2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Jeremy Allison 2001, 2006.
8 * Copyright (C) Rafal Szczesniak 2002,
9 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
10 * Copyright (C) Simo Sorce 2003.
11 * Copyright (C) Gerald (Jerry) Carter 2005.
12 * Copyright (C) Volker Lendecke 2005.
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 3 of the License, or
17 * (at your option) any later version.
19 * This program is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
24 * You should have received a copy of the GNU General Public License
25 * along with this program; if not, see <http://www.gnu.org/licenses/>.
28 /* This is the implementation of the lsa server code. */
33 #define DBGC_CLASS DBGC_RPC_SRV
42 const struct generic_mapping lsa_generic_mapping
= {
49 /*******************************************************************
50 Function to free the per handle data.
51 ********************************************************************/
53 static void free_lsa_info(void *ptr
)
55 struct lsa_info
*lsa
= (struct lsa_info
*)ptr
;
60 /***************************************************************************
62 ***************************************************************************/
64 static void init_dom_query_3(DOM_QUERY_3
*d_q
, const char *dom_name
, DOM_SID
*dom_sid
)
66 d_q
->buffer_dom_name
= (dom_name
!= NULL
) ? 1 : 0; /* domain buffer pointer */
67 d_q
->buffer_dom_sid
= (dom_sid
!= NULL
) ? 1 : 0; /* domain sid pointer */
69 /* this string is supposed to be non-null terminated. */
70 /* But the maxlen in this UNISTR2 must include the terminating null. */
71 init_unistr2(&d_q
->uni_domain_name
, dom_name
, UNI_BROKEN_NON_NULL
);
74 * I'm not sure why this really odd combination of length
75 * values works, but it does appear to. I need to look at
76 * this *much* more closely - but at the moment leave alone
77 * until it's understood. This allows a W2k client to join
78 * a domain with both odd and even length names... JRA.
83 * The two fields below probably are reversed in meaning, ie.
84 * the first field is probably the str_len, the second the max
85 * len. Both are measured in bytes anyway.
88 d_q
->uni_dom_str_len
= d_q
->uni_domain_name
.uni_max_len
* 2;
89 d_q
->uni_dom_max_len
= d_q
->uni_domain_name
.uni_str_len
* 2;
92 init_dom_sid2(&d_q
->dom_sid
, dom_sid
);
95 /***************************************************************************
97 ***************************************************************************/
99 static void init_dom_query_5(DOM_QUERY_5
*d_q
, const char *dom_name
, DOM_SID
*dom_sid
)
101 init_dom_query_3(d_q
, dom_name
, dom_sid
);
104 /***************************************************************************
105 init_dom_ref - adds a domain if it's not already in, returns the index.
106 ***************************************************************************/
108 static int init_dom_ref(DOM_R_REF
*ref
, const char *dom_name
, DOM_SID
*dom_sid
)
112 if (dom_name
!= NULL
) {
113 for (num
= 0; num
< ref
->num_ref_doms_1
; num
++) {
114 if (sid_equal(dom_sid
, &ref
->ref_dom
[num
].ref_dom
.sid
))
118 num
= ref
->num_ref_doms_1
;
121 if (num
>= MAX_REF_DOMAINS
) {
122 /* index not found, already at maximum domain limit */
126 ref
->num_ref_doms_1
= num
+1;
127 ref
->ptr_ref_dom
= 1;
128 ref
->max_entries
= MAX_REF_DOMAINS
;
129 ref
->num_ref_doms_2
= num
+1;
131 ref
->hdr_ref_dom
[num
].ptr_dom_sid
= 1; /* dom sid cannot be NULL. */
133 init_unistr2(&ref
->ref_dom
[num
].uni_dom_name
, dom_name
, UNI_FLAGS_NONE
);
134 init_uni_hdr(&ref
->hdr_ref_dom
[num
].hdr_dom_name
, &ref
->ref_dom
[num
].uni_dom_name
);
136 init_dom_sid2(&ref
->ref_dom
[num
].ref_dom
, dom_sid
);
141 /***************************************************************************
142 lookup_lsa_rids. Must be called as root for lookup_name to work.
143 ***************************************************************************/
145 static NTSTATUS
lookup_lsa_rids(TALLOC_CTX
*mem_ctx
,
151 uint32
*pmapped_count
)
153 uint32 mapped_count
, i
;
155 SMB_ASSERT(num_entries
<= MAX_LOOKUP_SIDS
);
160 for (i
= 0; i
< num_entries
; i
++) {
166 enum lsa_SidType type
= SID_NAME_UNKNOWN
;
168 /* Split name into domain and user component */
170 full_name
= rpcstr_pull_unistr2_talloc(mem_ctx
, &name
[i
]);
171 if (full_name
== NULL
) {
172 DEBUG(0, ("pull_ucs2_talloc failed\n"));
173 return NT_STATUS_NO_MEMORY
;
176 DEBUG(5, ("lookup_lsa_rids: looking up name %s\n", full_name
));
178 /* We can ignore the result of lookup_name, it will not touch
179 "type" if it's not successful */
181 lookup_name(mem_ctx
, full_name
, flags
, &domain
, NULL
,
186 case SID_NAME_DOM_GRP
:
187 case SID_NAME_DOMAIN
:
189 case SID_NAME_WKN_GRP
:
190 DEBUG(5, ("init_lsa_rids: %s found\n", full_name
));
191 /* Leave these unchanged */
194 /* Don't hand out anything but the list above */
195 DEBUG(5, ("init_lsa_rids: %s not found\n", full_name
));
196 type
= SID_NAME_UNKNOWN
;
203 if (type
!= SID_NAME_UNKNOWN
) {
204 sid_split_rid(&sid
, &rid
);
205 dom_idx
= init_dom_ref(ref
, domain
, &sid
);
209 init_dom_rid(&prid
[i
], rid
, type
, dom_idx
);
212 *pmapped_count
= mapped_count
;
216 /***************************************************************************
217 lookup_lsa_sids. Must be called as root for lookup_name to work.
218 ***************************************************************************/
220 static NTSTATUS
lookup_lsa_sids(TALLOC_CTX
*mem_ctx
,
222 LSA_TRANSLATED_SID3
*trans_sids
,
226 uint32
*pmapped_count
)
228 uint32 mapped_count
, i
;
230 SMB_ASSERT(num_entries
<= MAX_LOOKUP_SIDS
);
235 for (i
= 0; i
< num_entries
; i
++) {
241 enum lsa_SidType type
= SID_NAME_UNKNOWN
;
243 /* Split name into domain and user component */
245 full_name
= rpcstr_pull_unistr2_talloc(mem_ctx
, &name
[i
]);
246 if (full_name
== NULL
) {
247 DEBUG(0, ("pull_ucs2_talloc failed\n"));
248 return NT_STATUS_NO_MEMORY
;
251 DEBUG(5, ("init_lsa_sids: looking up name %s\n", full_name
));
253 /* We can ignore the result of lookup_name, it will not touch
254 "type" if it's not successful */
256 lookup_name(mem_ctx
, full_name
, flags
, &domain
, NULL
,
261 case SID_NAME_DOM_GRP
:
262 case SID_NAME_DOMAIN
:
264 case SID_NAME_WKN_GRP
:
265 DEBUG(5, ("init_lsa_sids: %s found\n", full_name
));
266 /* Leave these unchanged */
269 /* Don't hand out anything but the list above */
270 DEBUG(5, ("init_lsa_sids: %s not found\n", full_name
));
271 type
= SID_NAME_UNKNOWN
;
278 if (type
!= SID_NAME_UNKNOWN
) {
280 sid_copy(&domain_sid
, &sid
);
281 sid_split_rid(&domain_sid
, &rid
);
282 dom_idx
= init_dom_ref(ref
, domain
, &domain_sid
);
286 /* Initialize the LSA_TRANSLATED_SID3 return. */
287 trans_sids
[i
].sid_type
= type
;
288 trans_sids
[i
].sid2
= TALLOC_P(mem_ctx
, DOM_SID2
);
289 if (trans_sids
[i
].sid2
== NULL
) {
290 return NT_STATUS_NO_MEMORY
;
292 init_dom_sid2(trans_sids
[i
].sid2
, &sid
);
293 trans_sids
[i
].sid_idx
= dom_idx
;
296 *pmapped_count
= mapped_count
;
300 /***************************************************************************
301 init_reply_lookup_names
302 ***************************************************************************/
304 static void init_reply_lookup_names(LSA_R_LOOKUP_NAMES
*r_l
,
305 DOM_R_REF
*ref
, uint32 num_entries
,
306 DOM_RID
*rid
, uint32 mapped_count
)
308 r_l
->ptr_dom_ref
= 1;
311 r_l
->num_entries
= num_entries
;
312 r_l
->ptr_entries
= 1;
313 r_l
->num_entries2
= num_entries
;
316 r_l
->mapped_count
= mapped_count
;
319 /***************************************************************************
320 init_reply_lookup_names2
321 ***************************************************************************/
323 static void init_reply_lookup_names2(LSA_R_LOOKUP_NAMES2
*r_l
,
324 DOM_R_REF
*ref
, uint32 num_entries
,
325 DOM_RID2
*rid
, uint32 mapped_count
)
327 r_l
->ptr_dom_ref
= 1;
330 r_l
->num_entries
= num_entries
;
331 r_l
->ptr_entries
= 1;
332 r_l
->num_entries2
= num_entries
;
335 r_l
->mapped_count
= mapped_count
;
338 /***************************************************************************
339 init_reply_lookup_names3
340 ***************************************************************************/
342 static void init_reply_lookup_names3(LSA_R_LOOKUP_NAMES3
*r_l
,
343 DOM_R_REF
*ref
, uint32 num_entries
,
344 LSA_TRANSLATED_SID3
*trans_sids
, uint32 mapped_count
)
346 r_l
->ptr_dom_ref
= 1;
349 r_l
->num_entries
= num_entries
;
350 r_l
->ptr_entries
= 1;
351 r_l
->num_entries2
= num_entries
;
352 r_l
->trans_sids
= trans_sids
;
354 r_l
->mapped_count
= mapped_count
;
357 /***************************************************************************
358 init_reply_lookup_names4
359 ***************************************************************************/
361 static void init_reply_lookup_names4(LSA_R_LOOKUP_NAMES4
*r_l
,
362 DOM_R_REF
*ref
, uint32 num_entries
,
363 LSA_TRANSLATED_SID3
*trans_sids
, uint32 mapped_count
)
365 r_l
->ptr_dom_ref
= 1;
368 r_l
->num_entries
= num_entries
;
369 r_l
->ptr_entries
= 1;
370 r_l
->num_entries2
= num_entries
;
371 r_l
->trans_sids
= trans_sids
;
373 r_l
->mapped_count
= mapped_count
;
