account*struct_size;
1311
1312 if (enum_context+max_entries < num_account)
1313 r_u->status = STATUS_MORE_ENTRIES;
1314
1315 DEBUG(5, ("_samr_query_dispinfo: %d\n", __LINE__));
1316
1317 init_samr_r_query_dispinfo(r_u, max_entries, total_data_size, temp_size, q_u->switch_level, ctr, r_u->status);
1318
1319 return r_u->status;
1320
1321 }
1322
1323 /*******************************************************************
1324 samr_reply_query_aliasinfo
1325 ********************************************************************/
1326
1327 NTSTATUS _samr_query_aliasinfo(pipes_struct *p, SAMR_Q_QUERY_ALIASINFO *q_u, SAMR_R_QUERY_ALIASINFO *r_u)
1328 {
1329 DOM_SID sid;
1330 GROUP_MAP map;
1331 uint32 acc_granted;
1332
1333 r_u->status = NT_STATUS_OK;
1334
1335 DEBUG(5,("_samr_query_aliasinfo: %d\n", __LINE__));
1336
1337 /* find the policy handle. open a policy on it. */
1338 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
1339 return NT_STATUS_INVALID_HANDLE;
1340 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_LOOKUP_INFO, "_samr_query_aliasinfo"))) {
1341 return r_u->status;
1342 }
1343
1344 if (!sid_check_is_in_our_domain(&sid) &&
1345 !sid_check_is_in_builtin(&sid))
1346 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1347
1348 if (!pdb_getgrsid(&map, sid))
1349 return NT_STATUS_NO_SUCH_ALIAS;
1350
1351 switch (q_u->switch_level) {
1352 case 1:
1353 r_u->ptr = 1;
1354 r_u->ctr.switch_value1 = 1;
1355 init_samr_alias_info1(&r_u->ctr.alias.info1, map.nt_name, 1, map.comment);
1356 break;
1357 case 3:
1358 r_u->ptr = 1;
1359 r_u->ctr.switch_value1 = 3;
1360 init_samr_alias_info3(&r_u->ctr.alias.info3, map.comment);
1361 break;
1362 default:
1363 return NT_STATUS_INVALID_INFO_CLASS;
1364 }
1365
1366 DEBUG(5,("_samr_query_aliasinfo: %d\n", __LINE__));
1367
1368 return r_u->status;
1369 }
1370
1371 #if 0
1372 /*******************************************************************
1373 samr_reply_lookup_ids
1374 ********************************************************************/
1375
1376 uint32 _samr_lookup_ids(pipes_struct *p, SAMR_Q_LOOKUP_IDS *q_u, SAMR_R_LOOKUP_IDS *r_u)
1377 {
1378 uint32 rid[MAX_SAM_ENTRIES];
1379 int num_rids = q_u->num_sids1;
1380
1381 r_u->status = NT_STATUS_OK;
1382
1383 DEBUG(5,("_samr_lookup_ids: %d\n", __LINE__));
1384
1385 if (num_rids > MAX_SAM_ENTRIES) {
1386 num_rids = MAX_SAM_ENTRIES;
1387 DEBUG(5,("_samr_lookup_ids: truncating entries to %d\n", num_rids));
1388 }
1389
1390 #if 0
1391 int i;
1392 SMB_ASSERT_ARRAY(q_u->uni_user_name, num_rids);
1393
1394 for (i = 0; i < num_rids && status == 0; i++)
1395 {
1396 struct sam_passwd *sam_pass;
1397 fstring user_name;
1398
1399
1400 fstrcpy(user_name, unistrn2(q_u->uni_user_name[i].buffer,
1401 q_u->uni_user_name[i].uni_str_len));
1402
1403 /* find the user account */
1404 become_root();
1405 sam_pass = get_smb21pwd_entry(user_name, 0);
1406 unbecome_root();
1407
1408 if (sam_pass == NULL)
1409 {
1410 status = 0xC0000000 | NT_STATUS_NO_SUCH_USER;
1411 rid[i] = 0;
1412 }
1413 else
1414 {
1415 rid[i] = sam_pass->user_rid;
1416 }
1417 }
1418 #endif
1419
1420 num_rids = 1;
1421 rid[0] = BUILTIN_ALIAS_RID_USERS;
1422
1423 init_samr_r_lookup_ids(&r_u, num_rids, rid, NT_STATUS_OK);
1424
1425 DEBUG(5,("_samr_lookup_ids: %d\n", __LINE__));
1426
1427 return r_u->status;
1428 }
1429 #endif
1430
1431 /*******************************************************************
1432 _samr_lookup_names
1433 ********************************************************************/
1434
1435 NTSTATUS _samr_lookup_names(pipes_struct *p, SAMR_Q_LOOKUP_NAMES *q_u, SAMR_R_LOOKUP_NAMES *r_u)
1436 {
1437 uint32 rid[MAX_SAM_ENTRIES];
1438 uint32 local_rid;
1439 enum SID_NAME_USE type[MAX_SAM_ENTRIES];
1440 enum SID_NAME_USE local_type;
1441 int i;
1442 int num_rids = q_u->num_names2;
1443 DOM_SID pol_sid;
1444 fstring sid_str;
1445 uint32 acc_granted;
1446
1447 r_u->status = NT_STATUS_OK;
1448
1449 DEBUG(5,("_samr_lookup_names: %d\n", __LINE__));
1450
1451 ZERO_ARRAY(rid);
1452 ZERO_ARRAY(type);
1453
1454 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &pol_sid, &acc_granted)) {
1455 init_samr_r_lookup_names(p->mem_ctx, r_u, 0, NULL, NULL, NT_STATUS_OBJECT_TYPE_MISMATCH);
1456 return r_u->status;
1457 }
1458
1459 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, 0, "_samr_lookup_names"))) { /* Don't know the acc_bits yet */
1460 return r_u->status;
1461 }
1462
1463 if (num_rids > MAX_SAM_ENTRIES) {
1464 num_rids = MAX_SAM_ENTRIES;
1465 DEBUG(5,("_samr_lookup_names: truncating entries to %d\n", num_rids));
1466 }
1467
1468 DEBUG(5,("_samr_lookup_names: looking name on SID %s\n", sid_to_string(sid_str, &pol_sid)));
1469
1470 become_root(); /* local_lookup_name can require root privs */
1471
1472 for (i = 0; i < num_rids; i++) {
1473 fstring name;
1474 DOM_SID sid;
1475 int ret;
1476
1477 r_u->status = NT_STATUS_NONE_MAPPED;
1478
1479 rid [i] = 0xffffffff;
1480 type[i] = SID_NAME_UNKNOWN;
1481
1482 ret = rpcstr_pull(name, q_u->uni_name[i].buffer, sizeof(name), q_u->uni_name[i].uni_str_len*2, 0);
1483
1484 /*
1485 * we are only looking for a name
1486 * the SID we get back can be outside
1487 * the scope of the pol_sid
1488 *
1489 * in clear: it prevents to reply to domain\group: yes
1490 * when only builtin\group exists.
1491 *
1492 * a cleaner code is to add the sid of the domain we're looking in
1493 * to the local_lookup_name function.
1494 */
1495
1496 if ((ret > 0) && local_lookup_name(name, &sid, &local_type)) {
1497 sid_split_rid(&sid, &local_rid);
1498
1499 if (sid_equal(&sid, &pol_sid)) {
1500 rid[i]=local_rid;
1501 type[i]=local_type;
1502 r_u->status = NT_STATUS_OK;
1503 }
1504 }
1505 }
1506
1507 unbecome_root();
1508
1509 init_samr_r_lookup_names(p->mem_ctx, r_u, num_rids, rid, (uint32 *)type, r_u->status);
1510
1511 DEBUG(5,("_samr_lookup_names: %d\n", __LINE__));
1512
1513 return r_u->status;
1514 }
1515
1516 /*******************************************************************
1517 _samr_chgpasswd_user
1518 ********************************************************************/
1519
1520 NTSTATUS _samr_chgpasswd_user(pipes_struct *p, SAMR_Q_CHGPASSWD_USER *q_u, SAMR_R_CHGPASSWD_USER *r_u)
1521 {
1522 fstring user_name;
1523 fstring wks;
1524
1525 DEBUG(5,("_samr_chgpasswd_user: %d\n", __LINE__));
1526
1527 r_u->status = NT_STATUS_OK;
1528
1529 rpcstr_pull(user_name, q_u->uni_user_name.buffer, sizeof(user_name), q_u->uni_user_name.uni_str_len*2, 0);
1530 rpcstr_pull(wks, q_u->uni_dest_host.buffer, sizeof(wks), q_u->uni_dest_host.uni_str_len*2,0);
1531
1532 DEBUG(5,("samr_chgpasswd_user: user: %s wks: %s\n", user_name, wks));
1533
1534 /*
1535 * Pass the user through the NT -> unix user mapping
1536 * function.
1537 */
1538
1539 (void)map_username(user_name);
1540
1541 /*
1542 * UNIX username case mangling not required, pass_oem_change
1543 * is case insensitive.
1544 */
1545
1546 r_u->status = pass_oem_change(user_name, q_u->lm_newpass.pass, q_u->lm_oldhash.hash,
1547 q_u->nt_newpass.pass, q_u->nt_oldhash.hash);
1548
1549 init_samr_r_chgpasswd_user(r_u, r_u->status);
1550
1551 DEBUG(5,("_samr_chgpasswd_user: %d\n", __LINE__));
1552
1553 return r_u->status;
1554 }
1555
1556 /*******************************************************************
1557 makes a SAMR_R_LOOKUP_RIDS structure.
1558 ********************************************************************/
1559
1560 static BOOL make_samr_lookup_rids(TALLOC_CTX *ctx, uint32 num_names, fstring names[],
1561 UNIHDR **pp_hdr_name, UNISTR2 **pp_uni_name)
1562 {
1563 uint32 i;
1564 UNIHDR *hdr_name=NULL;
1565 UNISTR2 *uni_name=NULL;
1566
1567 *pp_uni_name = NULL;
1568 *pp_hdr_name = NULL;
1569
1570 if (num_names != 0) {
1571 hdr_name = (UNIHDR *)talloc_zero(ctx, sizeof(UNIHDR)*num_names);
1572 if (hdr_name == NULL)
1573 return False;
1574
1575 uni_name = (UNISTR2 *)talloc_zero(ctx,sizeof(UNISTR2)*num_names);
1576 if (uni_name == NULL)
1577 return False;
1578 }
1579
1580 for (i = 0; i < num_names; i++) {
1581 DEBUG(10, ("names[%d]:%s\n", i, names[i] ? names[i] : ""));
1582 init_unistr2(&uni_name[i], names[i], UNI_FLAGS_NONE);
1583 init_uni_hdr(&hdr_name[i], &uni_name[i]);
1584 }
1585
1586 *pp_uni_name = uni_name;
1587 *pp_hdr_name = hdr_name;
1588
1589 return True;
1590 }
1591
1592 /*******************************************************************
1593 _samr_lookup_rids
1594 ********************************************************************/
1595
1596 NTSTATUS _samr_lookup_rids(pipes_struct *p, SAMR_Q_LOOKUP_RIDS *q_u, SAMR_R_LOOKUP_RIDS *r_u)
1597 {
1598 fstring group_names[MAX_SAM_ENTRIES];
1599 uint32 *group_attrs = NULL;
1600 UNIHDR *hdr_name = NULL;
1601 UNISTR2 *uni_name = NULL;
1602 DOM_SID pol_sid;
1603 int num_rids = q_u->num_rids1;
1604 int i;
1605 uint32 acc_granted;
1606
1607 r_u->status = NT_STATUS_OK;
1608
1609 DEBUG(5,("_samr_lookup_rids: %d\n", __LINE__));
1610
1611 /* find the policy handle. open a policy on it. */
1612 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &pol_sid, &acc_granted))
1613 return NT_STATUS_INVALID_HANDLE;
1614
1615 if (num_rids > MAX_SAM_ENTRIES) {
1616 num_rids = MAX_SAM_ENTRIES;
1617 DEBUG(5,("_samr_lookup_rids: truncating entries to %d\n", num_rids));
1618 }
1619
1620 if (num_rids) {
1621 if ((group_attrs = (uint32 *)talloc_zero(p->mem_ctx, num_rids * sizeof(uint32))) == NULL)
1622 return NT_STATUS_NO_MEMORY;
1623 }
1624
1625 r_u->status = NT_STATUS_NONE_MAPPED;
1626
1627 become_root(); /* lookup_sid can require root privs */
1628
1629 for (i = 0; i < num_rids; i++) {
1630 fstring tmpname;
1631 fstring domname;
1632 DOM_SID sid;
1633 enum SID_NAME_USE type;
1634
1635 group_attrs[i] = SID_NAME_UNKNOWN;
1636 *group_names[i] = '\0';
1637
1638 if (sid_equal(&pol_sid, get_global_sam_sid())) {
1639 sid_copy(&sid, &pol_sid);
1640 sid_append_rid(&sid, q_u->rid[i]);
1641
1642 if (lookup_sid(&sid, domname, tmpname, &type)) {
1643 r_u->status = NT_STATUS_OK;
1644 group_attrs[i] = (uint32)type;
1645 fstrcpy(group_names[i],tmpname);
1646 DEBUG(5,("_samr_lookup_rids: %s:%d\n", group_names[i], group_attrs[i]));
1647 }
1648 }
1649 }
1650
1651 unbecome_root();
1652
1653 if(!make_samr_lookup_rids(p->mem_ctx, num_rids, group_names, &hdr_name, &uni_name))
1654 return NT_STATUS_NO_MEMORY;
1655
1656 init_samr_r_lookup_rids(r_u, num_rids, hdr_name, uni_name, group_attrs);
1657
1658 DEBUG(5,("_samr_lookup_rids: %d\n", __LINE__));
1659
1660 return r_u->status;
1661 }
1662
1663 /*******************************************************************
1664 _samr_open_user. Safe - gives out no passwd info.
1665 ********************************************************************/
1666
1667 NTSTATUS _samr_open_user(pipes_struct *p, SAMR_Q_OPEN_USER *q_u, SAMR_R_OPEN_USER *r_u)
1668 {
1669 SAM_ACCOUNT *sampass=NULL;
1670 DOM_SID sid;
1671 POLICY_HND domain_pol = q_u->domain_pol;
1672 POLICY_HND *user_pol = &r_u->user_pol;
1673 struct samr_info *info = NULL;
1674 SEC_DESC *psd = NULL;
1675 uint32 acc_granted;
1676 uint32 des_access = q_u->access_mask;
1677 size_t sd_size;
1678 BOOL ret;
1679 NTSTATUS nt_status;
1680
1681 r_u->status = NT_STATUS_OK;
1682
1683 /* find the domain policy handle and get domain SID / access bits in the domain policy. */
1684 if (!get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted))
1685 return NT_STATUS_INVALID_HANDLE;
1686
1687 if (!NT_STATUS_IS_OK(nt_status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_open_user"))) {
1688 return nt_status;
1689 }
1690
1691 nt_status = pdb_init_sam_talloc(p->mem_ctx, &sampass);
1692 if (!NT_STATUS_IS_OK(nt_status)) {
1693 return nt_status;
1694 }
1695
1696 /* append the user's RID to it */
1697 if (!sid_append_rid(&sid, q_u->user_rid))
1698 return NT_STATUS_NO_SUCH_USER;
1699
1700 /* check if access can be granted as requested by client. */
1701 samr_make_usr_obj_sd(p->mem_ctx, &psd, &sd_size, &sid);
1702 se_map_generic(&des_access, &usr_generic_mapping);
1703 if (!NT_STATUS_IS_OK(nt_status =
1704 access_check_samr_object(psd, p->pipe_user.nt_user_token,
1705 des_access, &acc_granted, "_samr_open_user"))) {
1706 return nt_status;
1707 }
1708
1709 become_root();
1710 ret=pdb_getsampwsid(sampass, &sid);
1711 unbecome_root();
1712
1713 /* check that the SID exists in our domain. */
1714 if (ret == False) {
1715 return NT_STATUS_NO_SUCH_USER;
1716 }
1717
1718 pdb_free_sam(&sampass);
1719
1720 /* associate the user's SID and access bits with the new handle. */
1721 if ((info = get_samr_info_by_sid(&sid)) == NULL)
1722 return NT_STATUS_NO_MEMORY;
1723 info->acc_granted = acc_granted;
1724
1725 /* get a (unique) handle. open a policy on it. */
1726 if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info))
1727 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1728
1729 return r_u->status;
1730 }
1731
1732 /*************************************************************************
1733 get_user_info_10. Safe. Only gives out acb bits.
1734 *************************************************************************/
1735
1736 static NTSTATUS get_user_info_10(TALLOC_CTX *mem_ctx, SAM_USER_INFO_10 *id10, DOM_SID *user_sid)
1737 {
1738 SAM_ACCOUNT *smbpass=NULL;
1739 BOOL ret;
1740 NTSTATUS nt_status;
1741
1742 nt_status = pdb_init_sam_talloc(mem_ctx, &smbpass);
1743
1744 if (!NT_STATUS_IS_OK(nt_status)) {
1745 return nt_status;
1746 }
1747
1748 become_root();
1749 ret = pdb_getsampwsid(smbpass, user_sid);
1750 unbecome_root();
1751
1752 if (ret==False) {
1753 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
1754 return NT_STATUS_NO_SUCH_USER;
1755 }
1756
1757 DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass) ));
1758
1759 ZERO_STRUCTP(id10);
1760 init_sam_user_info10(id10, pdb_get_acct_ctrl(smbpass) );
1761
1762 pdb_free_sam(&smbpass);
1763
1764 return NT_STATUS_OK;
1765 }
1766
1767 /*************************************************************************
1768 get_user_info_12. OK - this is the killer as it gives out password info.
1769 Ensure that this is only allowed on an encrypted connection with a root
1770 user. JRA.
1771 *************************************************************************/
1772
1773 static NTSTATUS get_user_info_12(pipes_struct *p, TALLOC_CTX *mem_ctx, SAM_USER_INFO_12 * id12, DOM_SID *user_sid)
1774 {
1775 SAM_ACCOUNT *smbpass=NULL;
1776 BOOL ret;
1777 NTSTATUS nt_status;
1778
1779 if (!p->ntlmssp_auth_validated)
1780 return NT_STATUS_ACCESS_DENIED;
1781
1782 if (!(p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) || !(p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL))
1783 return NT_STATUS_ACCESS_DENIED;
1784
1785 /*
1786 * Do *NOT* do become_root()/unbecome_root() here ! JRA.
1787 */
1788
1789 nt_status = pdb_init_sam_talloc(mem_ctx, &smbpass);
1790
1791 if (!NT_STATUS_IS_OK(nt_status)) {
1792 return nt_status;
1793 }
1794
1795 ret = pdb_getsampwsid(smbpass, user_sid);
1796
1797 if (ret == False) {
1798 DEBUG(4, ("User %s not found\n", sid_string_static(user_sid)));
1799 pdb_free_sam(&smbpass);
1800 return (geteuid() == (uid_t)0) ? NT_STATUS_NO_SUCH_USER : NT_STATUS_ACCESS_DENIED;
1801 }
1802
1803 DEBUG(3,("User:[%s] 0x%x\n", pdb_get_username(smbpass), pdb_get_acct_ctrl(smbpass) ));
1804
1805 if ( pdb_get_acct_ctrl(smbpass) & ACB_DISABLED) {
1806 pdb_free_sam(&smbpass);
1807 return NT_STATUS_ACCOUNT_DISABLED;
1808 }
1809
1810 ZERO_STRUCTP(id12);
1811 init_sam_user_info12(id12, pdb_get_lanman_passwd(smbpass), pdb_get_nt_passwd(smbpass));
1812
1813 pdb_free_sam(&smbpass);
1814
1815 return NT_STATUS_OK;
1816 }
1817
1818 /*************************************************************************
1819 get_user_info_20
1820 *************************************************************************/
1821
1822 static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx, SAM_USER_INFO_20 *id20, DOM_SID *user_sid)
1823 {
1824 SAM_ACCOUNT *sampass=NULL;
1825 BOOL ret;
1826
1827 pdb_init_sam_talloc(mem_ctx, &sampass);
1828
1829 become_root();
1830 ret = pdb_getsampwsid(sampass, user_sid);
1831 unbecome_root();
1832
1833 if (ret == False) {
1834 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
1835 return NT_STATUS_NO_SUCH_USER;
1836 }
1837
1838 samr_clear_sam_passwd(sampass);
1839
1840 DEBUG(3,("User:[%s]\n", pdb_get_username(sampass) ));
1841
1842 ZERO_STRUCTP(id20);
1843 init_sam_user_info20A(id20, sampass);
1844
1845 pdb_free_sam(&sampass);
1846
1847 return NT_STATUS_OK;
1848 }
1849
1850 /*************************************************************************
1851 get_user_info_21
1852 *************************************************************************/
1853
1854 static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx, SAM_USER_INFO_21 *id21,
1855 DOM_SID *user_sid, DOM_SID *domain_sid)
1856 {
1857 SAM_ACCOUNT *sampass=NULL;
1858 BOOL ret;
1859 NTSTATUS nt_status;
1860
1861 nt_status = pdb_init_sam_talloc(mem_ctx, &sampass);
1862 if (!NT_STATUS_IS_OK(nt_status)) {
1863 return nt_status;
1864 }
1865
1866 become_root();
1867 ret = pdb_getsampwsid(sampass, user_sid);
1868 unbecome_root();
1869
1870 if (ret == False) {
1871 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
1872 return NT_STATUS_NO_SUCH_USER;
1873 }
1874
1875 samr_clear_sam_passwd(sampass);
1876
1877 DEBUG(3,("User:[%s]\n", pdb_get_username(sampass) ));
1878
1879 ZERO_STRUCTP(id21);
1880 nt_status = init_sam_user_info21A(id21, sampass, domain_sid);
1881
1882 pdb_free_sam(&sampass);
1883
1884 return NT_STATUS_OK;
1885 }
1886
1887 /*******************************************************************
1888 _samr_query_userinfo
1889 ********************************************************************/
1890
1891 NTSTATUS _samr_query_userinfo(pipes_struct *p, SAMR_Q_QUERY_USERINFO *q_u, SAMR_R_QUERY_USERINFO *r_u)
1892 {
1893 SAM_USERINFO_CTR *ctr;
1894 struct samr_info *info = NULL;
1895 DOM_SID domain_sid;
1896 uint32 rid;
1897
1898 r_u->status=NT_STATUS_OK;
1899
1900 /* search for the handle */
1901 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1902 return NT_STATUS_INVALID_HANDLE;
1903
1904 domain_sid = info->sid;
1905
1906 sid_split_rid(&domain_sid, &rid);
1907
1908 if (!sid_check_is_in_our_domain(&info->sid))
1909 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1910
1911 DEBUG(5,("_samr_query_userinfo: sid:%s\n", sid_string_static(&info->sid)));
1912
1913 ctr = (SAM_USERINFO_CTR *)talloc_zero(p->mem_ctx, sizeof(SAM_USERINFO_CTR));
1914 if (!ctr)
1915 return NT_STATUS_NO_MEMORY;
1916
1917 ZERO_STRUCTP(ctr);
1918
1919 /* ok! user info levels (lots: see MSDEV help), off we go... */
1920 ctr->switch_value = q_u->switch_value;
1921
1922 switch (q_u->switch_value) {
1923 case 0x10:
1924 ctr->info.id10 = (SAM_USER_INFO_10 *)talloc_zero(p->mem_ctx, sizeof(SAM_USER_INFO_10));
1925 if (ctr->info.id10 == NULL)
1926 return NT_STATUS_NO_MEMORY;
1927
1928 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_10(p->mem_ctx, ctr->info.id10, &info->sid)))
1929 return r_u->status;
1930 break;
1931
1932 #if 0
1933 /* whoops - got this wrong. i think. or don't understand what's happening. */
1934 case 0x11:
1935 {
1936 NTTIME expire;
1937 info = (void *)&id11;
1938
1939 expire.low = 0xffffffff;
1940 expire.high = 0x7fffffff;
1941
1942 ctr->info.id = (SAM_USER_INFO_11 *)talloc_zero(p->mem_ctx,
1943 sizeof
1944 (*ctr->
1945 info.
1946 id11));
1947 ZERO_STRUCTP(ctr->info.id11);
1948 init_sam_user_info11(ctr->info.id11, &expire,
1949 "BROOKFIELDS$", /* name */
1950 0x03ef, /* user rid */
1951 0x201, /* group rid */
1952 0x0080); /* acb info */
1953
1954 break;
1955 }
1956 #endif
1957
1958 case 0x12:
1959 ctr->info.id12 = (SAM_USER_INFO_12 *)talloc_zero(p->mem_ctx, sizeof(SAM_USER_INFO_12));
1960 if (ctr->info.id12 == NULL)
1961 return NT_STATUS_NO_MEMORY;
1962
1963 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_12(p, p->mem_ctx, ctr->info.id12, &info->sid)))
1964 return r_u->status;
1965 break;
1966
1967 case 20:
1968 ctr->info.id20 = (SAM_USER_INFO_20 *)talloc_zero(p->mem_ctx,sizeof(SAM_USER_INFO_20));
1969 if (ctr->info.id20 == NULL)
1970 return NT_STATUS_NO_MEMORY;
1971 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_20(p->mem_ctx, ctr->info.id20, &info->sid)))
1972 return r_u->status;
1973 break;
1974
1975 case 21:
1976 ctr->info.id21 = (SAM_USER_INFO_21 *)talloc_zero(p->mem_ctx,sizeof(SAM_USER_INFO_21));
1977 if (ctr->info.id21 == NULL)
1978 return NT_STATUS_NO_MEMORY;
1979 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_21(p->mem_ctx, ctr->info.id21,
1980 &info->sid, &domain_sid)))
1981 return r_u->status;
1982 break;
1983
1984 default:
1985 return NT_STATUS_INVALID_INFO_CLASS;
1986 }
1987
1988 init_samr_r_query_userinfo(r_u, ctr, r_u->status);
1989
1990 DEBUG(5,("_samr_query_userinfo: %d\n", __LINE__));
1991
1992 return r_u->status;
1993 }
1994
1995 /*******************************************************************
1996 samr_reply_query_usergroups
1997 ********************************************************************/
1998
1999 NTSTATUS _samr_query_usergroups(pipes_struct *p, SAMR_Q_QUERY_USERGROUPS *q_u, SAMR_R_QUERY_USERGROUPS *r_u)
2000 {
2001 SAM_ACCOUNT *sam_pass=NULL;
2002 DOM_SID sid;
2003 DOM_GID *gids = NULL;
2004 int num_groups = 0;
2005 uint32 acc_granted;
2006 BOOL ret;
2007
2008 /*
2009 * from the SID in the request:
2010 * we should send back the list of DOMAIN GROUPS
2011 * the user is a member of
2012 *
2013 * and only the DOMAIN GROUPS
2014 * no ALIASES !!! neither aliases of the domain
2015 * nor aliases of the builtin SID
2016 *
2017 * JFM, 12/2/2001
2018 */
2019
2020 r_u->status = NT_STATUS_OK;
2021
2022 DEBUG(5,("_samr_query_usergroups: %d\n", __LINE__));
2023
2024 /* find the policy handle. open a policy on it. */
2025 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
2026 return NT_STATUS_INVALID_HANDLE;
2027
2028 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_USER_GET_GROUPS, "_samr_query_usergroups"))) {
2029 return r_u->status;
2030 }
2031
2032 if (!sid_check_is_in_our_domain(&sid))
2033 return NT_STATUS_OBJECT_TYPE_MISMATCH;
2034
2035 pdb_init_sam(&sam_pass);
2036
2037 become_root();
2038 ret = pdb_getsampwsid(sam_pass, &sid);
2039 unbecome_root();
2040
2041 if (ret == False) {
2042 pdb_free_sam(&sam_pass);
2043 return NT_STATUS_NO_SUCH_USER;
2044 }
2045
2046 if(!get_domain_user_groups(p->mem_ctx, &num_groups, &gids, sam_pass)) {
2047 pdb_free_sam(&sam_pass);
2048 return NT_STATUS_NO_SUCH_GROUP;
2049 }
2050
2051 /* construct the response. lkclXXXX: gids are not copied! */
2052 init_samr_r_query_usergroups(r_u, num_groups, gids, r_u->status);
2053
2054 DEBUG(5,("_samr_query_usergroups: %d\n", __LINE__));
2055
2056 pdb_free_sam(&sam_pass);
2057
2058 return r_u->status;
2059 }
2060
2061 /*******************************************************************
2062 _samr_query_dom_info
2063 ********************************************************************/
2064
2065 NTSTATUS _samr_query_dom_info(pipes_struct *p, SAMR_Q_QUERY_DOMAIN_INFO *q_u, SAMR_R_QUERY_DOMAIN_INFO *r_u)
2066 {
2067 struct samr_info *info = NULL;
2068 SAM_UNK_CTR *ctr;
2069 uint32 min_pass_len,pass_hist,flag;
2070 time_t u_expire, u_min_age;
2071 NTTIME nt_expire, nt_min_age;
2072
2073 time_t u_lock_duration, u_reset_time;
2074 NTTIME nt_lock_duration, nt_reset_time;
2075 uint32 lockout;
2076
2077 time_t u_logout;
2078 NTTIME nt_logout;
2079
2080 uint32 account_policy_temp;
2081
2082 uint32 num_users=0, num_groups=0, num_aliases=0;
2083
2084 if ((ctr = (SAM_UNK_CTR *)talloc_zero(p->mem_ctx, sizeof(SAM_UNK_CTR))) == NULL)
2085 return NT_STATUS_NO_MEMORY;
2086
2087 ZERO_STRUCTP(ctr);
2088
2089 r_u->status = NT_STATUS_OK;
2090
2091 DEBUG(5,("_samr_query_dom_info: %d\n", __LINE__));
2092
2093 /* find the policy handle. open a policy on it. */
2094 if (!find_policy_by_hnd(p, &q_u->domain_pol, (void **)&info))
2095 return NT_STATUS_INVALID_HANDLE;
2096
2097 switch (q_u->switch_value) {
2098 case 0x01:
2099
2100 account_policy_get(AP_MIN_PASSWORD_LEN, &account_policy_temp);
2101 min_pass_len = account_policy_temp;
2102
2103 account_policy_get(AP_PASSWORD_HISTORY, &account_policy_temp);
2104 pass_hist = account_policy_temp;
2105
2106 account_policy_get(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp);
2107 flag = account_policy_temp;
2108
2109 account_policy_get(AP_MAX_PASSWORD_AGE, &account_policy_temp);
2110 u_expire = account_policy_temp;
2111
2112 account_policy_get(AP_MIN_PASSWORD_AGE, &account_policy_temp);
2113 u_min_age = account_policy_temp;
2114
2115 unix_to_nt_time_abs(&nt_expire, u_expire);
2116 unix_to_nt_time_abs(&nt_min_age, u_min_age);
2117
2118 init_unk_info1(&ctr->info.inf1, (uint16)min_pass_len, (uint16)pass_hist,
2119 flag, nt_expire, nt_min_age);
2120 break;
2121 case 0x02:
2122 become_root();
2123 r_u->status=load_sampwd_entries(info, ACB_NORMAL, False);
2124 unbecome_root();
2125 if (!NT_STATUS_IS_OK(r_u->status)) {
2126 DEBUG(5, ("_samr_query_dispinfo: load_sampwd_entries failed\n"));
2127 return r_u->status;
2128 }
2129 num_users=info->disp_info.num_user_account;
2130 free_samr_db(info);
2131
2132 r_u->status=load_group_domain_entries(info, get_global_sam_sid());
2133 if (!NT_STATUS_IS_OK(r_u->status)) {
2134 DEBUG(5, ("_samr_query_dispinfo: load_group_domain_entries failed\n"));
2135 return r_u->status;
2136 }
2137 num_groups=info->disp_info.num_group_account;
2138 free_samr_db(info);
2139
2140 /* The time call below is to get a sequence number for the sam. FIXME !!! JRA. */
2141 init_unk_info2(&ctr->info.inf2, lp_workgroup(), global_myname(), (uint32) time(NULL),
2142 num_users, num_groups, num_aliases);
2143 break;
2144 case 0x03:
2145 account_policy_get(AP_TIME_TO_LOGOUT, (unsigned int *)&u_logout);
2146 unix_to_nt_time_abs(&nt_logout, u_logout);
2147
2148 init_unk_info3(&ctr->info.inf3, nt_logout);
2149 break;
2150 case 0x05:
2151 init_unk_info5(&ctr->info.inf5, global_myname());
2152 break;
2153 case 0x06:
2154 init_unk_info6(&ctr->info.inf6);
2155 break;
2156 case 0x07:
2157 init_unk_info7(&ctr->info.inf7);
2158 break;
2159 case 0x0c:
2160 account_policy_get(AP_LOCK_ACCOUNT_DURATION, &account_policy_temp);
2161 u_lock_duration = account_policy_temp;
2162
2163 account_policy_get(AP_RESET_COUNT_TIME, &account_policy_temp);
2164 u_reset_time = account_policy_temp;
2165
2166 account_policy_get(AP_BAD_ATTEMPT_LOCKOUT, &account_policy_temp);
2167 lockout = account_policy_temp;
2168
2169 unix_to_nt_time_abs(&nt_lock_duration, u_lock_duration);
2170 unix_to_nt_time_abs(&nt_reset_time, u_reset_time);
2171
2172 init_unk_info12(&ctr->info.inf12, nt_lock_duration, nt_reset_time, (uint16)lockout);
2173 break;
2174 default:
2175 return NT_STATUS_INVALID_INFO_CLASS;
2176 }
2177
2178 init_samr_r_query_dom_info(r_u, q_u->switch_value, ctr, NT_STATUS_OK);
2179
2180 DEBUG(5,("_samr_query_dom_info: %d\n", __LINE__));
2181
2182 return r_u->status;