376 /***************************************************************************
377 Init_reply_lookup_sids.
378 ***************************************************************************/
380 static void init_reply_lookup_sids2(LSA_R_LOOKUP_SIDS2
*r_l
,
384 r_l
->ptr_dom_ref
= ref
? 1 : 0;
386 r_l
->mapped_count
= mapped_count
;
389 /***************************************************************************
390 Init_reply_lookup_sids.
391 ***************************************************************************/
393 static void init_reply_lookup_sids3(LSA_R_LOOKUP_SIDS3
*r_l
,
397 r_l
->ptr_dom_ref
= ref
? 1 : 0;
399 r_l
->mapped_count
= mapped_count
;
402 /***************************************************************************
403 Init_reply_lookup_sids.
404 ***************************************************************************/
406 static NTSTATUS
init_reply_lookup_sids(TALLOC_CTX
*mem_ctx
,
407 LSA_R_LOOKUP_SIDS
*r_l
,
409 LSA_TRANS_NAME_ENUM2
*names
,
412 LSA_TRANS_NAME_ENUM
*oldnames
= &r_l
->names
;
414 oldnames
->num_entries
= names
->num_entries
;
415 oldnames
->ptr_trans_names
= names
->ptr_trans_names
;
416 oldnames
->num_entries2
= names
->num_entries2
;
417 oldnames
->uni_name
= names
->uni_name
;
419 if (names
->num_entries
) {
422 oldnames
->name
= TALLOC_ARRAY(mem_ctx
, LSA_TRANS_NAME
, names
->num_entries
);
424 if (!oldnames
->name
) {
425 return NT_STATUS_NO_MEMORY
;
427 for (i
= 0; i
< names
->num_entries
; i
++) {
428 oldnames
->name
[i
].sid_name_use
= names
->name
[i
].sid_name_use
;
429 oldnames
->name
[i
].hdr_name
= names
->name
[i
].hdr_name
;
430 oldnames
->name
[i
].domain_idx
= names
->name
[i
].domain_idx
;
434 r_l
->ptr_dom_ref
= ref
? 1 : 0;
436 r_l
->mapped_count
= mapped_count
;
440 static NTSTATUS
lsa_get_generic_sd(TALLOC_CTX
*mem_ctx
, SEC_DESC
**sd
, size_t *sd_size
)
442 DOM_SID local_adm_sid
;
450 init_sec_access(&mask
, POLICY_EXECUTE
);
451 init_sec_ace(&ace
[0], &global_sid_World
, SEC_ACE_TYPE_ACCESS_ALLOWED
, mask
, 0);
453 sid_copy(&adm_sid
, get_global_sam_sid());
454 sid_append_rid(&adm_sid
, DOMAIN_GROUP_RID_ADMINS
);
455 init_sec_access(&mask
, POLICY_ALL_ACCESS
);
456 init_sec_ace(&ace
[1], &adm_sid
, SEC_ACE_TYPE_ACCESS_ALLOWED
, mask
, 0);
458 sid_copy(&local_adm_sid
, &global_sid_Builtin
);
459 sid_append_rid(&local_adm_sid
, BUILTIN_ALIAS_RID_ADMINS
);
460 init_sec_access(&mask
, POLICY_ALL_ACCESS
);
461 init_sec_ace(&ace
[2], &local_adm_sid
, SEC_ACE_TYPE_ACCESS_ALLOWED
, mask
, 0);
463 if((psa
= make_sec_acl(mem_ctx
, NT4_ACL_REVISION
, 3, ace
)) == NULL
)
464 return NT_STATUS_NO_MEMORY
;
466 if((*sd
= make_sec_desc(mem_ctx
, SEC_DESC_REVISION
, SEC_DESC_SELF_RELATIVE
, &adm_sid
, NULL
, NULL
, psa
, sd_size
)) == NULL
)
467 return NT_STATUS_NO_MEMORY
;
472 #if 0 /* AD DC work in ongoing in Samba 4 */
474 /***************************************************************************
476 ***************************************************************************/
478 static void init_dns_dom_info(LSA_DNS_DOM_INFO
*r_l
, const char *nb_name
,
479 const char *dns_name
, const char *forest_name
,
480 struct GUID
*dom_guid
, DOM_SID
*dom_sid
)
482 if (nb_name
&& *nb_name
) {
483 init_unistr2(&r_l
->uni_nb_dom_name
, nb_name
, UNI_FLAGS_NONE
);
484 init_uni_hdr(&r_l
->hdr_nb_dom_name
, &r_l
->uni_nb_dom_name
);
485 r_l
->hdr_nb_dom_name
.uni_max_len
+= 2;
486 r_l
->uni_nb_dom_name
.uni_max_len
+= 1;
489 if (dns_name
&& *dns_name
) {
490 init_unistr2(&r_l
->uni_dns_dom_name
, dns_name
, UNI_FLAGS_NONE
);
491 init_uni_hdr(&r_l
->hdr_dns_dom_name
, &r_l
->uni_dns_dom_name
);
492 r_l
->hdr_dns_dom_name
.uni_max_len
+= 2;
493 r_l
->uni_dns_dom_name
.uni_max_len
+= 1;
496 if (forest_name
&& *forest_name
) {
497 init_unistr2(&r_l
->uni_forest_name
, forest_name
, UNI_FLAGS_NONE
);
498 init_uni_hdr(&r_l
->hdr_forest_name
, &r_l
->uni_forest_name
);
499 r_l
->hdr_forest_name
.uni_max_len
+= 2;
500 r_l
->uni_forest_name
.uni_max_len
+= 1;
503 /* how do we init the guid ? probably should write an init fn */
505 memcpy(&r_l
->dom_guid
, dom_guid
, sizeof(struct GUID
));
509 r_l
->ptr_dom_sid
= 1;
510 init_dom_sid2(&r_l
->dom_sid
, dom_sid
);
513 #endif /* AD DC work in ongoing in Samba 4 */
516 /***************************************************************************
518 ***************************************************************************/
520 NTSTATUS
_lsa_open_policy2(pipes_struct
*p
, LSA_Q_OPEN_POL2
*q_u
, LSA_R_OPEN_POL2
*r_u
)
522 struct lsa_info
*info
;
523 SEC_DESC
*psd
= NULL
;
525 uint32 des_access
=q_u
->des_access
;
530 /* map the generic bits to the lsa policy ones */
531 se_map_generic(&des_access
, &lsa_generic_mapping
);
533 /* get the generic lsa policy SD until we store it */
534 lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
536 if(!se_access_check(psd
, p
->pipe_user
.nt_user_token
, des_access
, &acc_granted
, &status
)) {
537 if (p
->pipe_user
.ut
.uid
!= sec_initial_uid()) {
540 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
541 acc_granted
, des_access
));
542 DEBUGADD(4,("but overwritten by euid == 0\n"));
545 /* This is needed for lsa_open_account and rpcclient .... :-) */
547 if (p
->pipe_user
.ut
.uid
== sec_initial_uid())
548 acc_granted
= POLICY_ALL_ACCESS
;
550 /* associate the domain SID with the (unique) handle. */
551 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
552 return NT_STATUS_NO_MEMORY
;
555 sid_copy(&info
->sid
,get_global_sam_sid());
556 info
->access
= acc_granted
;
558 /* set up the LSA QUERY INFO response */
559 if (!create_policy_hnd(p
, &r_u
->pol
, free_lsa_info
, (void *)info
))
560 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
565 /***************************************************************************
567 ***************************************************************************/
569 NTSTATUS
_lsa_open_policy(pipes_struct
*p
, LSA_Q_OPEN_POL
*q_u
, LSA_R_OPEN_POL
*r_u
)
571 struct lsa_info
*info
;
572 SEC_DESC
*psd
= NULL
;
574 uint32 des_access
=q_u
->des_access
;
579 /* map the generic bits to the lsa policy ones */
580 se_map_generic(&des_access
, &lsa_generic_mapping
);
582 /* get the generic lsa policy SD until we store it */
583 lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
585 if(!se_access_check(psd
, p
->pipe_user
.nt_user_token
, des_access
, &acc_granted
, &status
)) {
586 if (geteuid() != 0) {
589 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
590 acc_granted
, des_access
));
591 DEBUGADD(4,("but overwritten by euid == 0\n"));
592 acc_granted
= des_access
;
595 /* associate the domain SID with the (unique) handle. */
596 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
597 return NT_STATUS_NO_MEMORY
;
600 sid_copy(&info
->sid
,get_global_sam_sid());
601 info
->access
= acc_granted
;
603 /* set up the LSA QUERY INFO response */
604 if (!create_policy_hnd(p
, &r_u
->pol
, free_lsa_info
, (void *)info
))
605 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
610 /***************************************************************************
611 _lsa_enum_trust_dom - this needs fixing to do more than return NULL ! JRA.
613 ***************************************************************************/
615 NTSTATUS
_lsa_enum_trust_dom(pipes_struct
*p
, LSA_Q_ENUM_TRUST_DOM
*q_u
,
616 LSA_R_ENUM_TRUST_DOM
*r_u
)
618 struct lsa_info
*info
;
620 struct trustdom_info
**domains
;
623 * preferred length is set to 5 as a "our" preferred length
624 * nt sets this parameter to 2
625 * update (20.08.2002): it's not preferred length, but preferred size!
626 * it needs further investigation how to optimally choose this value
628 uint32 max_num_domains
=
629 q_u
->preferred_len
< 5 ? q_u
->preferred_len
: 10;
634 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
635 return NT_STATUS_INVALID_HANDLE
;
637 /* check if the user have enough rights */
638 if (!(info
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
639 return NT_STATUS_ACCESS_DENIED
;
641 nt_status
= pdb_enum_trusteddoms(p
->mem_ctx
, &num_domains
, &domains
);
643 if (!NT_STATUS_IS_OK(nt_status
)) {
647 if (q_u
->enum_context
< num_domains
) {
648 num_thistime
= MIN(num_domains
, max_num_domains
);
650 r_u
->status
= STATUS_MORE_ENTRIES
;
652 if (q_u
->enum_context
+ num_thistime
> num_domains
) {
653 num_thistime
= num_domains
- q_u
->enum_context
;
654 r_u
->status
= NT_STATUS_OK
;
657 next_idx
= q_u
->enum_context
+ num_thistime
;
660 next_idx
= 0xffffffff;
661 r_u
->status
= NT_STATUS_NO_MORE_ENTRIES
;
664 /* set up the lsa_enum_trust_dom response */
666 init_r_enum_trust_dom(p
->mem_ctx
, r_u
, next_idx
,
667 num_thistime
, domains
+q_u
->enum_context
);
672 /***************************************************************************
673 _lsa_query_info. See the POLICY_INFOMATION_CLASS docs at msdn.