2183 }
2184
2185 /*******************************************************************
2186 _samr_create_user
2187 Create an account, can be either a normal user or a machine.
2188 This funcion will need to be updated for bdc/domain trusts.
2189 ********************************************************************/
2190
2191 NTSTATUS _samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_CREATE_USER *r_u)
2192 {
2193 SAM_ACCOUNT *sam_pass=NULL;
2194 fstring account;
2195 DOM_SID sid;
2196 pstring add_script;
2197 POLICY_HND dom_pol = q_u->domain_pol;
2198 UNISTR2 user_account = q_u->uni_name;
2199 uint16 acb_info = q_u->acb_info;
2200 POLICY_HND *user_pol = &r_u->user_pol;
2201 struct samr_info *info = NULL;
2202 BOOL ret;
2203 NTSTATUS nt_status;
2204 struct passwd *pw;
2205 uint32 acc_granted;
2206 SEC_DESC *psd;
2207 size_t sd_size;
2208 uint32 new_rid = 0;
2209 /* check this, when giving away 'add computer to domain' privs */
2210 uint32 des_access = GENERIC_RIGHTS_USER_ALL_ACCESS;
2211
2212 /* Get the domain SID stored in the domain policy */
2213 if (!get_lsa_policy_samr_sid(p, &dom_pol, &sid, &acc_granted))
2214 return NT_STATUS_INVALID_HANDLE;
2215
2216 if (!NT_STATUS_IS_OK(nt_status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_CREATE_USER, "_samr_create_user"))) {
2217 return nt_status;
2218 }
2219
2220 /* find the account: tell the caller if it exists.
2221 lkclXXXX i have *no* idea if this is a problem or not
2222 or even if you are supposed to construct a different
2223 reply if the account already exists...
2224 */
2225
2226 rpcstr_pull(account, user_account.buffer, sizeof(account), user_account.uni_str_len*2, 0);
2227 strlower_m(account);
2228
2229 pdb_init_sam(&sam_pass);
2230
2231 become_root();
2232 ret = pdb_getsampwnam(sam_pass, account);
2233 unbecome_root();
2234 if (ret == True) {
2235 /* this account exists: say so */
2236 pdb_free_sam(&sam_pass);
2237 return NT_STATUS_USER_EXISTS;
2238 }
2239
2240 pdb_free_sam(&sam_pass);
2241
2242 /*
2243 * NB. VERY IMPORTANT ! This call must be done as the current pipe user,
2244 * *NOT* surrounded by a become_root()/unbecome_root() call. This ensures
2245 * that only people with write access to the smbpasswd file will be able
2246 * to create a user. JRA.
2247 */
2248
2249 /*
2250 * add the user in the /etc/passwd file or the unix authority system.
2251 * We don't check if the smb_create_user() function succed or not for 2 reasons:
2252 * a) local_password_change() checks for us if the /etc/passwd account really exists
2253 * b) smb_create_user() would return an error if the account already exists
2254 * and as it could return an error also if it can't create the account, it would be tricky.
2255 *
2256 * So we go the easy way, only check after if the account exists.
2257 * JFM (2/3/2001), to clear any possible bad understanding (-:
2258 *
2259 * We now have seperate script paramaters for adding users/machines so we
2260 * now have some sainity-checking to match.
2261 */
2262
2263 DEBUG(10,("checking account %s at pos %lu for $ termination\n",account, (unsigned long)strlen(account)-1));
2264
2265 /*
2266 * we used to have code here that made sure the acb_info flags
2267 * matched with the users named (e.g. an account flags as a machine
2268 * trust account ended in '$'). It has been ifdef'd out for a long
2269 * time, so I replaced it with this comment. --jerry
2270 */
2271
2272 /* the passdb lookup has failed; check to see if we need to run the
2273 add user/machine script */
2274
2275 pw = Get_Pwnam(account);
2276
2277 /*********************************************************************
2278 * HEADS UP! If we have to create a new user account, we have to get
2279 * a new RID from somewhere. This used to be done by the passdb
2280 * backend. It has been moved into idmap now. Since idmap is now
2281 * wrapped up behind winbind, this means you have to run winbindd if you
2282 * want new accounts to get a new RID when "enable rid algorithm = no".
2283 * Tough. We now have a uniform way of allocating RIDs regardless
2284 * of what ever passdb backend people may use.
2285 * --jerry (2003-07-10)
2286 *********************************************************************/
2287
2288 if ( !pw ) {
2289 /*
2290 * we can't check both the ending $ and the acb_info.
2291 *
2292 * UserManager creates trust accounts (ending in $,
2293 * normal that hidden accounts) with the acb_info equals to ACB_NORMAL.
2294 * JFM, 11/29/2001
2295 */
2296 if (account[strlen(account)-1] == '$')
2297 pstrcpy(add_script, lp_addmachine_script());
2298 else
2299 pstrcpy(add_script, lp_adduser_script());
2300
2301 if (*add_script) {
2302 int add_ret;
2303 all_string_sub(add_script, "%u", account, sizeof(account));
2304 add_ret = smbrun(add_script,NULL);
2305 DEBUG(3,("_samr_create_user: Running the command `%s' gave %d\n", add_script, add_ret));
2306 }
2307 else /* no add user script -- ask winbindd to do it */
2308 {
2309 if ( !winbind_create_user( account, &new_rid ) ) {
2310 DEBUG(3,("_samr_create_user: winbind_create_user(%s) failed\n",
2311 account));
2312 }
2313 }
2314
2315 }
2316
2317 /* implicit call to getpwnam() next. we have a valid SID coming out of this call */
2318
2319 if ( !NT_STATUS_IS_OK(nt_status = pdb_init_sam_new(&sam_pass, account, new_rid)) )
2320 return nt_status;
2321
2322 pdb_set_acct_ctrl(sam_pass, acb_info, PDB_CHANGED);
2323
2324 if (!pdb_add_sam_account(sam_pass)) {
2325 pdb_free_sam(&sam_pass);
2326 DEBUG(0, ("could not add user/computer %s to passdb. Check permissions?\n",
2327 account));
2328 return NT_STATUS_ACCESS_DENIED;
2329 }
2330
2331 /* Get the user's SID */
2332 sid_copy(&sid, pdb_get_user_sid(sam_pass));
2333
2334 samr_make_usr_obj_sd(p->mem_ctx, &psd, &sd_size, &sid);
2335 se_map_generic(&des_access, &usr_generic_mapping);
2336 if (!NT_STATUS_IS_OK(nt_status =
2337 access_check_samr_object(psd, p->pipe_user.nt_user_token,
2338 des_access, &acc_granted, "_samr_create_user"))) {
2339 return nt_status;
2340 }
2341
2342 /* associate the user's SID with the new handle. */
2343 if ((info = get_samr_info_by_sid(&sid)) == NULL) {
2344 pdb_free_sam(&sam_pass);
2345 return NT_STATUS_NO_MEMORY;
2346 }
2347
2348 ZERO_STRUCTP(info);
2349 info->sid = sid;
2350 info->acc_granted = acc_granted;
2351
2352 /* get a (unique) handle. open a policy on it. */
2353 if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info)) {
2354 pdb_free_sam(&sam_pass);
2355 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2356 }
2357
2358 r_u->user_rid=pdb_get_user_rid(sam_pass);
2359
2360 r_u->access_granted = acc_granted;
2361
2362 pdb_free_sam(&sam_pass);
2363
2364 return NT_STATUS_OK;
2365 }
2366
2367 /*******************************************************************
2368 samr_reply_connect_anon
2369 ********************************************************************/
2370
2371 NTSTATUS _samr_connect_anon(pipes_struct *p, SAMR_Q_CONNECT_ANON *q_u, SAMR_R_CONNECT_ANON *r_u)
2372 {
2373 struct samr_info *info = NULL;
2374 uint32 des_access = q_u->access_mask;
2375
2376 /* Access check */
2377
2378 if (!pipe_access_check(p)) {
2379 DEBUG(3, ("access denied to samr_connect_anon\n"));
2380 r_u->status = NT_STATUS_ACCESS_DENIED;
2381 return r_u->status;
2382 }
2383
2384 /* set up the SAMR connect_anon response */
2385
2386 r_u->status = NT_STATUS_OK;
2387
2388 /* associate the user's SID with the new handle. */
2389 if ((info = get_samr_info_by_sid(NULL)) == NULL)
2390 return NT_STATUS_NO_MEMORY;
2391
2392 /* don't give away the farm but this is probably ok. The SA_RIGHT_SAM_ENUM_DOMAINS
2393 was observed from a win98 client trying to enumerate users (when configured
2394 user level access control on shares) --jerry */
2395
2396 se_map_generic( &des_access, &sam_generic_mapping );
2397 info->acc_granted = des_access & (SA_RIGHT_SAM_ENUM_DOMAINS|SA_RIGHT_SAM_OPEN_DOMAIN);
2398
2399 info->status = q_u->unknown_0;
2400
2401 /* get a (unique) handle. open a policy on it. */
2402 if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
2403 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2404
2405 return r_u->status;
2406 }
2407
2408 /*******************************************************************
2409 samr_reply_connect
2410 ********************************************************************/
2411
2412 NTSTATUS _samr_connect(pipes_struct *p, SAMR_Q_CONNECT *q_u, SAMR_R_CONNECT *r_u)
2413 {
2414 struct samr_info *info = NULL;
2415 SEC_DESC *psd = NULL;
2416 uint32 acc_granted;
2417 uint32 des_access = q_u->access_mask;
2418 size_t sd_size;
2419 NTSTATUS nt_status;
2420
2421
2422 DEBUG(5,("_samr_connect: %d\n", __LINE__));
2423
2424 /* Access check */
2425
2426 if (!pipe_access_check(p)) {
2427 DEBUG(3, ("access denied to samr_connect\n"));
2428 r_u->status = NT_STATUS_ACCESS_DENIED;
2429 return r_u->status;
2430 }
2431
2432 samr_make_sam_obj_sd(p->mem_ctx, &psd, &sd_size);
2433 se_map_generic(&des_access, &sam_generic_mapping);
2434 if (!NT_STATUS_IS_OK(nt_status =
2435 access_check_samr_object(psd, p->pipe_user.nt_user_token,
2436 des_access, &acc_granted, "_samr_connect"))) {
2437 return nt_status;
2438 }
2439
2440 r_u->status = NT_STATUS_OK;
2441
2442 /* associate the user's SID and access granted with the new handle. */
2443 if ((info = get_samr_info_by_sid(NULL)) == NULL)
2444 return NT_STATUS_NO_MEMORY;
2445
2446 info->acc_granted = acc_granted;
2447 info->status = q_u->access_mask;
2448
2449 /* get a (unique) handle. open a policy on it. */
2450 if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
2451 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2452
2453 DEBUG(5,("_samr_connect: %d\n", __LINE__));
2454
2455 return r_u->status;
2456 }
2457
2458 /*******************************************************************
2459 samr_connect4
2460 ********************************************************************/
2461
2462 NTSTATUS _samr_connect4(pipes_struct *p, SAMR_Q_CONNECT4 *q_u, SAMR_R_CONNECT4 *r_u)
2463 {
2464 struct samr_info *info = NULL;
2465 SEC_DESC *psd = NULL;
2466 uint32 acc_granted;
2467 uint32 des_access = q_u->access_mask;
2468 size_t sd_size;
2469 NTSTATUS nt_status;
2470
2471
2472 DEBUG(5,("_samr_connect4: %d\n", __LINE__));
2473
2474 /* Access check */
2475
2476 if (!pipe_access_check(p)) {
2477 DEBUG(3, ("access denied to samr_connect4\n"));
2478 r_u->status = NT_STATUS_ACCESS_DENIED;
2479 return r_u->status;
2480 }
2481
2482 samr_make_sam_obj_sd(p->mem_ctx, &psd, &sd_size);
2483 se_map_generic(&des_access, &sam_generic_mapping);
2484 if (!NT_STATUS_IS_OK(nt_status =
2485 access_check_samr_object(psd, p->pipe_user.nt_user_token,
2486 des_access, &acc_granted, "_samr_connect"))) {
2487 return nt_status;
2488 }
2489
2490 r_u->status = NT_STATUS_OK;
2491
2492 /* associate the user's SID and access granted with the new handle. */
2493 if ((info = get_samr_info_by_sid(NULL)) == NULL)
2494 return NT_STATUS_NO_MEMORY;
2495
2496 info->acc_granted = acc_granted;
2497 info->status = q_u->access_mask;
2498
2499 /* get a (unique) handle. open a policy on it. */
2500 if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
2501 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2502
2503 DEBUG(5,("_samr_connect: %d\n", __LINE__));
2504
2505 return r_u->status;
2506 }
2507
2508 /**********************************************************************
2509 api_samr_lookup_domain
2510 **********************************************************************/
2511
2512 NTSTATUS _samr_lookup_domain(pipes_struct *p, SAMR_Q_LOOKUP_DOMAIN *q_u, SAMR_R_LOOKUP_DOMAIN *r_u)
2513 {
2514 struct samr_info *info;
2515 fstring domain_name;
2516 DOM_SID sid;
2517
2518 r_u->status = NT_STATUS_OK;
2519
2520 if (!find_policy_by_hnd(p, &q_u->connect_pol, (void**)&info))
2521 return NT_STATUS_INVALID_HANDLE;
2522
2523 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted,
2524 SA_RIGHT_SAM_ENUM_DOMAINS, "_samr_lookup_domain")))
2525 {
2526 return r_u->status;
2527 }
2528
2529 rpcstr_pull(domain_name, q_u->uni_domain.buffer, sizeof(domain_name), q_u->uni_domain.uni_str_len*2, 0);
2530
2531 ZERO_STRUCT(sid);
2532
2533 if (!secrets_fetch_domain_sid(domain_name, &sid)) {
2534 r_u->status = NT_STATUS_NO_SUCH_DOMAIN;
2535 }
2536
2537 DEBUG(2,("Returning domain sid for domain %s -> %s\n", domain_name, sid_string_static(&sid)));
2538
2539 init_samr_r_lookup_domain(r_u, &sid, r_u->status);
2540
2541 return r_u->status;
2542 }
2543
2544 /******************************************************************
2545 makes a SAMR_R_ENUM_DOMAINS structure.