674 ***************************************************************************/
676 NTSTATUS
_lsa_query_info(pipes_struct
*p
, LSA_Q_QUERY_INFO
*q_u
, LSA_R_QUERY_INFO
*r_u
)
678 struct lsa_info
*handle
;
679 LSA_INFO_CTR
*ctr
= &r_u
->ctr
;
684 r_u
->status
= NT_STATUS_OK
;
686 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
687 return NT_STATUS_INVALID_HANDLE
;
689 switch (q_u
->info_class
) {
693 uint32 policy_def
= LSA_AUDIT_POLICY_ALL
;
695 /* check if the user have enough rights */
696 if (!(handle
->access
& POLICY_VIEW_AUDIT_INFORMATION
)) {
697 DEBUG(10,("_lsa_query_info: insufficient access rights\n"));
698 return NT_STATUS_ACCESS_DENIED
;
701 /* fake info: We audit everything. ;) */
702 ctr
->info
.id2
.ptr
= 1;
703 ctr
->info
.id2
.auditing_enabled
= True
;
704 ctr
->info
.id2
.count1
= ctr
->info
.id2
.count2
= LSA_AUDIT_NUM_CATEGORIES
;
706 if ((ctr
->info
.id2
.auditsettings
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, uint32
, LSA_AUDIT_NUM_CATEGORIES
)) == NULL
)
707 return NT_STATUS_NO_MEMORY
;
709 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_ACCOUNT_MANAGEMENT
] = policy_def
;
710 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_FILE_AND_OBJECT_ACCESS
] = policy_def
;
711 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_LOGON
] = policy_def
;
712 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_PROCCESS_TRACKING
] = policy_def
;
713 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_SECURITY_POLICY_CHANGES
] = policy_def
;
714 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_SYSTEM
] = policy_def
;
715 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_USE_OF_USER_RIGHTS
] = policy_def
;
720 /* check if the user have enough rights */
721 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
722 return NT_STATUS_ACCESS_DENIED
;
724 /* Request PolicyPrimaryDomainInformation. */
725 switch (lp_server_role()) {
726 case ROLE_DOMAIN_PDC
:
727 case ROLE_DOMAIN_BDC
:
728 name
= get_global_sam_name();
729 sid
= get_global_sam_sid();
731 case ROLE_DOMAIN_MEMBER
:
732 name
= lp_workgroup();
733 /* We need to return the Domain SID here. */
734 if (secrets_fetch_domain_sid(lp_workgroup(), &domain_sid
))
737 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
739 case ROLE_STANDALONE
:
740 name
= lp_workgroup();
744 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
746 init_dom_query_3(&r_u
->ctr
.info
.id3
, name
, sid
);
749 /* check if the user have enough rights */
750 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
751 return NT_STATUS_ACCESS_DENIED
;
753 /* Request PolicyAccountDomainInformation. */
754 name
= get_global_sam_name();
755 sid
= get_global_sam_sid();
756 init_dom_query_5(&r_u
->ctr
.info
.id5
, name
, sid
);
759 /* check if the user have enough rights */
760 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
761 return NT_STATUS_ACCESS_DENIED
;
763 switch (lp_server_role()) {
764 case ROLE_DOMAIN_BDC
:
766 * only a BDC is a backup controller
767 * of the domain, it controls.
769 ctr
->info
.id6
.server_role
= 2;
773 * any other role is a primary
774 * of the domain, it controls.
776 ctr
->info
.id6
.server_role
= 3;
781 DEBUG(0,("_lsa_query_info: unknown info level in Lsa Query: %d\n", q_u
->info_class
));
782 r_u
->status
= NT_STATUS_INVALID_INFO_CLASS
;
786 if (NT_STATUS_IS_OK(r_u
->status
)) {
787 r_u
->dom_ptr
= 0x22000000; /* bizarre */
788 ctr
->info_class
= q_u
->info_class
;
794 /***************************************************************************
795 _lsa_lookup_sids_internal
796 ***************************************************************************/
798 static NTSTATUS
_lsa_lookup_sids_internal(pipes_struct
*p
,
799 uint16 level
, /* input */
800 int num_sids
, /* input */
801 const DOM_SID2
*sid
, /* input */
802 DOM_R_REF
**pp_ref
, /* output */
803 LSA_TRANS_NAME_ENUM2
*names
, /* input/output */
804 uint32
*pp_mapped_count
)
808 const DOM_SID
**sids
= NULL
;
809 DOM_R_REF
*ref
= NULL
;
810 uint32 mapped_count
= 0;
811 struct lsa_dom_info
*dom_infos
= NULL
;
812 struct lsa_name_info
*name_infos
= NULL
;
814 *pp_mapped_count
= 0;
822 sids
= TALLOC_ARRAY(p
->mem_ctx
, const DOM_SID
*, num_sids
);
823 ref
= TALLOC_ZERO_P(p
->mem_ctx
, DOM_R_REF
);
825 if (sids
== NULL
|| ref
== NULL
) {
826 return NT_STATUS_NO_MEMORY
;
829 for (i
=0; i
<num_sids
; i
++) {
830 sids
[i
] = &sid
[i
].sid
;
833 status
= lookup_sids(p
->mem_ctx
, num_sids
, sids
, level
,
834 &dom_infos
, &name_infos
);
836 if (!NT_STATUS_IS_OK(status
)) {
840 names
->name
= TALLOC_ARRAY(p
->mem_ctx
, LSA_TRANS_NAME2
, num_sids
);
841 names
->uni_name
= TALLOC_ARRAY(p
->mem_ctx
, UNISTR2
, num_sids
);
842 if ((names
->name
== NULL
) || (names
->uni_name
== NULL
)) {
843 return NT_STATUS_NO_MEMORY
;
846 for (i
=0; i
<MAX_REF_DOMAINS
; i
++) {
848 if (!dom_infos
[i
].valid
) {
852 if (init_dom_ref(ref
, dom_infos
[i
].name
,
853 &dom_infos
[i
].sid
) != i
) {
854 DEBUG(0, ("Domain %s mentioned twice??\n",
856 return NT_STATUS_INTERNAL_ERROR
;
860 for (i
=0; i
<num_sids
; i
++) {
861 struct lsa_name_info
*name
= &name_infos
[i
];
863 if (name
->type
== SID_NAME_UNKNOWN
) {
865 /* Unknown sids should return the string
866 * representation of the SID. Windows 2003 behaves
867 * rather erratic here, in many cases it returns the
868 * RID as 8 bytes hex, in others it returns the full
869 * SID. We (Jerry/VL) could not figure out which the
870 * hard cases are, so leave it with the SID. */
871 name
->name
= talloc_asprintf(p
->mem_ctx
, "%s",
872 sid_string_static(sids
[i
]));
873 if (name
->name
== NULL
) {
874 return NT_STATUS_NO_MEMORY
;
879 init_lsa_trans_name2(&names
->name
[i
], &names
->uni_name
[i
],
880 name
->type
, name
->name
, name
->dom_idx
);
883 names
->num_entries
= num_sids
;
884 names
->ptr_trans_names
= 1;
885 names
->num_entries2
= num_sids
;
887 status
= NT_STATUS_NONE_MAPPED
;
888 if (mapped_count
> 0) {
889 status
= (mapped_count
< num_sids
) ?