2546 ********************************************************************/
2547
2548 static BOOL make_enum_domains(TALLOC_CTX *ctx, SAM_ENTRY **pp_sam,
2549 UNISTR2 **pp_uni_name, uint32 num_sam_entries, fstring doms[])
2550 {
2551 uint32 i;
2552 SAM_ENTRY *sam;
2553 UNISTR2 *uni_name;
2554
2555 DEBUG(5, ("make_enum_domains\n"));
2556
2557 *pp_sam = NULL;
2558 *pp_uni_name = NULL;
2559
2560 if (num_sam_entries == 0)
2561 return True;
2562
2563 sam = (SAM_ENTRY *)talloc_zero(ctx, sizeof(SAM_ENTRY)*num_sam_entries);
2564 uni_name = (UNISTR2 *)talloc_zero(ctx, sizeof(UNISTR2)*num_sam_entries);
2565
2566 if (sam == NULL || uni_name == NULL)
2567 return False;
2568
2569 for (i = 0; i < num_sam_entries; i++) {
2570 init_unistr2(&uni_name[i], doms[i], UNI_FLAGS_NONE);
2571 init_sam_entry(&sam[i], &uni_name[i], 0);
2572 }
2573
2574 *pp_sam = sam;
2575 *pp_uni_name = uni_name;
2576
2577 return True;
2578 }
2579
2580 /**********************************************************************
2581 api_samr_enum_domains
2582 **********************************************************************/
2583
2584 NTSTATUS _samr_enum_domains(pipes_struct *p, SAMR_Q_ENUM_DOMAINS *q_u, SAMR_R_ENUM_DOMAINS *r_u)
2585 {
2586 struct samr_info *info;
2587 uint32 num_entries = 2;
2588 fstring dom[2];
2589 const char *name;
2590
2591 r_u->status = NT_STATUS_OK;
2592
2593 if (!find_policy_by_hnd(p, &q_u->pol, (void**)&info))
2594 return NT_STATUS_INVALID_HANDLE;
2595
2596 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted, SA_RIGHT_SAM_ENUM_DOMAINS, "_samr_enum_domains"))) {
2597 return r_u->status;
2598 }
2599
2600 name = get_global_sam_name();
2601
2602 fstrcpy(dom[0],name);
2603 strupper_m(dom[0]);
2604 fstrcpy(dom[1],"Builtin");
2605
2606 if (!make_enum_domains(p->mem_ctx, &r_u->sam, &r_u->uni_dom_name, num_entries, dom))
2607 return NT_STATUS_NO_MEMORY;
2608
2609 init_samr_r_enum_domains(r_u, q_u->start_idx + num_entries, num_entries);
2610
2611 return r_u->status;
2612 }
2613
2614 /*******************************************************************
2615 api_samr_open_alias
2616 ********************************************************************/
2617
2618 NTSTATUS _samr_open_alias(pipes_struct *p, SAMR_Q_OPEN_ALIAS *q_u, SAMR_R_OPEN_ALIAS *r_u)
2619 {
2620 DOM_SID sid;
2621 POLICY_HND domain_pol = q_u->dom_pol;
2622 uint32 alias_rid = q_u->rid_alias;
2623 POLICY_HND *alias_pol = &r_u->pol;
2624 struct samr_info *info = NULL;
2625 SEC_DESC *psd = NULL;
2626 uint32 acc_granted;
2627 uint32 des_access = q_u->access_mask;
2628 size_t sd_size;
2629 NTSTATUS status;
2630
2631 r_u->status = NT_STATUS_OK;
2632
2633 /* find the domain policy and get the SID / access bits stored in the domain policy */
2634 if (!get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted))
2635 return NT_STATUS_INVALID_HANDLE;
2636
2637 if (!NT_STATUS_IS_OK(status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_open_alias"))) {
2638 return status;
2639 }
2640
2641 /* append the alias' RID to it */
2642 if (!sid_append_rid(&sid, alias_rid))
2643 return NT_STATUS_NO_SUCH_USER;
2644
2645 /*check if access can be granted as requested by client. */
2646 samr_make_ali_obj_sd(p->mem_ctx, &psd, &sd_size);
2647 se_map_generic(&des_access,&ali_generic_mapping);
2648 if (!NT_STATUS_IS_OK(status =
2649 access_check_samr_object(psd, p->pipe_user.nt_user_token,
2650 des_access, &acc_granted, "_samr_open_alias"))) {
2651 return status;
2652 }
2653
2654 /*
2655 * we should check if the rid really exist !!!
2656 * JFM.
2657 */
2658
2659 /* associate the user's SID with the new handle. */
2660 if ((info = get_samr_info_by_sid(&sid)) == NULL)
2661 return NT_STATUS_NO_MEMORY;
2662
2663 info->acc_granted = acc_granted;
2664
2665 /* get a (unique) handle. open a policy on it. */
2666 if (!create_policy_hnd(p, alias_pol, free_samr_info, (void *)info))
2667 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2668
2669 return r_u->status;
2670 }
2671
2672 /*******************************************************************
2673 set_user_info_10
2674 ********************************************************************/
2675
2676 static BOOL set_user_info_10(const SAM_USER_INFO_10 *id10, DOM_SID *sid)
2677 {
2678 SAM_ACCOUNT *pwd =NULL;
2679 BOOL ret;
2680
2681 pdb_init_sam(&pwd);
2682
2683 ret = pdb_getsampwsid(pwd, sid);
2684
2685 if(ret==False) {
2686 pdb_free_sam(&pwd);
2687 return False;
2688 }
2689
2690 if (id10 == NULL) {
2691 DEBUG(5, ("set_user_info_10: NULL id10\n"));
2692 pdb_free_sam(&pwd);
2693 return False;
2694 }
2695
2696 /* FIX ME: check if the value is really changed --metze */
2697 if (!pdb_set_acct_ctrl(pwd, id10->acb_info, PDB_CHANGED)) {
2698 pdb_free_sam(&pwd);
2699 return False;
2700 }
2701
2702 if(!pdb_update_sam_account(pwd)) {
2703 pdb_free_sam(&pwd);
2704 return False;
2705 }
2706
2707 pdb_free_sam(&pwd);
2708
2709 return True;
2710 }
2711
2712 /*******************************************************************
2713 set_user_info_12
2714 ********************************************************************/
2715
2716 static BOOL set_user_info_12(SAM_USER_INFO_12 *id12, DOM_SID *sid)
2717 {
2718 SAM_ACCOUNT *pwd = NULL;
2719
2720 pdb_init_sam(&pwd);
2721
2722 if(!pdb_getsampwsid(pwd, sid)) {
2723 pdb_free_sam(&pwd);
2724 return False;
2725 }
2726
2727 if (id12 == NULL) {
2728 DEBUG(2, ("set_user_info_12: id12 is NULL\n"));
2729 pdb_free_sam(&pwd);
2730 return False;
2731 }
2732
2733 if (!pdb_set_lanman_passwd (pwd, id12->lm_pwd, PDB_CHANGED)) {
2734 pdb_free_sam(&pwd);
2735 return False;
2736 }
2737 if (!pdb_set_nt_passwd (pwd, id12->nt_pwd, PDB_CHANGED)) {
2738 pdb_free_sam(&pwd);
2739 return False;
2740 }
2741 if (!pdb_set_pass_changed_now (pwd)) {
2742 pdb_free_sam(&pwd);
2743 return False;
2744 }
2745
2746 if(!pdb_update_sam_account(pwd)) {
2747 pdb_free_sam(&pwd);
2748 return False;
2749 }
2750
2751 pdb_free_sam(&pwd);
2752 return True;
2753 }
2754
2755 /*******************************************************************
2756 The GROUPSID field in the SAM_ACCOUNT changed. Try to tell unix.
2757 ********************************************************************/
2758 static BOOL set_unix_primary_group(SAM_ACCOUNT *sampass)
2759 {
2760 struct group *grp;
2761 gid_t gid;
2762
2763 if (!NT_STATUS_IS_OK(sid_to_gid(pdb_get_group_sid(sampass),
2764 &gid))) {
2765 DEBUG(2,("Could not get gid for primary group of "
2766 "user %s\n", pdb_get_username(sampass)));
2767 return False;
2768 }
2769
2770 grp = getgrgid(gid);
2771
2772 if (grp == NULL) {
2773 DEBUG(2,("Could not find primary group %lu for "
2774 "user %s\n", (unsigned long)gid,
2775 pdb_get_username(sampass)));
2776 return False;
2777 }
2778
2779 if (smb_set_primary_group(grp->gr_name,
2780 pdb_get_username(sampass)) != 0) {
2781 DEBUG(2,("Could not set primary group for user %s to "
2782 "%s\n",
2783 pdb_get_username(sampass), grp->gr_name));
2784 return False;
2785 }
2786
2787 return True;
2788 }
2789
2790
2791 /*******************************************************************
2792 set_user_info_20
2793 ********************************************************************/
2794
2795 static BOOL set_user_info_20(SAM_USER_INFO_20 *id20, DOM_SID *sid)
2796 {
2797 SAM_ACCOUNT *pwd = NULL;
2798
2799 if (id20 == NULL) {
2800 DEBUG(5, ("set_user_info_20: NULL id20\n"));
2801 return False;
2802 }
2803
2804 pdb_init_sam(&pwd);
2805
2806 if (!pdb_getsampwsid(pwd, sid)) {
2807 pdb_free_sam(&pwd);
2808 return False;
2809 }
2810
2811 copy_id20_to_sam_passwd(pwd, id20);
2812
2813 /* write the change out */
2814 if(!pdb_update_sam_account(pwd)) {
2815 pdb_free_sam(&pwd);
2816 return False;
2817 }
2818
2819 pdb_free_sam(&pwd);
2820
2821 return True;
2822 }
2823 /*******************************************************************
2824 set_user_info_21
2825 ********************************************************************/
2826
2827 static BOOL set_user_info_21(SAM_USER_INFO_21 *id21, DOM_SID *sid)
2828 {
2829 SAM_ACCOUNT *pwd = NULL;
2830
2831 if (id21 == NULL) {
2832 DEBUG(5, ("set_user_info_21: NULL id21\n"));
2833 return False;
2834 }
2835
2836 pdb_init_sam(&pwd);
2837
2838 if (!pdb_getsampwsid(pwd, sid)) {
2839 pdb_free_sam(&pwd);
2840 return False;
2841 }
2842
2843 copy_id21_to_sam_passwd(pwd, id21);
2844
2845 /*
2846 * The funny part about the previous two calls is
2847 * that pwd still has the password hashes from the
2848 * passdb entry. These have not been updated from
2849 * id21. I don't know if they need to be set. --jerry
2850 */
2851
2852 if (IS_SAM_CHANGED(pwd, PDB_GROUPSID))
2853 set_unix_primary_group(pwd);
2854
2855 /* write the change out */
2856 if(!pdb_update_sam_account(pwd)) {
2857 pdb_free_sam(&pwd);
2858 return False;
2859 }
2860
2861 pdb_free_sam(&pwd);
2862
2863 return True;
2864 }
2865
2866 /*******************************************************************
2867 set_user_info_23
2868 ********************************************************************/
2869
2870 static BOOL set_user_info_23(SAM_USER_INFO_23 *id23, DOM_SID *sid)
2871 {
2872 SAM_ACCOUNT *pwd = NULL;
2873 pstring plaintext_buf;
2874 uint32 len;
2875 uint16 acct_ctrl;
2876
2877 if (id23 == NULL) {
2878 DEBUG(5, ("set_user_info_23: NULL id23\n"));
2879 return False;
2880 }
2881
2882 pdb_init_sam(&pwd);
2883
2884 if (!pdb_getsampwsid(pwd, sid)) {
2885 pdb_free_sam(&pwd);
2886 return False;
2887 }
2888
2889 DEBUG(5, ("Attempting administrator password change (level 23) for user %s\n",
2890 pdb_get_username(pwd)));
2891
2892 acct_ctrl = pdb_get_acct_ctrl(pwd);
2893
2894 if (!decode_pw_buffer((char*)id23->pass, plaintext_buf, 256, &len)) {
2895 pdb_free_sam(&pwd);
2896 return False;
2897 }
2898
2899 if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
2900 pdb_free_sam(&pwd);
2901 return False;
2902 }
2903
2904 copy_id23_to_sam_passwd(pwd, id23);
2905
2906 /* if it's a trust account, don't update /etc/passwd */
2907 if ( ( (acct_ctrl & ACB_DOMTRUST) == ACB_DOMTRUST ) ||
2908 ( (acct_ctrl & ACB_WSTRUST) == ACB_WSTRUST) ||
2909 ( (acct_ctrl & ACB_SVRTRUST) == ACB_SVRTRUST) ) {
2910 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
2911 } else {
2912 /* update the UNIX password */
2913 if (lp_unix_password_sync() )
2914 if(!chgpasswd(pdb_get_username(pwd), "", plaintext_buf, True)) {
2915 pdb_free_sam(&pwd);
2916 return False;
2917 }
2918 }
2919
2920 ZERO_STRUCT(plaintext_buf);
2921
2922 if (IS_SAM_CHANGED(pwd, PDB_GROUPSID))
2923 set_unix_primary_group(pwd);
2924
2925 if(!pdb_update_sam_account(pwd)) {
2926 pdb_free_sam(&pwd);
2927 return False;
2928 }
2929
2930 pdb_free_sam(&pwd);
2931
2932 return True;
2933 }
2934
2935 /*******************************************************************
2936 set_user_info_pw
2937 ********************************************************************/
2938
2939 static BOOL set_user_info_pw(char *pass, DOM_SID *sid)
2940 {
2941 SAM_ACCOUNT *pwd = NULL;
2942 uint32 len;
2943 pstring plaintext_buf;
2944 uint16 acct_ctrl;
2945
2946 pdb_init_sam(&pwd);
2947
2948 if (!pdb_getsampwsid(pwd, sid)) {
2949 pdb_free_sam(&pwd);
2950 return False;
2951 }
2952
2953 DEBUG(5, ("Attempting administrator password change for user %s\n",
2954 pdb_get_username(pwd)));
2955
2956 acct_ctrl = pdb_get_acct_ctrl(pwd);
2957
2958 ZERO_STRUCT(plaintext_buf);
2959
2960 if (!decode_pw_buffer(pass, plaintext_buf, 256, &len)) {
2961 pdb_free_sam(&pwd);
2962 return False;
2963 }
2964
2965 if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
2966 pdb_free_sam(&pwd);
2967 return False;
2968 }
2969
2970 /* if it's a trust account, don't update /etc/passwd */
2971 if ( ( (acct_ctrl & ACB_DOMTRUST) == ACB_DOMTRUST ) ||
2972 ( (acct_ctrl & ACB_WSTRUST) == ACB_WSTRUST) ||
2973 ( (acct_ctrl & ACB_SVRTRUST) == ACB_SVRTRUST) ) {
2974 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
2975 } else {
2976 /* update the UNIX password */
2977 if (lp_unix_password_sync()) {
2978 if(!chgpasswd(pdb_get_username(pwd), "", plaintext_buf, True)) {
2979 pdb_free_sam(&pwd);
2980 return False;
2981 }
2982 }
2983 }
2984
2985 ZERO_STRUCT(plaintext_buf);
2986
2987 DEBUG(5,("set_user_info_pw: pdb_update_pwd()\n"));
2988
2989 /* update the SAMBA password */
2990 if(!pdb_update_sam_account(pwd)) {
2991 pdb_free_sam(&pwd);
2992 return False;
2993 }
2994
2995 pdb_free_sam(&pwd);
2996
2997 return True;
2998 }
2999
3000 /*******************************************************************
3001 samr_reply_set_userinfo
3002 ********************************************************************/
3003
3004 NTSTATUS _samr_set_userinfo(pipes_struct *p, SAMR_Q_SET_USERINFO *q_u, SAMR_R_SET_USERINFO *r_u)
3005 {
3006 DOM_SID sid;
3007 POLICY_HND *pol = &q_u->pol;
3008 uint16 switch_value = q_u->switch_value;
3009 SAM_USERINFO_CTR *ctr = q_u->ctr;
3010 uint32 acc_granted;
3011 uint32 acc_required;
3012
3013 DEBUG(5, ("_samr_set_userinfo: %d\n", __LINE__));
3014
3015 r_u->status = NT_STATUS_OK;
3016
3017 /* find the policy handle. open a policy on it. */
3018 if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted))
3019 return NT_STATUS_INVALID_HANDLE;
3020
3021 acc_required = SA_RIGHT_USER_SET_LOC_COM | SA_RIGHT_USER_SET_ATTRIBUTES; /* This is probably wrong */
3022 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, acc_required, "_samr_set_userinfo"))) {
3023 return r_u->status;
3024 }
3025
3026 DEBUG(5, ("_samr_set_userinfo: sid:%s, level:%d\n", sid_string_static(&sid), switch_value));
3027
3028 if (ctr == NULL) {
3029 DEBUG(5, ("_samr_set_userinfo: NULL info level\n"));
3030 return NT_STATUS_INVALID_INFO_CLASS;
3031 }
3032
3033 /* ok! user info levels (lots: see MSDEV help), off we go... */
3034 switch (switch_value) {
3035 case 0x12:
3036 if (!set_user_info_12(ctr->info.id12, &sid))
3037 return NT_STATUS_ACCESS_DENIED;
3038 break;
3039
3040 case 24:
3041 SamOEMhash(ctr->info.id24->pass, p->session_key, 516);
3042
3043 dump_data(100, (char *)ctr->info.id24->pass, 516);
3044
3045 if (!set_user_info_pw((char *)ctr->info.id24->pass, &sid))
3046 return NT_STATUS_ACCESS_DENIED;
3047 break;
3048
3049 case 25:
3050 #if 0
3051 /*
3052 * Currently we don't really know how to unmarshall
3053 * the level 25 struct, and the password encryption
3054 * is different. This is a placeholder for when we
3055 * do understand it. In the meantime just return INVALID
3056 * info level and W2K SP2 drops down to level 23... JRA.