890 STATUS_SOME_UNMAPPED
: NT_STATUS_OK
;
893 DEBUG(10, ("num_sids %d, mapped_count %d, status %s\n",
894 num_sids
, mapped_count
, nt_errstr(status
)));
896 *pp_mapped_count
= mapped_count
;
902 /***************************************************************************
904 ***************************************************************************/
906 NTSTATUS
_lsa_lookup_sids(pipes_struct
*p
,
907 LSA_Q_LOOKUP_SIDS
*q_u
,
908 LSA_R_LOOKUP_SIDS
*r_u
)
910 struct lsa_info
*handle
;
911 int num_sids
= q_u
->sids
.num_entries
;
912 uint32 mapped_count
= 0;
913 DOM_R_REF
*ref
= NULL
;
914 LSA_TRANS_NAME_ENUM2 names
;
917 if ((q_u
->level
< 1) || (q_u
->level
> 6)) {
918 return NT_STATUS_INVALID_PARAMETER
;
921 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
)) {
922 return NT_STATUS_INVALID_HANDLE
;
925 /* check if the user has enough rights */
926 if (!(handle
->access
& POLICY_LOOKUP_NAMES
)) {
927 return NT_STATUS_ACCESS_DENIED
;
930 if (num_sids
> MAX_LOOKUP_SIDS
) {
931 DEBUG(5,("_lsa_lookup_sids: limit of %d exceeded, requested %d\n",
932 MAX_LOOKUP_SIDS
, num_sids
));
933 return NT_STATUS_NONE_MAPPED
;
936 r_u
->status
= _lsa_lookup_sids_internal(p
,
944 /* Convert from LSA_TRANS_NAME_ENUM2 to LSA_TRANS_NAME_ENUM */
946 status
= init_reply_lookup_sids(p
->mem_ctx
, r_u
, ref
, &names
, mapped_count
);
947 if (!NT_STATUS_IS_OK(status
)) {
953 /***************************************************************************
955 ***************************************************************************/
957 NTSTATUS
_lsa_lookup_sids2(pipes_struct
*p
,
958 LSA_Q_LOOKUP_SIDS2
*q_u
,
959 LSA_R_LOOKUP_SIDS2
*r_u
)
961 struct lsa_info
*handle
;
962 int num_sids
= q_u
->sids
.num_entries
;
963 uint32 mapped_count
= 0;
964 DOM_R_REF
*ref
= NULL
;
966 if ((q_u
->level
< 1) || (q_u
->level
> 6)) {
967 return NT_STATUS_INVALID_PARAMETER
;
970 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
)) {
971 return NT_STATUS_INVALID_HANDLE
;
974 /* check if the user have enough rights */
975 if (!(handle
->access
& POLICY_LOOKUP_NAMES
)) {
976 return NT_STATUS_ACCESS_DENIED
;
979 if (num_sids
> MAX_LOOKUP_SIDS
) {
980 DEBUG(5,("_lsa_lookup_sids2: limit of %d exceeded, requested %d\n",
981 MAX_LOOKUP_SIDS
, num_sids
));
982 return NT_STATUS_NONE_MAPPED
;
985 r_u
->status
= _lsa_lookup_sids_internal(p
,
993 init_reply_lookup_sids2(r_u
, ref
, mapped_count
);
997 /***************************************************************************
999 ***************************************************************************/
1001 NTSTATUS
_lsa_lookup_sids3(pipes_struct
*p
,
1002 LSA_Q_LOOKUP_SIDS3
*q_u
,
1003 LSA_R_LOOKUP_SIDS3
*r_u
)
1005 int num_sids
= q_u
->sids
.num_entries
;
1006 uint32 mapped_count
= 0;
1007 DOM_R_REF
*ref
= NULL
;
1009 if ((q_u
->level
< 1) || (q_u
->level
> 6)) {
1010 return NT_STATUS_INVALID_PARAMETER
;
1013 /* No policy handle on this call. Restrict to crypto connections. */
1014 if (p
->auth
.auth_type
!= PIPE_AUTH_TYPE_SCHANNEL
) {
1015 DEBUG(0,("_lsa_lookup_sids3: client %s not using schannel for netlogon\n",
1016 get_remote_machine_name() ));
1017 return NT_STATUS_INVALID_PARAMETER
;
1020 if (num_sids
> MAX_LOOKUP_SIDS
) {
1021 DEBUG(5,("_lsa_lookup_sids3: limit of %d exceeded, requested %d\n",
1022 MAX_LOOKUP_SIDS
, num_sids
));
1023 return NT_STATUS_NONE_MAPPED
;
1026 r_u
->status
= _lsa_lookup_sids_internal(p
,
1034 init_reply_lookup_sids3(r_u
, ref
, mapped_count
);
1038 /***************************************************************************
1039 lsa_reply_lookup_names
1040 ***************************************************************************/
1042 NTSTATUS
_lsa_lookup_names(pipes_struct
*p
,LSA_Q_LOOKUP_NAMES
*q_u
, LSA_R_LOOKUP_NAMES
*r_u
)
1044 struct lsa_info
*handle
;
1045 UNISTR2
*names
= q_u
->uni_name
;
1046 uint32 num_entries
= q_u
->num_entries
;
1049 uint32 mapped_count
= 0;
1052 if (num_entries
> MAX_LOOKUP_SIDS
) {
1053 num_entries
= MAX_LOOKUP_SIDS
;
1054 DEBUG(5,("_lsa_lookup_names: truncating name lookup list to %d\n", num_entries
));
1057 /* Probably the lookup_level is some sort of bitmask. */
1058 if (q_u
->lookup_level
== 1) {
1059 flags
= LOOKUP_NAME_ALL
;
1062 ref
= TALLOC_ZERO_P(p
->mem_ctx
, DOM_R_REF
);
1064 return NT_STATUS_NO_MEMORY
;
1068 rids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, DOM_RID
, num_entries
);
1070 return NT_STATUS_NO_MEMORY
;
1076 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
)) {
1077 r_u
->status
= NT_STATUS_INVALID_HANDLE
;
1081 /* check if the user have enough rights */
1082 if (!(handle
->access
& POLICY_LOOKUP_NAMES
)) {
1083 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
1087 /* set up the LSA Lookup RIDs response */
1088 become_root(); /* lookup_name can require root privs */
1089 r_u
->status
= lookup_lsa_rids(p
->mem_ctx
, ref
, rids
, num_entries
,
1090 names
, flags
, &mapped_count
);
1095 if (NT_STATUS_IS_OK(r_u
->status
) && (num_entries
!= 0) ) {
1096 if (mapped_count
== 0)
1097 r_u
->status
= NT_STATUS_NONE_MAPPED
;
1098 else if (mapped_count
!= num_entries
)
1099 r_u
->status
= STATUS_SOME_UNMAPPED
;
1102 init_reply_lookup_names(r_u
, ref
, num_entries
, rids
, mapped_count
);
1106 /***************************************************************************
1107 lsa_reply_lookup_names2
1108 ***************************************************************************/
1110 NTSTATUS
_lsa_lookup_names2(pipes_struct
*p
, LSA_Q_LOOKUP_NAMES2
*q_u
, LSA_R_LOOKUP_NAMES2
*r_u
)
1112 struct lsa_info
*handle
;
1113 UNISTR2
*names
= q_u
->uni_name
;
1114 uint32 num_entries
= q_u
->num_entries
;
1119 uint32 mapped_count
= 0;
1122 if (num_entries
> MAX_LOOKUP_SIDS
) {
1123 num_entries
= MAX_LOOKUP_SIDS
;
1124 DEBUG(5,("_lsa_lookup_names2: truncating name lookup list to %d\n", num_entries
));
1127 /* Probably the lookup_level is some sort of bitmask. */
1128 if (q_u
->lookup_level
== 1) {
1129 flags
= LOOKUP_NAME_ALL
;
1132 ref
= TALLOC_ZERO_P(p
->mem_ctx
, DOM_R_REF
);
1134 r_u
->status
= NT_STATUS_NO_MEMORY
;
1135 return NT_STATUS_NO_MEMORY
;
1139 rids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, DOM_RID
, num_entries
);
1140 rids2
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, DOM_RID2
, num_entries
);
1141 if ((rids
== NULL
) || (rids2
== NULL
)) {
1142 r_u
->status
= NT_STATUS_NO_MEMORY
;
1143 return NT_STATUS_NO_MEMORY
;
1150 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
)) {
1151 r_u
->status
= NT_STATUS_INVALID_HANDLE
;
1155 /* check if the user have enough rights */
1156 if (!(handle
->access
& POLICY_LOOKUP_NAMES
)) {
1157 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
1161 /* set up the LSA Lookup RIDs response */
1162 become_root(); /* lookup_name can require root privs */
1163 r_u
->status
= lookup_lsa_rids(p
->mem_ctx
, ref
, rids
, num_entries
,
1164 names
, flags
, &mapped_count
);
1169 if (NT_STATUS_IS_OK(r_u
->status
)) {
1170 if (mapped_count
== 0) {
1171 r_u
->status
= NT_STATUS_NONE_MAPPED
;
1172 } else if (mapped_count
!= num_entries
) {
1173 r_u
->status
= STATUS_SOME_UNMAPPED
;
1177 /* Convert the rids array to rids2. */
1178 for (i
= 0; i
< num_entries
; i
++) {
1179 rids2
[i
].type
= rids
[i
].type
;
1180 rids2
[i
].rid
= rids
[i
].rid
;
1181 rids2
[i
].rid_idx
= rids
[i
].rid_idx
;
1182 rids2
[i
].unknown
= 0;
1185 init_reply_lookup_names2(r_u
, ref
, num_entries
, rids2
, mapped_count
);
1189 /***************************************************************************
1190 lsa_reply_lookup_names3.
1191 ***************************************************************************/
1193 NTSTATUS
_lsa_lookup_names3(pipes_struct
*p
, LSA_Q_LOOKUP_NAMES3
*q_u
, LSA_R_LOOKUP_NAMES3
*r_u
)
1195 struct lsa_info
*handle
;
1196 UNISTR2
*names
= q_u
->uni_name
;
1197 uint32 num_entries
= q_u
->num_entries
;
1198 DOM_R_REF
*ref
= NULL
;
1199 LSA_TRANSLATED_SID3
*trans_sids
= NULL
;
1200 uint32 mapped_count
= 0;
1203 if (num_entries
> MAX_LOOKUP_SIDS
) {
1204 num_entries
= MAX_LOOKUP_SIDS
;
1205 DEBUG(5,("_lsa_lookup_names3: truncating name lookup list to %d\n", num_entries
));
1208 /* Probably the lookup_level is some sort of bitmask. */
1209 if (q_u
->lookup_level
== 1) {
1210 flags
= LOOKUP_NAME_ALL
;
1213 ref
= TALLOC_ZERO_P(p
->mem_ctx
, DOM_R_REF
);
1215 return NT_STATUS_NO_MEMORY
;
1218 trans_sids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, LSA_TRANSLATED_SID3
, num_entries
);
1220 return NT_STATUS_NO_MEMORY
;
1226 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
)) {
1227 r_u
->status
= NT_STATUS_INVALID_HANDLE
;
1231 /* check if the user have enough rights */
1232 if (!(handle
->access
& POLICY_LOOKUP_NAMES
)) {
1233 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
1237 /* set up the LSA Lookup SIDs response */
1238 become_root(); /* lookup_name can require root privs */
1239 r_u
->status
= lookup_lsa_sids(p
->mem_ctx
, ref
, trans_sids
, num_entries
,
1240 names
, flags
, &mapped_count
);
1245 if (NT_STATUS_IS_OK(r_u
->status
)) {
1246 if (mapped_count
== 0) {
1247 r_u
->status
= NT_STATUS_NONE_MAPPED
;
1248 } else if (mapped_count
!= num_entries
) {
1249 r_u
->status
= STATUS_SOME_UNMAPPED
;
1253 init_reply_lookup_names3(r_u
, ref
, num_entries
, trans_sids
, mapped_count
);
1257 /***************************************************************************
1258 lsa_reply_lookup_names4.