3057 */
3058
3059 SamOEMhash(ctr->info.id25->pass, p->session_key, 532);
3060
3061 dump_data(100, (char *)ctr->info.id25->pass, 532);
3062
3063 if (!set_user_info_pw(ctr->info.id25->pass, &sid))
3064 return NT_STATUS_ACCESS_DENIED;
3065 break;
3066 #endif
3067 return NT_STATUS_INVALID_INFO_CLASS;
3068
3069 case 23:
3070 SamOEMhash(ctr->info.id23->pass, p->session_key, 516);
3071
3072 dump_data(100, (char *)ctr->info.id23->pass, 516);
3073
3074 if (!set_user_info_23(ctr->info.id23, &sid))
3075 return NT_STATUS_ACCESS_DENIED;
3076 break;
3077
3078 default:
3079 return NT_STATUS_INVALID_INFO_CLASS;
3080 }
3081
3082 return r_u->status;
3083 }
3084
3085 /*******************************************************************
3086 samr_reply_set_userinfo2
3087 ********************************************************************/
3088
3089 NTSTATUS _samr_set_userinfo2(pipes_struct *p, SAMR_Q_SET_USERINFO2 *q_u, SAMR_R_SET_USERINFO2 *r_u)
3090 {
3091 DOM_SID sid;
3092 SAM_USERINFO_CTR *ctr = q_u->ctr;
3093 POLICY_HND *pol = &q_u->pol;
3094 uint16 switch_value = q_u->switch_value;
3095 uint32 acc_granted;
3096 uint32 acc_required;
3097
3098 DEBUG(5, ("samr_reply_set_userinfo2: %d\n", __LINE__));
3099
3100 r_u->status = NT_STATUS_OK;
3101
3102 /* find the policy handle. open a policy on it. */
3103 if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted))
3104 return NT_STATUS_INVALID_HANDLE;
3105
3106 acc_required = SA_RIGHT_USER_SET_LOC_COM | SA_RIGHT_USER_SET_ATTRIBUTES; /* This is probably wrong */
3107 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, acc_required, "_samr_set_userinfo2"))) {
3108 return r_u->status;
3109 }
3110
3111 DEBUG(5, ("samr_reply_set_userinfo2: sid:%s\n", sid_string_static(&sid)));
3112
3113 if (ctr == NULL) {
3114 DEBUG(5, ("samr_reply_set_userinfo2: NULL info level\n"));
3115 return NT_STATUS_INVALID_INFO_CLASS;
3116 }
3117
3118 switch_value=ctr->switch_value;
3119
3120 /* ok! user info levels (lots: see MSDEV help), off we go... */
3121 switch (switch_value) {
3122 case 21:
3123 if (!set_user_info_21(ctr->info.id21, &sid))
3124 return NT_STATUS_ACCESS_DENIED;
3125 break;
3126 case 20:
3127 if (!set_user_info_20(ctr->info.id20, &sid))
3128 return NT_STATUS_ACCESS_DENIED;
3129 break;
3130 case 16:
3131 if (!set_user_info_10(ctr->info.id10, &sid))
3132 return NT_STATUS_ACCESS_DENIED;
3133 break;
3134 case 18:
3135 /* Used by AS/U JRA. */
3136 if (!set_user_info_12(ctr->info.id12, &sid))
3137 return NT_STATUS_ACCESS_DENIED;
3138 break;
3139 default:
3140 return NT_STATUS_INVALID_INFO_CLASS;
3141 }
3142
3143 return r_u->status;
3144 }
3145
3146 /*********************************************************************
3147 _samr_query_aliasmem
3148 *********************************************************************/
3149
3150 NTSTATUS _samr_query_useraliases(pipes_struct *p, SAMR_Q_QUERY_USERALIASES *q_u, SAMR_R_QUERY_USERALIASES *r_u)
3151 {
3152 int num_groups = 0, tmp_num_groups=0;
3153 uint32 *rids=NULL, *new_rids=NULL, *tmp_rids=NULL;
3154 struct samr_info *info = NULL;
3155 int i,j;
3156
3157 NTSTATUS ntstatus1;
3158 NTSTATUS ntstatus2;
3159
3160 /* until i see a real useraliases query, we fack one up */
3161
3162 /* I have seen one, JFM 2/12/2001 */
3163 /*
3164 * Explanation of what this call does:
3165 * for all the SID given in the request:
3166 * return a list of alias (local groups)
3167 * that have those SID as members.
3168 *
3169 * and that's the alias in the domain specified
3170 * in the policy_handle
3171 *
3172 * if the policy handle is on an incorrect sid
3173 * for example a user's sid
3174 * we should reply NT_STATUS_OBJECT_TYPE_MISMATCH
3175 */
3176
3177 r_u->status = NT_STATUS_OK;
3178
3179 DEBUG(5,("_samr_query_useraliases: %d\n", __LINE__));
3180
3181 /* find the policy handle. open a policy on it. */
3182 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
3183 return NT_STATUS_INVALID_HANDLE;
3184
3185 ntstatus1 = access_check_samr_function(info->acc_granted, SA_RIGHT_DOMAIN_LOOKUP_ALIAS_BY_MEM, "_samr_query_useraliases");
3186 ntstatus2 = access_check_samr_function(info->acc_granted, SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_query_useraliases");
3187
3188 if (!NT_STATUS_IS_OK(ntstatus1) || !NT_STATUS_IS_OK(ntstatus2)) {
3189 if (!(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus2)) &&
3190 !(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus1))) {
3191 return (NT_STATUS_IS_OK(ntstatus1)) ? ntstatus2 : ntstatus1;
3192 }
3193 }
3194
3195 if (!sid_check_is_domain(&info->sid) &&
3196 !sid_check_is_builtin(&info->sid))
3197 return NT_STATUS_OBJECT_TYPE_MISMATCH;
3198
3199
3200 for (i=0; i<q_u->num_sids1; i++) {
3201
3202 r_u->status=get_alias_user_groups(p->mem_ctx, &info->sid, &tmp_num_groups, &tmp_rids, &(q_u->sid[i].sid));
3203
3204 /*
3205 * if there is an error, we just continue as
3206 * it can be an unfound user or group
3207 */
3208 if (!NT_STATUS_IS_OK(r_u->status)) {
3209 DEBUG(10,("_samr_query_useraliases: an error occured while getting groups\n"));
3210 continue;
3211 }
3212
3213 if (tmp_num_groups==0) {
3214 DEBUG(10,("_samr_query_useraliases: no groups found\n"));
3215 continue;
3216 }
3217
3218 new_rids=(uint32 *)talloc_realloc(p->mem_ctx, rids, (num_groups+tmp_num_groups)*sizeof(uint32));
3219 if (new_rids==NULL) {
3220 DEBUG(0,("_samr_query_useraliases: could not realloc memory\n"));
3221 return NT_STATUS_NO_MEMORY;
3222 }
3223 rids=new_rids;
3224
3225 for (j=0; j<tmp_num_groups; j++)
3226 rids[j+num_groups]=tmp_rids[j];
3227
3228 safe_free(tmp_rids);
3229
3230 num_groups+=tmp_num_groups;
3231 }
3232
3233 init_samr_r_query_useraliases(r_u, num_groups, rids, NT_STATUS_OK);
3234 return NT_STATUS_OK;
3235 }
3236
3237 /*********************************************************************
3238 _samr_query_aliasmem
3239 *********************************************************************/
3240
3241 NTSTATUS _samr_query_aliasmem(pipes_struct *p, SAMR_Q_QUERY_ALIASMEM *q_u, SAMR_R_QUERY_ALIASMEM *r_u)
3242 {
3243 int i;
3244
3245 GROUP_MAP map;
3246 int num_uids = 0;
3247 DOM_SID2 *sid;
3248 uid_t *uid=NULL;
3249
3250 DOM_SID alias_sid;
3251 DOM_SID als_sid;
3252 uint32 alias_rid;
3253 fstring alias_sid_str;
3254 DOM_SID temp_sid;
3255
3256 SAM_ACCOUNT *sam_user = NULL;
3257 BOOL check;
3258 uint32 acc_granted;
3259
3260 /* find the policy handle. open a policy on it. */
3261 if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
3262 return NT_STATUS_INVALID_HANDLE;
3263
3264 if (!NT_STATUS_IS_OK(r_u->status =
3265 access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_GET_MEMBERS, "_samr_query_aliasmem"))) {
3266 return r_u->status;
3267 }
3268
3269 sid_copy(&als_sid, &alias_sid);
3270 sid_to_string(alias_sid_str, &alias_sid);
3271 sid_split_rid(&alias_sid, &alias_rid);
3272
3273 DEBUG(10, ("sid is %s\n", alias_sid_str));
3274
3275 if (sid_equal(&alias_sid, &global_sid_Builtin)) {
3276 DEBUG(10, ("lookup on Builtin SID (S-1-5-32)\n"));
3277 if(!get_builtin_group_from_sid(als_sid, &map))
3278 return NT_STATUS_NO_SUCH_ALIAS;
3279 } else {
3280 if (sid_equal(&alias_sid, get_global_sam_sid())) {
3281 DEBUG(10, ("lookup on Server SID\n"));
3282 if(!get_local_group_from_sid(als_sid, &map))
3283 return NT_STATUS_NO_SUCH_ALIAS;
3284 }
3285 }
3286
3287 if(!get_uid_list_of_group(map.gid, &uid, &num_uids))
3288 return NT_STATUS_NO_SUCH_ALIAS;
3289
3290 DEBUG(10, ("sid is %s\n", alias_sid_str));
3291 sid = (DOM_SID2 *)talloc_zero(p->mem_ctx, sizeof(DOM_SID2) * num_uids);
3292 if (num_uids!=0 && sid == NULL)
3293 return NT_STATUS_NO_MEMORY;
3294
3295 for (i = 0; i < num_uids; i++) {
3296 struct passwd *pass;
3297 uint32 rid;
3298
3299 sid_copy(&temp_sid, get_global_sam_sid());
3300
3301 pass = getpwuid_alloc(uid[i]);
3302 if (!pass) continue;
3303
3304 if (!NT_STATUS_IS_OK(pdb_init_sam(&sam_user))) {
3305 passwd_free(&pass);
3306 continue;
3307 }
3308
3309 become_root();
3310 check = pdb_getsampwnam(sam_user, pass->pw_name);
3311 unbecome_root();
3312
3313 if (check != True) {
3314 pdb_free_sam(&sam_user);
3315 passwd_free(&pass);
3316 continue;
3317 }
3318
3319 rid = pdb_get_user_rid(sam_user);
3320 if (rid == 0) {
3321 pdb_free_sam(&sam_user);
3322 passwd_free(&pass);
3323 continue;
3324 }
3325
3326 pdb_free_sam(&sam_user);
3327 passwd_free(&pass);
3328
3329 sid_append_rid(&temp_sid, rid);
3330
3331 init_dom_sid2(&sid[i], &temp_sid);
3332 }
3333
3334 DEBUG(10, ("sid is %s\n", alias_sid_str));
3335 init_samr_r_query_aliasmem(r_u, num_uids, sid, NT_STATUS_OK);
3336
3337 return NT_STATUS_OK;
3338 }
3339
3340 /*********************************************************************
3341 _samr_query_groupmem
3342 *********************************************************************/
3343
3344 NTSTATUS _samr_query_groupmem(pipes_struct *p, SAMR_Q_QUERY_GROUPMEM *q_u, SAMR_R_QUERY_GROUPMEM *r_u)
3345 {
3346 int num_uids = 0;
3347 int i;
3348 DOM_SID group_sid;
3349 uint32 group_rid;
3350 fstring group_sid_str;
3351 uid_t *uid=NULL;
3352
3353 GROUP_MAP map;
3354
3355 uint32 *rid=NULL;
3356 uint32 *attr=NULL;
3357
3358 SAM_ACCOUNT *sam_user = NULL;
3359 BOOL check;
3360 uint32 acc_granted;
3361
3362 /* find the policy handle. open a policy on it. */
3363 if (!get_lsa_policy_samr_sid(p, &q_u->group_pol, &group_sid, &acc_granted))
3364 return NT_STATUS_INVALID_HANDLE;
3365
3366 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_GET_MEMBERS, "_samr_query_groupmem"))) {
3367 return r_u->status;
3368 }
3369
3370 /* todo: change to use sid_compare_front */
3371
3372 sid_split_rid(&group_sid, &group_rid);
3373 sid_to_string(group_sid_str, &group_sid);
3374 DEBUG(10, ("sid is %s\n", group_sid_str));
3375
3376 /* can we get a query for an SID outside our domain ? */
3377 if (!sid_equal(&group_sid, get_global_sam_sid()))
3378 return NT_STATUS_NO_SUCH_GROUP;
3379
3380 sid_append_rid(&group_sid, group_rid);
3381 DEBUG(10, ("lookup on Domain SID\n"));
3382
3383 if(!get_domain_group_from_sid(group_sid, &map))
3384 return NT_STATUS_NO_SUCH_GROUP;
3385
3386 if(!get_uid_list_of_group(map.gid, &uid, &num_uids))
3387 return NT_STATUS_NO_SUCH_GROUP;
3388
3389 rid=talloc_zero(p->mem_ctx, sizeof(uint32)*num_uids);
3390 attr=talloc_zero(p->mem_ctx, sizeof(uint32)*num_uids);
3391
3392 if (num_uids!=0 && (rid==NULL || attr==NULL))
3393 return NT_STATUS_NO_MEMORY;
3394
3395 for (i=0; i<num_uids; i++) {
3396 struct passwd *pass;
3397 uint32 urid;
3398
3399 pass = getpwuid_alloc(uid[i]);
3400 if (!pass) continue;
3401
3402 if (!NT_STATUS_IS_OK(pdb_init_sam(&sam_user))) {
3403 passwd_free(&pass);
3404 continue;
3405 }
3406
3407 become_root();
3408 check = pdb_getsampwnam(sam_user, pass->pw_name);
3409 unbecome_root();
3410
3411 if (check != True) {
3412 pdb_free_sam(&sam_user);
3413 passwd_free(&pass);
3414 continue;
3415 }
3416
3417 urid = pdb_get_user_rid(sam_user);
3418 if (urid == 0) {
3419 pdb_free_sam(&sam_user);
3420 passwd_free(&pass);
3421 continue;
3422 }
3423
3424 pdb_free_sam(&sam_user);
3425 passwd_free(&pass);
3426
3427 rid[i] = urid;
3428 attr[i] = SID_NAME_USER;
3429 }
3430
3431 init_samr_r_query_groupmem(r_u, num_uids, rid, attr, NT_STATUS_OK);
3432
3433 return NT_STATUS_OK;
3434 }
3435
3436 /*********************************************************************
3437 _samr_add_aliasmem
3438 *********************************************************************/
3439
3440 NTSTATUS _samr_add_aliasmem(pipes_struct *p, SAMR_Q_ADD_ALIASMEM *q_u, SAMR_R_ADD_ALIASMEM *r_u)
3441 {
3442 DOM_SID alias_sid;
3443 fstring alias_sid_str;
3444 uid_t uid;
3445 struct passwd *pwd;
3446 struct group *grp;
3447 fstring grp_name;
3448 GROUP_MAP map;
3449 NTSTATUS ret;
3450 SAM_ACCOUNT *sam_user = NULL;
3451 BOOL check;
3452 uint32 acc_granted;
3453
3454 /* Find the policy handle. Open a policy on it. */
3455 if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
3456 return NT_STATUS_INVALID_HANDLE;
3457
3458 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_ADD_MEMBER, "_samr_add_aliasmem"))) {
3459 return r_u->status;
3460 }
3461
3462 sid_to_string(alias_sid_str, &alias_sid);
3463 DEBUG(10, ("sid is %s\n", alias_sid_str));
3464
3465 if (sid_compare(&alias_sid, get_global_sam_sid())>0) {
3466 DEBUG(10, ("adding member on Server SID\n"));
3467 if(!get_local_group_from_sid(alias_sid, &map))
3468 return NT_STATUS_NO_SUCH_ALIAS;
3469
3470 } else {
3471 if (sid_compare(&alias_sid, &global_sid_Builtin)>0) {
3472 DEBUG(10, ("adding member on BUILTIN SID\n"));
3473 if( !get_local_group_from_sid(alias_sid, &map))
3474 return NT_STATUS_NO_SUCH_ALIAS;
3475
3476 } else
3477 return NT_STATUS_NO_SUCH_ALIAS;
3478 }
3479
3480 ret = pdb_init_sam(&sam_user);
3481 if (!NT_STATUS_IS_OK(ret))
3482 return ret;
3483
3484 check = pdb_getsampwsid(sam_user, &q_u->sid.sid);
3485
3486 if (check != True) {
3487 pdb_free_sam(&sam_user);
3488 return NT_STATUS_NO_SUCH_USER;
3489 }
3490
3491 /* check a real user exist before we run the script to add a user to a group */
3492 if (!NT_STATUS_IS_OK(sid_to_uid(pdb_get_user_sid(sam_user), &uid))) {
3493 pdb_free_sam(&sam_user);
3494 return NT_STATUS_NO_SUCH_USER;
3495 }
3496
3497 pdb_free_sam(&sam_user);
3498
3499 if ((pwd=getpwuid_alloc(uid)) == NULL) {
3500 return NT_STATUS_NO_SUCH_USER;
3501 }
3502
3503 if ((grp=getgrgid(map.gid)) == NULL) {
3504 passwd_free(&pwd);
3505 return NT_STATUS_NO_SUCH_ALIAS;
3506 }
3507
3508 /* we need to copy the name otherwise it's overloaded in user_in_group_list */
3509 fstrcpy(grp_name, grp->gr_name);
3510
3511 /* if the user is already in the group */
3512 if(user_in_unix_group_list(pwd->pw_name, grp_name)) {
3513 passwd_free(&pwd);
3514 return NT_STATUS_MEMBER_IN_ALIAS;
3515 }
3516
3517 /*
3518 * ok, the group exist, the user exist, the user is not in the group,
3519 * we can (finally) add it to the group !