1259 ***************************************************************************/
1261 NTSTATUS
_lsa_lookup_names4(pipes_struct
*p
, LSA_Q_LOOKUP_NAMES4
*q_u
, LSA_R_LOOKUP_NAMES4
*r_u
)
1263 UNISTR2
*names
= q_u
->uni_name
;
1264 uint32 num_entries
= q_u
->num_entries
;
1265 DOM_R_REF
*ref
= NULL
;
1266 LSA_TRANSLATED_SID3
*trans_sids
= NULL
;
1267 uint32 mapped_count
= 0;
1270 if (num_entries
> MAX_LOOKUP_SIDS
) {
1271 num_entries
= MAX_LOOKUP_SIDS
;
1272 DEBUG(5,("_lsa_lookup_names4: truncating name lookup list to %d\n", num_entries
));
1275 /* Probably the lookup_level is some sort of bitmask. */
1276 if (q_u
->lookup_level
== 1) {
1277 flags
= LOOKUP_NAME_ALL
;
1280 /* No policy handle on this call. Restrict to crypto connections. */
1281 if (p
->auth
.auth_type
!= PIPE_AUTH_TYPE_SCHANNEL
) {
1282 DEBUG(0,("_lsa_lookup_names4: client %s not using schannel for netlogon\n",
1283 get_remote_machine_name() ));
1284 return NT_STATUS_INVALID_PARAMETER
;
1287 ref
= TALLOC_ZERO_P(p
->mem_ctx
, DOM_R_REF
);
1289 return NT_STATUS_NO_MEMORY
;
1293 trans_sids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, LSA_TRANSLATED_SID3
, num_entries
);
1295 return NT_STATUS_NO_MEMORY
;
1301 /* set up the LSA Lookup SIDs response */
1302 become_root(); /* lookup_name can require root privs */
1303 r_u
->status
= lookup_lsa_sids(p
->mem_ctx
, ref
, trans_sids
, num_entries
,
1304 names
, flags
, &mapped_count
);
1307 if (NT_STATUS_IS_OK(r_u
->status
)) {
1308 if (mapped_count
== 0) {
1309 r_u
->status
= NT_STATUS_NONE_MAPPED
;
1310 } else if (mapped_count
!= num_entries
) {
1311 r_u
->status
= STATUS_SOME_UNMAPPED
;
1315 init_reply_lookup_names4(r_u
, ref
, num_entries
, trans_sids
, mapped_count
);
1319 /***************************************************************************
1320 _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
1321 ***************************************************************************/
1323 NTSTATUS
_lsa_Close(pipes_struct
*p
, struct lsa_Close
*r
)
1325 if (!find_policy_by_hnd(p
, r
->in
.handle
, NULL
)) {
1326 return NT_STATUS_INVALID_HANDLE
;
1329 close_policy_hnd(p
, r
->in
.handle
);
1330 return NT_STATUS_OK
;
1333 /***************************************************************************
1334 ***************************************************************************/
1336 NTSTATUS
_lsa_OpenSecret(pipes_struct
*p
, struct lsa_OpenSecret
*r
)
1338 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1341 /***************************************************************************
1342 ***************************************************************************/
1344 NTSTATUS
_lsa_OpenTrustedDomain(pipes_struct
*p
, struct lsa_OpenTrustedDomain
*r
)
1346 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1349 /***************************************************************************
1350 ***************************************************************************/
1352 NTSTATUS
_lsa_CreateTrustedDomain(pipes_struct
*p
, struct lsa_CreateTrustedDomain
*r
)
1354 return NT_STATUS_ACCESS_DENIED
;
1357 /***************************************************************************
1358 ***************************************************************************/
1360 NTSTATUS
_lsa_CreateSecret(pipes_struct
*p
, struct lsa_CreateSecret
*r
)
1362 return NT_STATUS_ACCESS_DENIED
;
1365 /***************************************************************************
1366 ***************************************************************************/
1368 NTSTATUS
_lsa_SetSecret(pipes_struct
*p
, struct lsa_SetSecret
*r
)
1370 return NT_STATUS_ACCESS_DENIED
;
1373 /***************************************************************************
1374 ***************************************************************************/
1376 NTSTATUS
_lsa_delete_object(pipes_struct
*p
, LSA_Q_DELETE_OBJECT
*q_u
, LSA_R_DELETE_OBJECT
*r_u
)
1378 return NT_STATUS_ACCESS_DENIED
;
1381 /***************************************************************************
1383 ***************************************************************************/
1385 NTSTATUS
_lsa_enum_privs(pipes_struct
*p
, LSA_Q_ENUM_PRIVS
*q_u
, LSA_R_ENUM_PRIVS
*r_u
)
1387 struct lsa_info
*handle
;
1389 uint32 enum_context
= q_u
->enum_context
;
1390 int num_privs
= count_all_privileges();
1391 LSA_PRIV_ENTRY
*entries
= NULL
;
1394 /* remember that the enum_context starts at 0 and not 1 */
1396 if ( enum_context
>= num_privs
)
1397 return NT_STATUS_NO_MORE_ENTRIES
;
1399 DEBUG(10,("_lsa_enum_privs: enum_context:%d total entries:%d\n",
1400 enum_context
, num_privs
));
1402 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1403 return NT_STATUS_INVALID_HANDLE
;
1405 /* check if the user have enough rights
1406 I don't know if it's the right one. not documented. */
1408 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
1409 return NT_STATUS_ACCESS_DENIED
;
1412 if ( !(entries
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, LSA_PRIV_ENTRY
, num_privs
)) )
1413 return NT_STATUS_NO_MEMORY
;
1418 for (i
= 0; i
< num_privs
; i
++) {
1419 if( i
< enum_context
) {
1420 init_unistr2(&entries
[i
].name
, NULL
, UNI_FLAGS_NONE
);
1421 init_uni_hdr(&entries
[i
].hdr_name
, &entries
[i
].name
);
1423 entries
[i
].luid_low
= 0;
1424 entries
[i
].luid_high
= 0;
1426 init_unistr2(&entries
[i
].name
, privs
[i
].name
, UNI_FLAGS_NONE
);
1427 init_uni_hdr(&entries
[i
].hdr_name
, &entries
[i
].name
);
1429 luid
= get_privilege_luid( &privs
[i
].se_priv
);
1431 entries
[i
].luid_low
= luid
.luid
.low
;
1432 entries
[i
].luid_high
= luid
.luid
.high
;
1436 enum_context
= num_privs
;
1438 init_lsa_r_enum_privs(r_u
, enum_context
, num_privs
, entries
);
1440 return NT_STATUS_OK
;
1443 /***************************************************************************
1444 _lsa_priv_get_dispname.
1445 ***************************************************************************/
1447 NTSTATUS
_lsa_priv_get_dispname(pipes_struct
*p
, LSA_Q_PRIV_GET_DISPNAME
*q_u
, LSA_R_PRIV_GET_DISPNAME
*r_u
)
1449 struct lsa_info
*handle
;
1451 const char *description
;
1453 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1454 return NT_STATUS_INVALID_HANDLE
;
1456 /* check if the user have enough rights */
1459 * I don't know if it's the right one. not documented.
1461 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
1462 return NT_STATUS_ACCESS_DENIED
;
1464 unistr2_to_ascii(name_asc
, &q_u
->name
, sizeof(name_asc
));
1466 DEBUG(10,("_lsa_priv_get_dispname: name = %s\n", name_asc
));
1468 description
= get_privilege_dispname( name_asc
);
1470 if ( description
) {
1471 DEBUG(10,("_lsa_priv_get_dispname: display name = %s\n", description
));
1473 init_unistr2(&r_u
->desc
, description
, UNI_FLAGS_NONE
);
1474 init_uni_hdr(&r_u
->hdr_desc
, &r_u
->desc
);
1476 r_u
->ptr_info
= 0xdeadbeef;
1477 r_u
->lang_id
= q_u
->lang_id
;
1479 return NT_STATUS_OK
;
1481 DEBUG(10,("_lsa_priv_get_dispname: doesn't exist\n"));
1485 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1489 /***************************************************************************
1491 ***************************************************************************/
1493 NTSTATUS
_lsa_enum_accounts(pipes_struct
*p
, LSA_Q_ENUM_ACCOUNTS
*q_u
, LSA_R_ENUM_ACCOUNTS
*r_u
)
1495 struct lsa_info
*handle
;
1497 int i
, j
, num_entries
;
1498 LSA_SID_ENUM
*sids
=&r_u
->sids
;
1501 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1502 return NT_STATUS_INVALID_HANDLE
;
1504 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
1505 return NT_STATUS_ACCESS_DENIED
;
1510 /* The only way we can currently find out all the SIDs that have been
1511 privileged is to scan all privileges */
1513 if (!NT_STATUS_IS_OK(ret
= privilege_enumerate_accounts(&sid_list
, &num_entries
))) {
1517 if (q_u
->enum_context
>= num_entries
)
1518 return NT_STATUS_NO_MORE_ENTRIES
;
1520 if (num_entries
-q_u
->enum_context
) {
1521 sids
->ptr_sid
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, uint32
, num_entries
-q_u
->enum_context
);
1522 sids
->sid
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, DOM_SID2
, num_entries
-q_u
->enum_context
);
1524 if (sids
->ptr_sid
==NULL
|| sids
->sid
==NULL
) {
1525 SAFE_FREE(sid_list
);
1526 return NT_STATUS_NO_MEMORY
;
1529 for (i
= q_u
->enum_context
, j
= 0; i
< num_entries
; i
++, j
++) {
1530 init_dom_sid2(&(*sids
).sid
[j
], &sid_list
[i
]);
1531 (*sids
).ptr_sid
[j
] = 1;
1534 sids
->ptr_sid
= NULL
;
1538 talloc_free(sid_list
);
1540 init_lsa_r_enum_accounts(r_u
, num_entries
);
1542 return NT_STATUS_OK
;
1546 NTSTATUS
_lsa_unk_get_connuser(pipes_struct
*p
, LSA_Q_UNK_GET_CONNUSER
*q_u
, LSA_R_UNK_GET_CONNUSER
*r_u
)
1548 fstring username
, domname
;
1549 user_struct
*vuser
= get_valid_user_struct(p
->vuid
);
1552 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
1554 fstrcpy(username
, vuser
->user
.smb_name
);
1555 fstrcpy(domname
, vuser
->user
.domain
);
1557 r_u
->ptr_user_name
= 1;
1558 init_unistr2(&r_u
->uni2_user_name
, username
, UNI_STR_TERMINATE
);
1559 init_uni_hdr(&r_u
->hdr_user_name
, &r_u
->uni2_user_name
);
1563 r_u
->ptr_dom_name
= 1;
1564 init_unistr2(&r_u
->uni2_dom_name
, domname
, UNI_STR_TERMINATE
);
1565 init_uni_hdr(&r_u
->hdr_dom_name
, &r_u
->uni2_dom_name
);
1567 r_u
->status
= NT_STATUS_OK
;
1572 /***************************************************************************
1574 ***************************************************************************/
1576 NTSTATUS
_lsa_create_account(pipes_struct
*p
, LSA_Q_CREATEACCOUNT
*q_u
, LSA_R_CREATEACCOUNT
*r_u
)
1578 struct lsa_info
*handle
;
1579 struct lsa_info
*info
;
1581 /* find the connection policy handle. */
1582 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1583 return NT_STATUS_INVALID_HANDLE
;
1585 /* check if the user have enough rights */
1588 * I don't know if it's the right one. not documented.