3520 */
3521 smb_add_user_group(grp_name, pwd->pw_name);
3522
3523 /* check if the user has been added then ... */
3524 if(!user_in_unix_group_list(pwd->pw_name, grp_name)) {
3525 passwd_free(&pwd);
3526 return NT_STATUS_MEMBER_NOT_IN_ALIAS; /* don't know what to reply else */
3527 }
3528
3529 passwd_free(&pwd);
3530 return NT_STATUS_OK;
3531 }
3532
3533 /*********************************************************************
3534 _samr_del_aliasmem
3535 *********************************************************************/
3536
3537 NTSTATUS _samr_del_aliasmem(pipes_struct *p, SAMR_Q_DEL_ALIASMEM *q_u, SAMR_R_DEL_ALIASMEM *r_u)
3538 {
3539 DOM_SID alias_sid;
3540 fstring alias_sid_str;
3541 struct group *grp;
3542 fstring grp_name;
3543 GROUP_MAP map;
3544 SAM_ACCOUNT *sam_pass=NULL;
3545 uint32 acc_granted;
3546
3547 /* Find the policy handle. Open a policy on it. */
3548 if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
3549 return NT_STATUS_INVALID_HANDLE;
3550
3551 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_REMOVE_MEMBER, "_samr_del_aliasmem"))) {
3552 return r_u->status;
3553 }
3554
3555 sid_to_string(alias_sid_str, &alias_sid);
3556 DEBUG(10, ("_samr_del_aliasmem:sid is %s\n", alias_sid_str));
3557
3558 if (!sid_check_is_in_our_domain(&alias_sid) &&
3559 !sid_check_is_in_builtin(&alias_sid)) {
3560 DEBUG(10, ("_samr_del_aliasmem:invalid alias group\n"));
3561 return NT_STATUS_NO_SUCH_ALIAS;
3562 }
3563
3564 if( !get_local_group_from_sid(alias_sid, &map))
3565 return NT_STATUS_NO_SUCH_ALIAS;
3566
3567 if ((grp=getgrgid(map.gid)) == NULL)
3568 return NT_STATUS_NO_SUCH_ALIAS;
3569
3570 /* we need to copy the name otherwise it's overloaded in user_in_unix_group_list */
3571 fstrcpy(grp_name, grp->gr_name);
3572
3573 /* check if the user exists before trying to remove it from the group */
3574 pdb_init_sam(&sam_pass);
3575 if(!pdb_getsampwsid(sam_pass, &q_u->sid.sid)) {
3576 DEBUG(5,("_samr_del_aliasmem:User %s doesn't exist.\n", pdb_get_username(sam_pass)));
3577 pdb_free_sam(&sam_pass);
3578 return NT_STATUS_NO_SUCH_USER;
3579 }
3580
3581 /* if the user is not in the group */
3582 if(!user_in_unix_group_list(pdb_get_username(sam_pass), grp_name)) {
3583 pdb_free_sam(&sam_pass);
3584 return NT_STATUS_MEMBER_IN_ALIAS;
3585 }
3586
3587 smb_delete_user_group(grp_name, pdb_get_username(sam_pass));
3588
3589 /* check if the user has been removed then ... */
3590 if(user_in_unix_group_list(pdb_get_username(sam_pass), grp_name)) {
3591 pdb_free_sam(&sam_pass);
3592 return NT_STATUS_MEMBER_NOT_IN_ALIAS; /* don't know what to reply else */
3593 }
3594
3595 pdb_free_sam(&sam_pass);
3596 return NT_STATUS_OK;
3597 }
3598
3599 /*********************************************************************
3600 _samr_add_groupmem
3601 *********************************************************************/
3602
3603 NTSTATUS _samr_add_groupmem(pipes_struct *p, SAMR_Q_ADD_GROUPMEM *q_u, SAMR_R_ADD_GROUPMEM *r_u)
3604 {
3605 DOM_SID group_sid;
3606 DOM_SID user_sid;
3607 fstring group_sid_str;
3608 uid_t uid;
3609 struct passwd *pwd;
3610 struct group *grp;
3611 fstring grp_name;
3612 GROUP_MAP map;
3613 NTSTATUS ret;
3614 SAM_ACCOUNT *sam_user=NULL;
3615 BOOL check;
3616 uint32 acc_granted;
3617
3618 /* Find the policy handle. Open a policy on it. */
3619 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
3620 return NT_STATUS_INVALID_HANDLE;
3621
3622 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_ADD_MEMBER, "_samr_add_groupmem"))) {
3623 return r_u->status;
3624 }
3625
3626 sid_to_string(group_sid_str, &group_sid);
3627 DEBUG(10, ("sid is %s\n", group_sid_str));
3628
3629 if (sid_compare(&group_sid, get_global_sam_sid())<=0)
3630 return NT_STATUS_NO_SUCH_GROUP;
3631
3632 DEBUG(10, ("lookup on Domain SID\n"));
3633
3634 if(!get_domain_group_from_sid(group_sid, &map))
3635 return NT_STATUS_NO_SUCH_GROUP;
3636
3637 sid_copy(&user_sid, get_global_sam_sid());
3638 sid_append_rid(&user_sid, q_u->rid);
3639
3640 ret = pdb_init_sam(&sam_user);
3641 if (!NT_STATUS_IS_OK(ret))
3642 return ret;
3643
3644 check = pdb_getsampwsid(sam_user, &user_sid);
3645
3646 if (check != True) {
3647 pdb_free_sam(&sam_user);
3648 return NT_STATUS_NO_SUCH_USER;
3649 }
3650
3651 /* check a real user exist before we run the script to add a user to a group */
3652 if (!NT_STATUS_IS_OK(sid_to_uid(pdb_get_user_sid(sam_user), &uid))) {
3653 pdb_free_sam(&sam_user);
3654 return NT_STATUS_NO_SUCH_USER;
3655 }
3656
3657 pdb_free_sam(&sam_user);
3658
3659 if ((pwd=getpwuid_alloc(uid)) == NULL) {
3660 return NT_STATUS_NO_SUCH_USER;
3661 }
3662
3663 if ((grp=getgrgid(map.gid)) == NULL) {
3664 passwd_free(&pwd);
3665 return NT_STATUS_NO_SUCH_GROUP;
3666 }
3667
3668 /* we need to copy the name otherwise it's overloaded in user_in_unix_group_list */
3669 fstrcpy(grp_name, grp->gr_name);
3670
3671 /* if the user is already in the group */
3672 if(user_in_unix_group_list(pwd->pw_name, grp_name)) {
3673 passwd_free(&pwd);
3674 return NT_STATUS_MEMBER_IN_GROUP;
3675 }
3676
3677 /*
3678 * ok, the group exist, the user exist, the user is not in the group,
3679 *
3680 * we can (finally) add it to the group !
3681 */
3682
3683 smb_add_user_group(grp_name, pwd->pw_name);
3684
3685 /* check if the user has been added then ... */
3686 if(!user_in_unix_group_list(pwd->pw_name, grp_name)) {
3687 passwd_free(&pwd);
3688 return NT_STATUS_MEMBER_NOT_IN_GROUP; /* don't know what to reply else */
3689 }
3690
3691 passwd_free(&pwd);
3692 return NT_STATUS_OK;
3693 }
3694
3695 /*********************************************************************
3696 _samr_del_groupmem
3697 *********************************************************************/
3698
3699 NTSTATUS _samr_del_groupmem(pipes_struct *p, SAMR_Q_DEL_GROUPMEM *q_u, SAMR_R_DEL_GROUPMEM *r_u)
3700 {
3701 DOM_SID group_sid;
3702 DOM_SID user_sid;
3703 SAM_ACCOUNT *sam_pass=NULL;
3704 GROUP_MAP map;
3705 fstring grp_name;
3706 struct group *grp;
3707 uint32 acc_granted;
3708
3709 /*
3710 * delete the group member named q_u->rid
3711 * who is a member of the sid associated with the handle
3712 * the rid is a user's rid as the group is a domain group.
3713 */
3714
3715 /* Find the policy handle. Open a policy on it. */
3716 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
3717 return NT_STATUS_INVALID_HANDLE;
3718
3719 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_REMOVE_MEMBER, "_samr_del_groupmem"))) {
3720 return r_u->status;
3721 }
3722
3723 if (!sid_check_is_in_our_domain(&group_sid))
3724 return NT_STATUS_NO_SUCH_GROUP;
3725
3726 sid_copy(&user_sid, get_global_sam_sid());
3727 sid_append_rid(&user_sid, q_u->rid);
3728
3729 if (!get_domain_group_from_sid(group_sid, &map))
3730 return NT_STATUS_NO_SUCH_GROUP;
3731
3732 if ((grp=getgrgid(map.gid)) == NULL)
3733 return NT_STATUS_NO_SUCH_GROUP;
3734
3735 /* we need to copy the name otherwise it's overloaded in user_in_group_list */
3736 fstrcpy(grp_name, grp->gr_name);
3737
3738 /* check if the user exists before trying to remove it from the group */
3739 pdb_init_sam(&sam_pass);
3740 if (!pdb_getsampwsid(sam_pass, &user_sid)) {
3741 DEBUG(5,("User %s doesn't exist.\n", pdb_get_username(sam_pass)));
3742 pdb_free_sam(&sam_pass);
3743 return NT_STATUS_NO_SUCH_USER;
3744 }
3745
3746 /* if the user is not in the group */
3747 if (!user_in_unix_group_list(pdb_get_username(sam_pass), grp_name)) {
3748 pdb_free_sam(&sam_pass);
3749 return NT_STATUS_MEMBER_NOT_IN_GROUP;
3750 }
3751
3752 smb_delete_user_group(grp_name, pdb_get_username(sam_pass));
3753
3754 /* check if the user has been removed then ... */
3755 if (user_in_unix_group_list(pdb_get_username(sam_pass), grp_name)) {
3756 pdb_free_sam(&sam_pass);
3757 return NT_STATUS_ACCESS_DENIED; /* don't know what to reply else */
3758 }
3759
3760 pdb_free_sam(&sam_pass);
3761 return NT_STATUS_OK;
3762
3763 }
3764
3765 /****************************************************************************
3766 Delete a UNIX user on demand.
3767 ****************************************************************************/
3768
3769 static int smb_delete_user(const char *unix_user)
3770 {
3771 pstring del_script;
3772 int ret;
3773
3774 /* try winbindd first since it is impossible to determine where
3775 a user came from via NSS. Try the delete user script if this fails
3776 meaning the user did not exist in winbindd's list of accounts */
3777
3778 if ( winbind_delete_user( unix_user ) ) {
3779 DEBUG(3,("winbind_delete_user: removed user (%s)\n", unix_user));
3780 return 0;
3781 }
3782
3783
3784 /* fall back to 'delete user script' */
3785
3786 pstrcpy(del_script, lp_deluser_script());
3787 if (! *del_script)
3788 return -1;
3789 all_string_sub(del_script, "%u", unix_user, sizeof(pstring));
3790 ret = smbrun(del_script,NULL);
3791 DEBUG(3,("smb_delete_user: Running the command `%s' gave %d\n",del_script,ret));
3792
3793 return ret;
3794 }
3795
3796 /*********************************************************************
3797 _samr_delete_dom_user
3798 *********************************************************************/
3799
3800 NTSTATUS _samr_delete_dom_user(pipes_struct *p, SAMR_Q_DELETE_DOM_USER *q_u, SAMR_R_DELETE_DOM_USER *r_u )
3801 {
3802 DOM_SID user_sid;
3803 SAM_ACCOUNT *sam_pass=NULL;
3804 uint32 acc_granted;
3805
3806 DEBUG(5, ("_samr_delete_dom_user: %d\n", __LINE__));
3807
3808 /* Find the policy handle. Open a policy on it. */
3809 if (!get_lsa_policy_samr_sid(p, &q_u->user_pol, &user_sid, &acc_granted))
3810 return NT_STATUS_INVALID_HANDLE;
3811
3812 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS, "_samr_delete_dom_user"))) {
3813 return r_u->status;
3814 }
3815
3816 if (!sid_check_is_in_our_domain(&user_sid))
3817 return NT_STATUS_CANNOT_DELETE;
3818
3819 /* check if the user exists before trying to delete */
3820 pdb_init_sam(&sam_pass);
3821 if(!pdb_getsampwsid(sam_pass, &user_sid)) {
3822 DEBUG(5,("_samr_delete_dom_user:User %s doesn't exist.\n",
3823 sid_string_static(&user_sid)));
3824 pdb_free_sam(&sam_pass);
3825 return NT_STATUS_NO_SUCH_USER;
3826 }
3827
3828 /* delete the unix side */
3829 /*
3830 * note: we don't check if the delete really happened
3831 * as the script is not necessary present
3832 * and maybe the sysadmin doesn't want to delete the unix side
3833 */
3834 smb_delete_user(pdb_get_username(sam_pass));
3835
3836 /* and delete the samba side */
3837 if (!pdb_delete_sam_account(sam_pass)) {
3838 DEBUG(5,("_samr_delete_dom_user:Failed to delete entry for user %s.\n", pdb_get_username(sam_pass)));
3839 pdb_free_sam(&sam_pass);
3840 return NT_STATUS_CANNOT_DELETE;
3841 }
3842
3843 pdb_free_sam(&sam_pass);
3844
3845 if (!close_policy_hnd(p, &q_u->user_pol))
3846 return NT_STATUS_OBJECT_NAME_INVALID;
3847
3848 return NT_STATUS_OK;
3849 }
3850
3851 /*********************************************************************
3852 _samr_delete_dom_group
3853 *********************************************************************/
3854
3855 NTSTATUS _samr_delete_dom_group(pipes_struct *p, SAMR_Q_DELETE_DOM_GROUP *q_u, SAMR_R_DELETE_DOM_GROUP *r_u)
3856 {
3857 DOM_SID group_sid;
3858 DOM_SID dom_sid;
3859 uint32 group_rid;
3860 fstring group_sid_str;
3861 gid_t gid;
3862 struct group *grp;
3863 GROUP_MAP map;
3864 uint32 acc_granted;
3865
3866 DEBUG(5, ("samr_delete_dom_group: %d\n", __LINE__));
3867
3868 /* Find the policy handle. Open a policy on it. */
3869 if (!get_lsa_policy_samr_sid(p, &q_u->group_pol, &group_sid, &acc_granted))
3870 return NT_STATUS_INVALID_HANDLE;
3871
3872 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS, "_samr_delete_dom_group"))) {
3873 return r_u->status;
3874 }
3875
3876 sid_copy(&dom_sid, &group_sid);
3877 sid_to_string(group_sid_str, &dom_sid);
3878 sid_split_rid(&dom_sid, &group_rid);
3879
3880 DEBUG(10, ("sid is %s\n", group_sid_str));
3881
3882 /* we check if it's our SID before deleting */
3883 if (!sid_equal(&dom_sid, get_global_sam_sid()))
3884 return NT_STATUS_NO_SUCH_GROUP;
3885
3886 DEBUG(10, ("lookup on Domain SID\n"));
3887
3888 if(!get_domain_group_from_sid(group_sid, &map))
3889 return NT_STATUS_NO_SUCH_GROUP;
3890
3891 gid=map.gid;
3892
3893 /* check if group really exists */
3894 if ( (grp=getgrgid(gid)) == NULL)
3895 return NT_STATUS_NO_SUCH_GROUP;
3896
3897 /* we can delete the UNIX group */
3898 smb_delete_group(grp->gr_name);
3899
3900 /* check if the group has been successfully deleted */
3901 if ( (grp=getgrgid(gid)) != NULL)
3902 return NT_STATUS_ACCESS_DENIED;
3903
3904 if(!pdb_delete_group_mapping_entry(group_sid))
3905 return NT_STATUS_ACCESS_DENIED;
3906
3907 if (!close_policy_hnd(p, &q_u->group_pol))
3908 return NT_STATUS_OBJECT_NAME_INVALID;
3909
3910 return NT_STATUS_OK;
3911 }
3912
3913 /*********************************************************************
3914 _samr_delete_dom_alias
3915 *********************************************************************/
3916
3917 NTSTATUS _samr_delete_dom_alias(pipes_struct *p, SAMR_Q_DELETE_DOM_ALIAS *q_u, SAMR_R_DELETE_DOM_ALIAS *r_u)
3918 {
3919 DOM_SID alias_sid;
3920 DOM_SID dom_sid;
3921 uint32 alias_rid;
3922 fstring alias_sid_str;
3923 gid_t gid;
3924 struct group *grp;
3925 GROUP_MAP map;
3926 uint32 acc_granted;
3927
3928 DEBUG(5, ("_samr_delete_dom_alias: %d\n", __LINE__));
3929
3930 /* Find the policy handle. Open a policy on it. */
3931 if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
3932 return NT_STATUS_INVALID_HANDLE;
3933
3934 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS, "_samr_delete_dom_alias"))) {
3935 return r_u->status;
3936 }
3937
3938 sid_copy(&dom_sid, &alias_sid);
3939 sid_to_string(alias_sid_str, &dom_sid);
3940 sid_split_rid(&dom_sid, &alias_rid);
3941
3942 DEBUG(10, ("sid is %s\n", alias_sid_str));
3943
3944 /* we check if it's our SID before deleting */
3945 if (!sid_equal(&dom_sid, get_global_sam_sid()))
3946 return NT_STATUS_NO_SUCH_ALIAS;
3947
3948 DEBUG(10, ("lookup on Local SID\n"));
3949
3950 if(!get_local_group_from_sid(alias_sid, &map))
3951 return NT_STATUS_NO_SUCH_ALIAS;
3952
3953 gid=map.gid;
3954
3955 /* check if group really exists */
3956 if ( (grp=getgrgid(gid)) == NULL)
3957 return NT_STATUS_NO_SUCH_ALIAS;
3958
3959 /* we can delete the UNIX group */
3960 smb_delete_group(grp->gr_name);
3961
3962 /* check if the group has been successfully deleted */
3963 if ( (grp=getgrgid(gid)) != NULL)
3964 return NT_STATUS_ACCESS_DENIED;
3965
3966 /* don't check if we removed it as it could be an un-mapped group */
3967 pdb_delete_group_mapping_entry(alias_sid);
3968
3969 if (!close_policy_hnd(p, &q_u->alias_pol))
3970 return NT_STATUS_OBJECT_NAME_INVALID;
3971
3972 return NT_STATUS_OK;
3973 }
3974
3975 /*********************************************************************
3976 _samr_create_dom_group
3977 *********************************************************************/
3978
3979 NTSTATUS _samr_create_dom_group(pipes_struct *p, SAMR_Q_CREATE_DOM_GROUP *q_u, SAMR_R_CREATE_DOM_GROUP *r_u)
3980 {
3981 DOM_SID dom_sid;
3982 DOM_SID info_sid;
3983 fstring name;
3984 fstring sid_string;
3985 struct group *grp;
3986 struct samr_info *info;
3987 uint32 acc_granted;
3988 gid_t gid;
3989
3990 /* Find the policy handle. Open a policy on it. */
3991 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &dom_sid, &acc_granted))
3992 return NT_STATUS_INVALID_HANDLE;
3993
3994 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_CREATE_GROUP, "_samr_create_dom_group"))) {
3995 return r_u->status;
3996 }
3997
3998 if (!sid_equal(&dom_sid, get_global_sam_sid()))
3999 return NT_STATUS_ACCESS_DENIED;
4000
4001 /* TODO: check if allowed to create group and add a become_root/unbecome_root pair.*/
4002
4003 unistr2_to_ascii(name, &q_u->uni_acct_desc, sizeof(name)-1);
4004
4005 /* check if group already exist */
4006 if ((grp=getgrnam(name)) != NULL)
4007 return NT_STATUS_GROUP_EXISTS;
4008
4009 /* we can create the UNIX group */
4010 if (smb_create_group(name, &gid) != 0)
4011 return NT_STATUS_ACCESS_DENIED;
4012
4013 /* check if the group has been successfully created */
4014 if ((grp=getgrgid(gid)) == NULL)
4015 return NT_STATUS_ACCESS_DENIED;
4016
4017 r_u->rid=pdb_gid_to_group_rid(grp->gr_gid);
4018
4019 /* add the group to the mapping table */
4020 sid_copy(&info_sid, get_global_sam_sid());
4021 sid_append_rid(&info_sid, r_u->rid);
4022 sid_to_string(sid_string, &info_sid);
4023
4024 if(!add_initial_entry(grp->gr_gid, sid_string, SID_NAME_DOM_GRP, name, NULL))
4025 return NT_STATUS_ACCESS_DENIED;
4026
4027 if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
4028 return NT_STATUS_NO_MEMORY;
4029
4030 /* get a (unique) handle. open a policy on it. */
4031 if (!create_policy_hnd(p, &r_u->pol, free_samr_info, (void *)info))
4032 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4033
4034 return NT_STATUS_OK;
4035 }
4036
4037 /*********************************************************************
4038 _samr_create_dom_alias
4039 *********************************************************************/
4040
4041 NTSTATUS _samr_create_dom_alias(pipes_struct *p, SAMR_Q_CREATE_DOM_ALIAS *q_u, SAMR_R_CREATE_DOM_ALIAS *r_u)
4042 {
4043 DOM_SID dom_sid;
4044 DOM_SID info_sid;
4045 fstring name;
4046 fstring sid_string;
4047 struct group *grp;
4048 struct samr_info *info;
4049 uint32 acc_granted;
4050 gid_t gid;
4051
4052 /* Find the policy handle. Open a policy on it. */
4053 if (!get_lsa_policy_samr_sid(p, &q_u->dom_pol, &dom_sid, &acc_granted))
4054 return NT_STATUS_INVALID_HANDLE;
4055
4056 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_CREATE_ALIAS, "_samr_create_alias"))) {
4057 return r_u->status;
4058 }
4059
4060 if (!sid_equal(&dom_sid, get_global_sam_sid()))
4061 return NT_STATUS_ACCESS_DENIED;
4062
4063 /* TODO: check if allowed to create group and add a become_root/unbecome_root pair.*/
4064
4065 unistr2_to_ascii(name, &q_u->uni_acct_desc, sizeof(name)-1);
4066
4067 /* check if group already exists */
4068 if ( (grp=getgrnam(name)) != NULL)
4069 return NT_STATUS_GROUP_EXISTS;
4070
4071 /* we can create the UNIX group */
4072 if (smb_create_group(name, &gid) != 0)
4073 return NT_STATUS_ACCESS_DENIED;
4074
4075 /* check if the group has been successfully created */
4076 if ((grp=getgrgid(gid)) == NULL)
4077 return NT_STATUS_ACCESS_DENIED;
4078
4079 r_u->rid=pdb_gid_to_group_rid(grp->gr_gid);
4080
4081 sid_copy(&info_sid, get_global_sam_sid());
4082 sid_append_rid(&info_sid, r_u->rid);
4083 sid_to_string(sid_string, &info_sid);
4084
4085 /* add the group to the mapping table */
4086 if(!add_initial_entry(grp->gr_gid, sid_string, SID_NAME_ALIAS, name, NULL))
4087 return NT_STATUS_ACCESS_DENIED;
4088
4089 if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
4090 return NT_STATUS_NO_MEMORY;
4091
4092 /* get a (unique) handle. open a policy on it. */
4093 if (!create_policy_hnd(p, &r_u->alias_pol, free_samr_info, (void *)info))
4094 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4095
4096 return NT_STATUS_OK;
4097 }
4098
4099 /*********************************************************************
4100 _samr_query_groupinfo
4101
4102 sends the name/comment pair of a domain group
4103 level 1 send also the number of users of that group
4104 *********************************************************************/
4105
4106 NTSTATUS _samr_query_groupinfo(pipes_struct *p, SAMR_Q_QUERY_GROUPINFO *q_u, SAMR_R_QUERY_GROUPINFO *r_u)
4107 {
4108 DOM_SID group_sid;
4109 GROUP_MAP map;
4110 uid_t *uid=NULL;
4111 int num_uids=0;
4112 GROUP_INFO_CTR *ctr;
4113 uint32 acc_granted;
4114
4115 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
4116 return NT_STATUS_INVALID_HANDLE;
4117
4118 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_LOOKUP_INFO, "_samr_query_groupinfo"))) {
4119 return r_u->status;
4120 }
4121
4122 if (!get_domain_group_from_sid(group_sid, &map))
4123 return NT_STATUS_INVALID_HANDLE;
4124
4125 ctr=(GROUP_INFO_CTR *)talloc_zero(p->mem_ctx, sizeof(GROUP_INFO_CTR));
4126 if (ctr==NULL)
4127 return NT_STATUS_NO_MEMORY;
4128
4129 switch (q_u->switch_level) {
4130 case 1:
4131 ctr->switch_value1 = 1;
4132 if(!get_uid_list_of_group(map.gid, &uid, &num_uids))
4133 return NT_STATUS_NO_SUCH_GROUP;
4134 init_samr_group_info1(&ctr->group.info1, map.nt_name, map.comment, num_uids);
4135 SAFE_FREE(uid);
4136 break;
4137 case 3:
4138 ctr->switch_value1 = 3;
4139 init_samr_group_info3(&ctr->group.info3);
4140 break;
4141 case 4:
4142 ctr->switch_value1 = 4;
4143 init_samr_group_info4(&ctr->group.info4, map.comment);
4144 break;
4145 default:
4146 return NT_STATUS_INVALID_INFO_CLASS;
4147 }
4148
4149 init_samr_r_query_groupinfo(r_u, ctr, NT_STATUS_OK);
4150
4151 return NT_STATUS_OK;
4152 }
4153
4154 /*********************************************************************
4155 _samr_set_groupinfo
4156
4157 update a domain group's comment.
4158 *********************************************************************/
4159
4160 NTSTATUS _samr_set_groupinfo(pipes_struct *p, SAMR_Q_SET_GROUPINFO *q_u, SAMR_R_SET_GROUPINFO *r_u)
4161 {
4162 DOM_SID group_sid;
4163 GROUP_MAP map;
4164 GROUP_INFO_CTR *ctr;
4165 uint32 acc_granted;
4166
4167 if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
4168 return NT_STATUS_INVALID_HANDLE;
4169
4170 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_SET_INFO, "_samr_set_groupinfo"))) {
4171 return r_u->status;
4172 }
4173
4174 if (!get_domain_group_from_sid(group_sid, &map))
4175 return NT_STATUS_NO_SUCH_GROUP;
4176
4177 ctr=q_u->ctr;
4178
4179 switch (ctr->switch_value1) {
4180 case 1:
4181 unistr2_to_ascii(map.comment, &(ctr->group.info1.uni_acct_desc), sizeof(map.comment)-1);
4182 break;
4183 case 4:
4184 unistr2_to_ascii(map.comment, &(ctr->group.info4.uni_acct_desc), sizeof(map.comment)-1);
4185 break;
4186 default:
4187 return NT_STATUS_INVALID_INFO_CLASS;
4188 }
4189
4190 if(!pdb_update_group_mapping_entry(&map)) {
4191 return NT_STATUS_NO_SUCH_GROUP;
4192 }
4193
4194 return NT_STATUS_OK;
4195 }
4196
4197 /*********************************************************************
4198 _samr_set_aliasinfo
4199
4200 update an alias's comment.