1589 * but guessed with rpcclient.
1591 if (!(handle
->access
& POLICY_GET_PRIVATE_INFORMATION
))
1592 return NT_STATUS_ACCESS_DENIED
;
1594 /* check to see if the pipe_user is a Domain Admin since
1595 account_pol.tdb was already opened as root, this is all we have */
1597 if ( !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1598 return NT_STATUS_ACCESS_DENIED
;
1600 if ( is_privileged_sid( &q_u
->sid
.sid
) )
1601 return NT_STATUS_OBJECT_NAME_COLLISION
;
1603 /* associate the user/group SID with the (unique) handle. */
1605 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
1606 return NT_STATUS_NO_MEMORY
;
1609 info
->sid
= q_u
->sid
.sid
;
1610 info
->access
= q_u
->access
;
1612 /* get a (unique) handle. open a policy on it. */
1613 if (!create_policy_hnd(p
, &r_u
->pol
, free_lsa_info
, (void *)info
))
1614 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1616 return privilege_create_account( &info
->sid
);
1620 /***************************************************************************
1622 ***************************************************************************/
1624 NTSTATUS
_lsa_open_account(pipes_struct
*p
, LSA_Q_OPENACCOUNT
*q_u
, LSA_R_OPENACCOUNT
*r_u
)
1626 struct lsa_info
*handle
;
1627 struct lsa_info
*info
;
1629 /* find the connection policy handle. */
1630 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1631 return NT_STATUS_INVALID_HANDLE
;
1633 /* check if the user have enough rights */
1636 * I don't know if it's the right one. not documented.
1637 * but guessed with rpcclient.
1639 if (!(handle
->access
& POLICY_GET_PRIVATE_INFORMATION
))
1640 return NT_STATUS_ACCESS_DENIED
;
1642 /* TODO: Fis the parsing routine before reenabling this check! */
1644 if (!lookup_sid(&handle
->sid
, dom_name
, name
, &type
))
1645 return NT_STATUS_ACCESS_DENIED
;
1647 /* associate the user/group SID with the (unique) handle. */
1648 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
1649 return NT_STATUS_NO_MEMORY
;
1652 info
->sid
= q_u
->sid
.sid
;
1653 info
->access
= q_u
->access
;
1655 /* get a (unique) handle. open a policy on it. */
1656 if (!create_policy_hnd(p
, &r_u
->pol
, free_lsa_info
, (void *)info
))
1657 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1659 return NT_STATUS_OK
;
1662 /***************************************************************************
1663 For a given SID, enumerate all the privilege this account has.
1664 ***************************************************************************/
1666 NTSTATUS
_lsa_enum_privsaccount(pipes_struct
*p
, prs_struct
*ps
, LSA_Q_ENUMPRIVSACCOUNT
*q_u
, LSA_R_ENUMPRIVSACCOUNT
*r_u
)
1668 struct lsa_info
*info
=NULL
;
1670 PRIVILEGE_SET privileges
;
1672 /* find the connection policy handle. */
1673 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1674 return NT_STATUS_INVALID_HANDLE
;
1676 if ( !get_privileges_for_sids( &mask
, &info
->sid
, 1 ) )
1677 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1679 privilege_set_init( &privileges
);
1681 if ( se_priv_to_privilege_set( &privileges
, &mask
) ) {
1683 DEBUG(10,("_lsa_enum_privsaccount: %s has %d privileges\n",
1684 sid_string_static(&info
->sid
), privileges
.count
));
1686 r_u
->status
= init_lsa_r_enum_privsaccount(ps
->mem_ctx
, r_u
, privileges
.set
, privileges
.count
, 0);
1689 r_u
->status
= NT_STATUS_NO_SUCH_PRIVILEGE
;
1691 privilege_set_free( &privileges
);
1696 /***************************************************************************
1698 ***************************************************************************/
1700 NTSTATUS
_lsa_getsystemaccount(pipes_struct
*p
, LSA_Q_GETSYSTEMACCOUNT
*q_u
, LSA_R_GETSYSTEMACCOUNT
*r_u
)
1702 struct lsa_info
*info
=NULL
;
1704 /* find the connection policy handle. */
1706 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1707 return NT_STATUS_INVALID_HANDLE
;
1709 if (!lookup_sid(p
->mem_ctx
, &info
->sid
, NULL
, NULL
, NULL
))
1710 return NT_STATUS_ACCESS_DENIED
;
1713 0x01 -> Log on locally
1714 0x02 -> Access this computer from network
1715 0x04 -> Log on as a batch job
1716 0x10 -> Log on as a service
1718 they can be ORed together
1721 r_u
->access
= PR_LOG_ON_LOCALLY
| PR_ACCESS_FROM_NETWORK
;
1723 return NT_STATUS_OK
;
1726 /***************************************************************************
1727 update the systemaccount information
1728 ***************************************************************************/
1730 NTSTATUS
_lsa_setsystemaccount(pipes_struct
*p
, LSA_Q_SETSYSTEMACCOUNT
*q_u
, LSA_R_SETSYSTEMACCOUNT
*r_u
)
1732 struct lsa_info
*info
=NULL
;
1734 r_u
->status
= NT_STATUS_OK
;
1736 /* find the connection policy handle. */
1737 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1738 return NT_STATUS_INVALID_HANDLE
;
1740 /* check to see if the pipe_user is a Domain Admin since
1741 account_pol.tdb was already opened as root, this is all we have */
1743 if ( !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1744 return NT_STATUS_ACCESS_DENIED
;
1746 if (!pdb_getgrsid(&map
, info
->sid
))
1747 return NT_STATUS_NO_SUCH_GROUP
;
1749 return pdb_update_group_mapping_entry(&map
);
1752 /***************************************************************************
1753 For a given SID, add some privileges.
1754 ***************************************************************************/
1756 NTSTATUS
_lsa_addprivs(pipes_struct
*p
, LSA_Q_ADDPRIVS
*q_u
, LSA_R_ADDPRIVS
*r_u
)
1758 struct lsa_info
*info
= NULL
;
1760 PRIVILEGE_SET
*set
= NULL
;
1762 /* find the connection policy handle. */
1763 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1764 return NT_STATUS_INVALID_HANDLE
;
1766 /* check to see if the pipe_user is root or a Domain Admin since
1767 account_pol.tdb was already opened as root, this is all we have */
1769 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
1770 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1772 return NT_STATUS_ACCESS_DENIED
;
1777 if ( !privilege_set_to_se_priv( &mask
, set
) )
1778 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1780 if ( !grant_privilege( &info
->sid
, &mask
) ) {
1781 DEBUG(3,("_lsa_addprivs: grant_privilege(%s) failed!\n",
1782 sid_string_static(&info
->sid
) ));
1783 DEBUG(3,("Privilege mask:\n"));
1784 dump_se_priv( DBGC_ALL
, 3, &mask
);
1785 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1788 return NT_STATUS_OK
;
1791 /***************************************************************************
1792 For a given SID, remove some privileges.
1793 ***************************************************************************/
1795 NTSTATUS
_lsa_removeprivs(pipes_struct
*p
, LSA_Q_REMOVEPRIVS
*q_u
, LSA_R_REMOVEPRIVS
*r_u
)
1797 struct lsa_info
*info
= NULL
;
1799 PRIVILEGE_SET
*set
= NULL
;
1801 /* find the connection policy handle. */
1802 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1803 return NT_STATUS_INVALID_HANDLE
;
1805 /* check to see if the pipe_user is root or a Domain Admin since
1806 account_pol.tdb was already opened as root, this is all we have */
1808 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
1809 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1811 return NT_STATUS_ACCESS_DENIED
;
1816 if ( !privilege_set_to_se_priv( &mask
, set
) )
1817 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1819 if ( !revoke_privilege( &info
->sid
, &mask
) ) {
1820 DEBUG(3,("_lsa_removeprivs: revoke_privilege(%s) failed!\n",
1821 sid_string_static(&info
->sid
) ));
1822 DEBUG(3,("Privilege mask:\n"));
1823 dump_se_priv( DBGC_ALL
, 3, &mask
);
1824 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1827 return NT_STATUS_OK
;
1830 /***************************************************************************