4201 *********************************************************************/
4202
4203 NTSTATUS _samr_set_aliasinfo(pipes_struct *p, SAMR_Q_SET_ALIASINFO *q_u, SAMR_R_SET_ALIASINFO *r_u)
4204 {
4205 DOM_SID group_sid;
4206 GROUP_MAP map;
4207 ALIAS_INFO_CTR *ctr;
4208 uint32 acc_granted;
4209
4210 if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &group_sid, &acc_granted))
4211 return NT_STATUS_INVALID_HANDLE;
4212
4213 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_SET_INFO, "_samr_set_aliasinfo"))) {
4214 return r_u->status;
4215 }
4216
4217 if (!get_local_group_from_sid(group_sid, &map))
4218 return NT_STATUS_NO_SUCH_GROUP;
4219
4220 ctr=&q_u->ctr;
4221
4222 switch (ctr->switch_value1) {
4223 case 3:
4224 unistr2_to_ascii(map.comment, &(ctr->alias.info3.uni_acct_desc), sizeof(map.comment)-1);
4225 break;
4226 default:
4227 return NT_STATUS_INVALID_INFO_CLASS;
4228 }
4229
4230 if(!pdb_update_group_mapping_entry(&map)) {
4231 return NT_STATUS_NO_SUCH_GROUP;
4232 }
4233
4234 return NT_STATUS_OK;
4235 }
4236
4237 /*********************************************************************
4238 _samr_get_dom_pwinfo
4239 *********************************************************************/
4240
4241 NTSTATUS _samr_get_dom_pwinfo(pipes_struct *p, SAMR_Q_GET_DOM_PWINFO *q_u, SAMR_R_GET_DOM_PWINFO *r_u)
4242 {
4243 /* Perform access check. Since this rpc does not require a
4244 policy handle it will not be caught by the access checks on
4245 SAMR_CONNECT or SAMR_CONNECT_ANON. */
4246
4247 if (!pipe_access_check(p)) {
4248 DEBUG(3, ("access denied to samr_get_dom_pwinfo\n"));
4249 r_u->status = NT_STATUS_ACCESS_DENIED;
4250 return r_u->status;
4251 }
4252
4253 /* Actually, returning zeros here works quite well :-). */
4254
4255 return NT_STATUS_OK;
4256 }
4257
4258 /*********************************************************************
4259 _samr_open_group
4260 *********************************************************************/
4261
4262 NTSTATUS _samr_open_group(pipes_struct *p, SAMR_Q_OPEN_GROUP *q_u, SAMR_R_OPEN_GROUP *r_u)
4263 {
4264 DOM_SID sid;
4265 DOM_SID info_sid;
4266 GROUP_MAP map;
4267 struct samr_info *info;
4268 SEC_DESC *psd = NULL;
4269 uint32 acc_granted;
4270 uint32 des_access = q_u->access_mask;
4271 size_t sd_size;
4272 NTSTATUS status;
4273 fstring sid_string;
4274
4275 if (!get_lsa_policy_samr_sid(p, &q_u->domain_pol, &sid, &acc_granted))
4276 return NT_STATUS_INVALID_HANDLE;
4277
4278 if (!NT_STATUS_IS_OK(status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_open_group"))) {
4279 return status;
4280 }
4281
4282 /*check if access can be granted as requested by client. */
4283 samr_make_grp_obj_sd(p->mem_ctx, &psd, &sd_size);
4284 se_map_generic(&des_access,&grp_generic_mapping);
4285 if (!NT_STATUS_IS_OK(status =
4286 access_check_samr_object(psd, p->pipe_user.nt_user_token,
4287 des_access, &acc_granted, "_samr_open_group"))) {
4288 return status;
4289 }
4290
4291
4292 /* this should not be hard-coded like this */
4293 if (!sid_equal(&sid, get_global_sam_sid()))
4294 return NT_STATUS_ACCESS_DENIED;
4295
4296 sid_copy(&info_sid, get_global_sam_sid());
4297 sid_append_rid(&info_sid, q_u->rid_group);
4298 sid_to_string(sid_string, &info_sid);
4299
4300 if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
4301 return NT_STATUS_NO_MEMORY;
4302
4303 info->acc_granted = acc_granted;
4304
4305 DEBUG(10, ("_samr_open_group:Opening SID: %s\n", sid_string));
4306
4307 /* check if that group really exists */
4308 if (!get_domain_group_from_sid(info->sid, &map))
4309 return NT_STATUS_NO_SUCH_GROUP;
4310
4311 /* get a (unique) handle. open a policy on it. */
4312 if (!create_policy_hnd(p, &r_u->pol, free_samr_info, (void *)info))
4313 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4314
4315 return NT_STATUS_OK;
4316 }
4317
4318 /*********************************************************************
4319 _samr_remove_user_foreign_domain
4320 *********************************************************************/
4321
4322 NTSTATUS _samr_remove_user_foreign_domain(pipes_struct *p,
4323 SAMR_Q_REMOVE_USER_FOREIGN_DOMAIN *q_u,
4324 SAMR_R_REMOVE_USER_FOREIGN_DOMAIN *r_u)
4325 {
4326 DOM_SID user_sid, dom_sid;
4327 SAM_ACCOUNT *sam_pass=NULL;
4328 uint32 acc_granted;
4329
4330 sid_copy( &user_sid, &q_u->sid.sid );
4331
4332 DEBUG(5,("_samr_remove_user_foreign_domain: removing user [%s]\n",
4333 sid_string_static(&user_sid)));
4334
4335 /* Find the policy handle. Open a policy on it. */
4336
4337 if (!get_lsa_policy_samr_sid(p, &q_u->dom_pol, &dom_sid, &acc_granted))
4338 return NT_STATUS_INVALID_HANDLE;
4339
4340 if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted,
4341 STD_RIGHT_DELETE_ACCESS, "_samr_remove_user_foreign_domain")))
4342 {
4343 return r_u->status;
4344 }
4345
4346 if ( !sid_check_is_in_our_domain(&user_sid) ) {
4347 DEBUG(5,("_samr_remove_user_foreign_domain: user not is our domain!\n"));
4348 return NT_STATUS_NO_SUCH_USER;
4349 }
4350
4351 /* check if the user exists before trying to delete */
4352
4353 pdb_init_sam(&sam_pass);
4354
4355 if ( !pdb_getsampwsid(sam_pass, &user_sid) ) {
4356
4357 DEBUG(5,("_samr_remove_user_foreign_domain:User %s doesn't exist.\n",
4358 sid_string_static(&user_sid)));
4359
4360 pdb_free_sam(&sam_pass);
4361
4362 return NT_STATUS_NO_SUCH_USER;
4363 }
4364
4365 /*
4366 * delete the unix side
4367 *
4368 * note: we don't check if the delete really happened
4369 * as the script is not necessary present
4370 * and maybe the sysadmin doesn't want to delete the unix side
4371 */
4372
4373 smb_delete_user(pdb_get_username(sam_pass));
4374
4375 /* and delete the samba side */
4376
4377 if ( !pdb_delete_sam_account(sam_pass) ) {
4378
4379 DEBUG(5,("_samr_delete_dom_user:Failed to delete entry for user %s.\n", pdb_get_username(sam_pass)));
4380 pdb_free_sam(&sam_pass);
4381
4382 return NT_STATUS_CANNOT_DELETE;
4383 }
4384
4385 pdb_free_sam(&sam_pass);
4386
4387 return NT_STATUS_OK;
4388 }
4389
4390 /*******************************************************************
4391 _samr_unknown_2e
4392 ********************************************************************/
4393
4394 NTSTATUS _samr_unknown_2e(pipes_struct *p, SAMR_Q_UNKNOWN_2E *q_u, SAMR_R_UNKNOWN_2E *r_u)
4395 {
4396 struct samr_info *info = NULL;
4397 SAM_UNK_CTR *ctr;
4398 uint32 min_pass_len,pass_hist,flag;
4399 time_t u_expire, u_min_age;
4400 NTTIME nt_expire, nt_min_age;
4401
4402 time_t u_lock_duration, u_reset_time;
4403 NTTIME nt_lock_duration, nt_reset_time;
4404 uint32 lockout;
4405
4406 time_t u_logout;
4407 NTTIME nt_logout;
4408
4409 uint32 num_users=0, num_groups=0, num_aliases=0;
4410
4411 uint32 account_policy_temp;
4412
4413 if ((ctr = (SAM_UNK_CTR *)talloc_zero(p->mem_ctx, sizeof(SAM_UNK_CTR))) == NULL)
4414 return NT_STATUS_NO_MEMORY;
4415
4416 ZERO_STRUCTP(ctr);
4417
4418 r_u->status = NT_STATUS_OK;
4419
4420 DEBUG(5,("_samr_unknown_2e: %d\n", __LINE__));
4421
4422 /* find the policy handle. open a policy on it. */
4423 if (!find_policy_by_hnd(p, &q_u->domain_pol, (void **)&info))
4424 return NT_STATUS_INVALID_HANDLE;
4425
4426 switch (q_u->switch_value) {
4427 case 0x01:
4428 account_policy_get(AP_MIN_PASSWORD_LEN, &account_policy_temp);
4429 min_pass_len = account_policy_temp;
4430
4431 account_policy_get(AP_PASSWORD_HISTORY, &account_policy_temp);
4432 pass_hist = account_policy_temp;
4433
4434 account_policy_get(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp);
4435 flag = account_policy_temp;
4436
4437 account_policy_get(AP_MAX_PASSWORD_AGE, &account_policy_temp);
4438 u_expire = account_policy_temp;
4439
4440 account_policy_get(AP_MIN_PASSWORD_AGE, &account_policy_temp);
4441 u_min_age = account_policy_temp;
4442
4443 unix_to_nt_time_abs(&nt_expire, u_expire);
4444 unix_to_nt_time_abs(&nt_min_age, u_min_age);
4445
4446 init_unk_info1(&ctr->info.inf1, (uint16)min_pass_len, (uint16)pass_hist,
4447 flag, nt_expire, nt_min_age);
4448 break;
4449 case 0x02:
4450 become_root();
4451 r_u->status=load_sampwd_entries(info, ACB_NORMAL, False);
4452 unbecome_root();
4453 if (!NT_STATUS_IS_OK(r_u->status)) {
4454 DEBUG(5, ("_samr_unknown_2e: load_sampwd_entries failed\n"));
4455 return r_u->status;
4456 }
4457 num_users=info->disp_info.num_user_account;
4458 free_samr_db(info);
4459
4460 r_u->status=load_group_domain_entries(info, get_global_sam_sid());
4461 if (NT_STATUS_IS_ERR(r_u->status)) {
4462 DEBUG(5, ("_samr_unknown_2e: load_group_domain_entries failed\n"));
4463 return r_u->status;
4464 }
4465 num_groups=info->disp_info.num_group_account;
4466 free_samr_db(info);
4467
4468 /* The time call below is to get a sequence number for the sam. FIXME !!! JRA. */
4469 init_unk_info2(&ctr->info.inf2, lp_workgroup(), global_myname(), (uint32) time(NULL),
4470 num_users, num_groups, num_aliases);
4471 break;
4472 case 0x03:
4473 account_policy_get(AP_TIME_TO_LOGOUT, &account_policy_temp);
4474 u_logout = account_policy_temp;
4475
4476 unix_to_nt_time_abs(&nt_logout, u_logout);
4477
4478 init_unk_info3(&ctr->info.inf3, nt_logout);
4479 break;
4480 case 0x05:
4481 init_unk_info5(&ctr->info.inf5, global_myname());
4482 break;
4483 case 0x06:
4484 init_unk_info6(&ctr->info.inf6);
4485 break;
4486 case 0x07:
4487 init_unk_info7(&ctr->info.inf7);
4488 break;
4489 case 0x0c:
4490 account_policy_get(AP_LOCK_ACCOUNT_DURATION, &account_policy_temp);
4491 u_lock_duration = account_policy_temp;
4492
4493 account_policy_get(AP_RESET_COUNT_TIME, &account_policy_temp);
4494 u_reset_time = account_policy_temp;
4495
4496 account_policy_get(AP_BAD_ATTEMPT_LOCKOUT, &account_policy_temp);
4497 lockout = account_policy_temp;
4498
4499 unix_to_nt_time_abs(&nt_lock_duration, u_lock_duration);
4500 unix_to_nt_time_abs(&nt_reset_time, u_reset_time);
4501
4502 init_unk_info12(&ctr->info.inf12, nt_lock_duration, nt_reset_time, (uint16)lockout);
4503 break;
4504 default:
4505 return NT_STATUS_INVALID_INFO_CLASS;
4506 }
4507
4508 init_samr_r_samr_unknown_2e(r_u, q_u->switch_value, ctr, NT_STATUS_OK);
4509
4510 DEBUG(5,("_samr_unknown_2e: %d\n", __LINE__));
4511
4512 return r_u->status;
4513 }
4514
4515 /*******************************************************************
4516 _samr_
4517 ********************************************************************/
4518
4519 NTSTATUS _samr_set_dom_info(pipes_struct *p, SAMR_Q_SET_DOMAIN_INFO *q_u, SAMR_R_SET_DOMAIN_INFO *r_u)
4520 {
4521 time_t u_expire, u_min_age;
4522 time_t u_logout;
4523 time_t u_lock_duration, u_reset_time;
4524
4525 r_u->status = NT_STATUS_OK;
4526
4527 DEBUG(5,("_samr_set_dom_info: %d\n", __LINE__));
4528
4529 /* find the policy handle. open a policy on it. */
4530 if (!find_policy_by_hnd(p, &q_u->domain_pol, NULL))
4531 return NT_STATUS_INVALID_HANDLE;
4532
4533 DEBUG(5,("_samr_set_dom_info: switch_value: %d\n", q_u->switch_value));
4534
4535 switch (q_u->switch_value) {
4536 case 0x01:
4537 u_expire=nt_time_to_unix_abs(&q_u->ctr->info.inf1.expire);
4538 u_min_age=nt_time_to_unix_abs(&q_u->ctr->info.inf1.min_passwordage);
4539
4540 account_policy_set(AP_MIN_PASSWORD_LEN, (uint32)q_u->ctr->info.inf1.min_length_password);
4541 account_policy_set(AP_PASSWORD_HISTORY, (uint32)q_u->ctr->info.inf1.password_history);
4542 account_policy_set(AP_USER_MUST_LOGON_TO_CHG_PASS, (uint32)q_u->ctr->info.inf1.flag);
4543 account_policy_set(AP_MAX_PASSWORD_AGE, (int)u_expire);
4544 account_policy_set(AP_MIN_PASSWORD_AGE, (int)u_min_age);
4545 break;
4546 case 0x02:
4547 break;
4548 case 0x03:
4549 u_logout=nt_time_to_unix_abs(&q_u->ctr->info.inf3.logout);
4550 account_policy_set(AP_TIME_TO_LOGOUT, (int)u_logout);
4551 break;
4552 case 0x05:
4553 break;
4554 case 0x06:
4555 break;
4556 case 0x07:
4557 break;
4558 case 0x0c:
4559 u_lock_duration=nt_time_to_unix_abs(&q_u->ctr->info.inf12.duration);
4560 u_reset_time=nt_time_to_unix_abs(&q_u->ctr->info.inf12.reset_count);
4561
4562 account_policy_set(AP_LOCK_ACCOUNT_DURATION, (int)u_lock_duration);
4563 account_policy_set(AP_RESET_COUNT_TIME, (int)u_reset_time);
4564 account_policy_set(AP_BAD_ATTEMPT_LOCKOUT, (uint32)q_u->ctr->info.inf12.bad_attempt_lockout);
4565 break;
4566 default:
4567 return NT_STATUS_INVALID_INFO_CLASS;
4568 }
4569
4570 init_samr_r_set_domain_info(r_u, NT_STATUS_OK);
4571
4572 DEBUG(5,("_samr_set_dom_info: %d\n", __LINE__));
4573
4574 return r_u->status;
4575 }
reg import