1831 For a given SID, remove some privileges.
1832 ***************************************************************************/
1834 NTSTATUS
_lsa_query_secobj(pipes_struct
*p
, LSA_Q_QUERY_SEC_OBJ
*q_u
, LSA_R_QUERY_SEC_OBJ
*r_u
)
1836 struct lsa_info
*handle
=NULL
;
1837 SEC_DESC
*psd
= NULL
;
1841 r_u
->status
= NT_STATUS_OK
;
1843 /* find the connection policy handle. */
1844 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1845 return NT_STATUS_INVALID_HANDLE
;
1847 /* check if the user have enough rights */
1848 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
1849 return NT_STATUS_ACCESS_DENIED
;
1852 switch (q_u
->sec_info
) {
1854 /* SD contains only the owner */
1856 status
=lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
1857 if(!NT_STATUS_IS_OK(status
))
1858 return NT_STATUS_NO_MEMORY
;
1861 if((r_u
->buf
= make_sec_desc_buf(p
->mem_ctx
, sd_size
, psd
)) == NULL
)
1862 return NT_STATUS_NO_MEMORY
;
1865 /* SD contains only the ACL */
1867 status
=lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
1868 if(!NT_STATUS_IS_OK(status
))
1869 return NT_STATUS_NO_MEMORY
;
1871 if((r_u
->buf
= make_sec_desc_buf(p
->mem_ctx
, sd_size
, psd
)) == NULL
)
1872 return NT_STATUS_NO_MEMORY
;
1875 return NT_STATUS_INVALID_LEVEL
;
1883 #if 0 /* AD DC work in ongoing in Samba 4 */
1885 /***************************************************************************
1886 ***************************************************************************/
1888 NTSTATUS
_lsa_query_info2(pipes_struct
*p
, LSA_Q_QUERY_INFO2
*q_u
, LSA_R_QUERY_INFO2
*r_u
)
1890 struct lsa_info
*handle
;
1891 const char *nb_name
;
1892 char *dns_name
= NULL
;
1893 char *forest_name
= NULL
;
1894 DOM_SID
*sid
= NULL
;
1899 r_u
->status
= NT_STATUS_OK
;
1901 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1902 return NT_STATUS_INVALID_HANDLE
;
1904 switch (q_u
->info_class
) {
1906 /* check if the user have enough rights */
1907 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
1908 return NT_STATUS_ACCESS_DENIED
;
1910 /* Request PolicyPrimaryDomainInformation. */
1911 switch (lp_server_role()) {
1912 case ROLE_DOMAIN_PDC
:
1913 case ROLE_DOMAIN_BDC
:
1914 nb_name
= get_global_sam_name();
1915 /* ugly temp hack for these next two */
1917 /* This should be a 'netbios domain -> DNS domain' mapping */
1918 dnsdomname
[0] = '\0';
1919 get_mydnsdomname(dnsdomname
);
1920 strlower_m(dnsdomname
);
1922 dns_name
= dnsdomname
;
1923 forest_name
= dnsdomname
;
1925 sid
= get_global_sam_sid();
1926 secrets_fetch_domain_guid(lp_workgroup(), &guid
);
1929 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
1931 init_dns_dom_info(&r_u
->info
.dns_dom_info
, nb_name
, dns_name
,
1932 forest_name
,&guid
,sid
);
1935 DEBUG(0,("_lsa_query_info2: unknown info level in Lsa Query: %d\n", q_u
->info_class
));
1936 r_u
->status
= NT_STATUS_INVALID_INFO_CLASS
;
1940 if (NT_STATUS_IS_OK(r_u
->status
)) {
1942 r_u
->info_class
= q_u
->info_class
;
1947 #endif /* AD DC work in ongoing in Samba 4 */
1949 /***************************************************************************
1950 ***************************************************************************/
1952 NTSTATUS
_lsa_add_acct_rights(pipes_struct
*p
, LSA_Q_ADD_ACCT_RIGHTS
*q_u
, LSA_R_ADD_ACCT_RIGHTS
*r_u
)
1954 struct lsa_info
*info
= NULL
;
1958 UNISTR4_ARRAY
*uni_privnames
= q_u
->rights
;
1961 /* find the connection policy handle. */
1962 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1963 return NT_STATUS_INVALID_HANDLE
;
1965 /* check to see if the pipe_user is a Domain Admin since
1966 account_pol.tdb was already opened as root, this is all we have */
1968 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
1969 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1971 return NT_STATUS_ACCESS_DENIED
;
1974 /* according to an NT4 PDC, you can add privileges to SIDs even without
1975 call_lsa_create_account() first. And you can use any arbitrary SID. */
1977 sid_copy( &sid
, &q_u
->sid
.sid
);
1979 /* just a little sanity check */
1981 if ( q_u
->count
!= uni_privnames
->count
) {
1982 DEBUG(0,("_lsa_add_acct_rights: count != number of UNISTR2 elements!\n"));
1983 return NT_STATUS_INVALID_HANDLE
;
1986 for ( i
=0; i
<q_u
->count
; i
++ ) {
1987 UNISTR4
*uni4_str
= &uni_privnames
->strings
[i
];
1989 /* only try to add non-null strings */
1991 if ( !uni4_str
->string
)
1994 rpcstr_pull( privname
, uni4_str
->string
->buffer
, sizeof(privname
), -1, STR_TERMINATE
);
1996 if ( !grant_privilege_by_name( &sid
, privname
) ) {
1997 DEBUG(2,("_lsa_add_acct_rights: Failed to add privilege [%s]\n", privname
));
1998 return NT_STATUS_NO_SUCH_PRIVILEGE
;
2002 return NT_STATUS_OK
;
2005 /***************************************************************************
2006 ***************************************************************************/
2008 NTSTATUS
_lsa_remove_acct_rights(pipes_struct
*p
, LSA_Q_REMOVE_ACCT_RIGHTS
*q_u
, LSA_R_REMOVE_ACCT_RIGHTS
*r_u
)
2010 struct lsa_info
*info
= NULL
;
2014 UNISTR4_ARRAY
*uni_privnames
= q_u
->rights
;
2017 /* find the connection policy handle. */
2018 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
2019 return NT_STATUS_INVALID_HANDLE
;
2021 /* check to see if the pipe_user is a Domain Admin since
2022 account_pol.tdb was already opened as root, this is all we have */
2024 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
2025 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
2027 return NT_STATUS_ACCESS_DENIED
;
2030 sid_copy( &sid
, &q_u
->sid
.sid
);
2032 if ( q_u
->removeall
) {
2033 if ( !revoke_all_privileges( &sid
) )
2034 return NT_STATUS_ACCESS_DENIED
;
2036 return NT_STATUS_OK
;
2039 /* just a little sanity check */
2041 if ( q_u
->count
!= uni_privnames
->count
) {
2042 DEBUG(0,("_lsa_add_acct_rights: count != number of UNISTR2 elements!\n"));
2043 return NT_STATUS_INVALID_HANDLE
;
2046 for ( i
=0; i
<q_u
->count
; i
++ ) {
2047 UNISTR4
*uni4_str
= &uni_privnames
->strings
[i
];
2049 /* only try to add non-null strings */
2051 if ( !uni4_str
->string
)
2054 rpcstr_pull( privname
, uni4_str
->string
->buffer
, sizeof(privname
), -1, STR_TERMINATE
);
2056 if ( !revoke_privilege_by_name( &sid
, privname
) ) {
2057 DEBUG(2,("_lsa_remove_acct_rights: Failed to revoke privilege [%s]\n", privname
));
2058 return NT_STATUS_NO_SUCH_PRIVILEGE
;
2062 return NT_STATUS_OK
;
2066 /***************************************************************************
2067 ***************************************************************************/
2069 NTSTATUS
_lsa_enum_acct_rights(pipes_struct
*p
, LSA_Q_ENUM_ACCT_RIGHTS
*q_u
, LSA_R_ENUM_ACCT_RIGHTS
*r_u
)
2071 struct lsa_info
*info
= NULL
;
2073 PRIVILEGE_SET privileges
;
2077 /* find the connection policy handle. */
2079 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
2080 return NT_STATUS_INVALID_HANDLE
;
2082 /* according to an NT4 PDC, you can add privileges to SIDs even without
2083 call_lsa_create_account() first. And you can use any arbitrary SID. */
2085 sid_copy( &sid
, &q_u
->sid
.sid
);
2087 if ( !get_privileges_for_sids( &mask
, &sid
, 1 ) )
2088 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
2090 privilege_set_init( &privileges
);
2092 if ( se_priv_to_privilege_set( &privileges
, &mask
) ) {
2094 DEBUG(10,("_lsa_enum_acct_rights: %s has %d privileges\n",
2095 sid_string_static(&sid
), privileges
.count
));
2097 r_u
->status
= init_r_enum_acct_rights( r_u
, &privileges
);
2100 r_u
->status
= NT_STATUS_NO_SUCH_PRIVILEGE
;
2102 privilege_set_free( &privileges
);
2108 /***************************************************************************
2109 ***************************************************************************/
2111 NTSTATUS
_lsa_lookup_priv_value(pipes_struct
*p
, LSA_Q_LOOKUP_PRIV_VALUE
*q_u
, LSA_R_LOOKUP_PRIV_VALUE
*r_u
)
2113 struct lsa_info
*info
= NULL
;
2115 LUID_ATTR priv_luid
;
2118 /* find the connection policy handle. */
2120 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
2121 return NT_STATUS_INVALID_HANDLE
;
2123 unistr2_to_ascii(name
, &q_u
->privname
.unistring
, sizeof(name
));
2125 DEBUG(10,("_lsa_lookup_priv_value: name = %s\n", name
));
2127 if ( !se_priv_from_name( name
, &mask
) )
2128 return NT_STATUS_NO_SUCH_PRIVILEGE
;
2130 priv_luid
= get_privilege_luid( &mask
);
2132 r_u
->luid
.low
= priv_luid
.luid
.low
;
2133 r_u
->luid
.high
= priv_luid
.luid
.high
;
2136 return NT_STATUS_OK
;
2141 * From here on the server routines are just dummy ones to make smbd link with
2142 * librpc/gen_ndr/srv_lsa.c. These routines are actually never called, we are
2143 * pulling the server stubs across one by one.
2146 NTSTATUS
_lsa_Delete(pipes_struct
*p
, struct lsa_Delete
*r
)
2148 p
->rng_fault_state
= True
;
2149 return NT_STATUS_NOT_IMPLEMENTED
;
2152 NTSTATUS
_lsa_EnumPrivs(pipes_struct
*p
, struct lsa_EnumPrivs
*r
)
2154 p
->rng_fault_state
= True
;
2155 return NT_STATUS_NOT_IMPLEMENTED
;
2158 NTSTATUS
_lsa_QuerySecurity(pipes_struct
*p
, struct lsa_QuerySecurity
*r
)
2160 p
->rng_fault_state
= True
;
2161 return NT_STATUS_NOT_IMPLEMENTED
;
2164 NTSTATUS
_lsa_SetSecObj(pipes_struct
*p
, struct lsa_SetSecObj
*r
)
2166 p
->rng_fault_state
= True
;
2167 return NT_STATUS_NOT_IMPLEMENTED
;
2170 NTSTATUS
_lsa_ChangePassword(pipes_struct
*p
, struct lsa_ChangePassword
*r
)
2172 p
->rng_fault_state
= True
;
2173 return NT_STATUS_NOT_IMPLEMENTED
;
2176 NTSTATUS
_lsa_OpenPolicy(pipes_struct
*p
, struct lsa_OpenPolicy
*r
)
2178 p
->rng_fault_state
= True
;
2179 return NT_STATUS_NOT_IMPLEMENTED
;
2182 NTSTATUS
_lsa_QueryInfoPolicy(pipes_struct
*p
, struct lsa_QueryInfoPolicy
*r
)
2184 p
->rng_fault_state
= True
;
2185 return NT_STATUS_NOT_IMPLEMENTED
;
2188 NTSTATUS
_lsa_SetInfoPolicy(pipes_struct
*p
, struct lsa_SetInfoPolicy
*r
)
2190 p
->rng_fault_state
= True
;
2191 return NT_STATUS_NOT_IMPLEMENTED
;
2194 NTSTATUS
_lsa_ClearAuditLog(pipes_struct
*p
, struct lsa_ClearAuditLog
*r
)
2196 p
->rng_fault_state
= True
;
2197 return NT_STATUS_NOT_IMPLEMENTED
;
2200 NTSTATUS
_lsa_CreateAccount(pipes_struct
*p
, struct lsa_CreateAccount
*r
)
2202 p
->rng_fault_state
= True
;
2203 return NT_STATUS_NOT_IMPLEMENTED
;
2206 NTSTATUS
_lsa_EnumAccounts(pipes_struct
*p
, struct lsa_EnumAccounts
*r
)
2208 p
->rng_fault_state
= True
;
2209 return NT_STATUS_NOT_IMPLEMENTED
;
2212 NTSTATUS
_lsa_EnumTrustDom(pipes_struct
*p
, struct lsa_EnumTrustDom
*r
)
2214 p
->rng_fault_state
= True
;
2215 return NT_STATUS_NOT_IMPLEMENTED
;
2218 NTSTATUS
_lsa_LookupNames(pipes_struct
*p
, struct lsa_LookupNames
*r
)
2220 p
->rng_fault_state
= True
;
2221 return NT_STATUS_NOT_IMPLEMENTED
;
2224 NTSTATUS
_lsa_LookupSids(pipes_struct
*p
, struct lsa_LookupSids
*r
)
2226 p
->rng_fault_state
= True
;
2227 return NT_STATUS_NOT_IMPLEMENTED
;
2230 NTSTATUS
_lsa_OpenAccount(pipes_struct
*p
, struct lsa_OpenAccount
*r
)
2232 p
->rng_fault_state
= True
;
2233 return NT_STATUS_NOT_IMPLEMENTED
;
2236 NTSTATUS
_lsa_EnumPrivsAccount(pipes_struct
*p
, struct lsa_EnumPrivsAccount
*r
)
2238 p
->rng_fault_state
= True
;
2239 return NT_STATUS_NOT_IMPLEMENTED
;
2242 NTSTATUS
_lsa_AddPrivilegesToAccount(pipes_struct
*p
, struct lsa_AddPrivilegesToAccount
*r
)
2244 p
->rng_fault_state
= True
;
2245 return NT_STATUS_NOT_IMPLEMENTED
;
2248 NTSTATUS
_lsa_RemovePrivilegesFromAccount(pipes_struct
*p
, struct lsa_RemovePrivilegesFromAccount
*r
)
2250 p
->rng_fault_state
= True
;
2251 return NT_STATUS_NOT_IMPLEMENTED
;
2254 NTSTATUS
_lsa_GetQuotasForAccount(pipes_struct
*p
, struct lsa_GetQuotasForAccount
*r
)
2256 p
->rng_fault_state
= True
;
2257 return NT_STATUS_NOT_IMPLEMENTED
;
2260 NTSTATUS
_lsa_SetQuotasForAccount(pipes_struct
*p
, struct lsa_SetQuotasForAccount
*r
)
2262 p
->rng_fault_state
= True
;
2263 return NT_STATUS_NOT_IMPLEMENTED
;
2266 NTSTATUS
_lsa_GetSystemAccessAccount(pipes_struct
*p
, struct lsa_GetSystemAccessAccount
*r
)
2268 p
->rng_fault_state
= True
;
2269 return NT_STATUS_NOT_IMPLEMENTED
;
2272 NTSTATUS
_lsa_SetSystemAccessAccount(pipes_struct
*p
, struct lsa_SetSystemAccessAccount
*r
)
2274 p
->rng_fault_state
= True
;
2275 return NT_STATUS_NOT_IMPLEMENTED
;
2278 NTSTATUS
_lsa_QueryTrustedDomainInfo(pipes_struct
*p
, struct lsa_QueryTrustedDomainInfo
*r
)
2280 p
->rng_fault_state
= True
;
2281 return NT_STATUS_NOT_IMPLEMENTED
;
2284 NTSTATUS
_lsa_SetInformationTrustedDomain(pipes_struct
*p
, struct lsa_SetInformationTrustedDomain
*r
)
2286 p
->rng_fault_state
= True
;
2287 return NT_STATUS_NOT_IMPLEMENTED
;
2290 NTSTATUS
_lsa_QuerySecret(pipes_struct
*p
, struct lsa_QuerySecret
*r
)
2292 p
->rng_fault_state
= True
;
2293 return NT_STATUS_NOT_IMPLEMENTED
;
2296 NTSTATUS
_lsa_LookupPrivValue(pipes_struct
*p
, struct lsa_LookupPrivValue
*r
)
2298 p
->rng_fault_state
= True
;
2299 return NT_STATUS_NOT_IMPLEMENTED
;
2302 NTSTATUS
_lsa_LookupPrivName(pipes_struct
*p
, struct lsa_LookupPrivName
*r
)
2304 p
->rng_fault_state
= True
;
2305 return NT_STATUS_NOT_IMPLEMENTED
;
2308 NTSTATUS
_lsa_LookupPrivDisplayName(pipes_struct
*p
, struct lsa_LookupPrivDisplayName
*r
)
2310 p
->rng_fault_state
= True
;
2311 return NT_STATUS_NOT_IMPLEMENTED
;
2314 NTSTATUS
_lsa_DeleteObject(pipes_struct
*p
, struct lsa_DeleteObject
*r
)
2316 p
->rng_fault_state
= True
;
2317 return NT_STATUS_NOT_IMPLEMENTED
;
2320 NTSTATUS
_lsa_EnumAccountsWithUserRight(pipes_struct
*p
, struct lsa_EnumAccountsWithUserRight
*r
)
2322 p
->rng_fault_state
= True
;
2323 return NT_STATUS_NOT_IMPLEMENTED
;
2326 NTSTATUS
_lsa_EnumAccountRights(pipes_struct
*p
, struct lsa_EnumAccountRights
*r
)
2328 p
->rng_fault_state
= True
;
2329 return NT_STATUS_NOT_IMPLEMENTED
;
2332 NTSTATUS
_lsa_AddAccountRights(pipes_struct
*p
, struct lsa_AddAccountRights
*r
)
2334 p
->rng_fault_state
= True
;
2335 return NT_STATUS_NOT_IMPLEMENTED
;
2338 NTSTATUS
_lsa_RemoveAccountRights(pipes_struct
*p
, struct lsa_RemoveAccountRights
*r
)
2340 p
->rng_fault_state
= True
;
2341 return NT_STATUS_NOT_IMPLEMENTED
;
2344 NTSTATUS
_lsa_QueryTrustedDomainInfoBySid(pipes_struct
*p
, struct lsa_QueryTrustedDomainInfoBySid
*r
)
2346 p
->rng_fault_state
= True
;
2347 return NT_STATUS_NOT_IMPLEMENTED
;
2350 NTSTATUS
_lsa_SetTrustedDomainInfo(pipes_struct
*p
, struct lsa_SetTrustedDomainInfo
*r
)
2352 p
->rng_fault_state
= True
;
2353 return NT_STATUS_NOT_IMPLEMENTED
;
2356 NTSTATUS
_lsa_DeleteTrustedDomain(pipes_struct
*p
, struct lsa_DeleteTrustedDomain
*r
)
2358 p
->rng_fault_state
= True
;
2359 return NT_STATUS_NOT_IMPLEMENTED
;
2362 NTSTATUS
_lsa_StorePrivateData(pipes_struct
*p
, struct lsa_StorePrivateData
*r
)
2364 p
->rng_fault_state
= True
;
2365 return NT_STATUS_NOT_IMPLEMENTED
;
2368 NTSTATUS
_lsa_RetrievePrivateData(pipes_struct
*p
, struct lsa_RetrievePrivateData
*r
)
2370 p
->rng_fault_state
= True
;
2371 return NT_STATUS_NOT_IMPLEMENTED
;
2374 NTSTATUS
_lsa_OpenPolicy2(pipes_struct
*p
, struct lsa_OpenPolicy2
*r
)
2376 p
->rng_fault_state
= True
;
2377 return NT_STATUS_NOT_IMPLEMENTED
;
2380 NTSTATUS
_lsa_GetUserName(pipes_struct
*p
, struct lsa_GetUserName
*r
)
2382 p
->rng_fault_state
= True
;
2383 return NT_STATUS_NOT_IMPLEMENTED
;
2386 NTSTATUS
_lsa_QueryInfoPolicy2(pipes_struct
*p
, struct lsa_QueryInfoPolicy2
*r
)
2388 p
->rng_fault_state
= True
;
2389 return NT_STATUS_NOT_IMPLEMENTED
;
2392 NTSTATUS
_lsa_SetInfoPolicy2(pipes_struct
*p
, struct lsa_SetInfoPolicy2
*r
)
2394 p
->rng_fault_state
= True
;
2395 return NT_STATUS_NOT_IMPLEMENTED
;
2398 NTSTATUS
_lsa_QueryTrustedDomainInfoByName(pipes_struct
*p
, struct lsa_QueryTrustedDomainInfoByName
*r
)
2400 p
->rng_fault_state
= True
;
2401 return NT_STATUS_NOT_IMPLEMENTED
;
2404 NTSTATUS
_lsa_SetTrustedDomainInfoByName(pipes_struct
*p
, struct lsa_SetTrustedDomainInfoByName
*r
)
2406 p
->rng_fault_state
= True
;
2407 return NT_STATUS_NOT_IMPLEMENTED
;
2410 NTSTATUS
_lsa_EnumTrustedDomainsEx(pipes_struct
*p
, struct lsa_EnumTrustedDomainsEx
*r
)
2412 p
->rng_fault_state
= True
;
2413 return NT_STATUS_NOT_IMPLEMENTED
;
2416 NTSTATUS
_lsa_CreateTrustedDomainEx(pipes_struct
*p
, struct lsa_CreateTrustedDomainEx
*r
)
2418 p
->rng_fault_state
= True
;
2419 return NT_STATUS_NOT_IMPLEMENTED
;
2422 NTSTATUS
_lsa_CloseTrustedDomainEx(pipes_struct
*p
, struct lsa_CloseTrustedDomainEx
*r
)
2424 p
->rng_fault_state
= True
;
2425 return NT_STATUS_NOT_IMPLEMENTED
;
2428 NTSTATUS
_lsa_QueryDomainInformationPolicy(pipes_struct
*p
, struct lsa_QueryDomainInformationPolicy
*r
)
2430 p
->rng_fault_state
= True
;
2431 return NT_STATUS_NOT_IMPLEMENTED
;
2434 NTSTATUS
_lsa_SetDomainInformationPolicy(pipes_struct
*p
, struct lsa_SetDomainInformationPolicy
*r
)
2436 p
->rng_fault_state
= True
;
2437 return NT_STATUS_NOT_IMPLEMENTED
;
2440 NTSTATUS
_lsa_OpenTrustedDomainByName(pipes_struct
*p
, struct lsa_OpenTrustedDomainByName
*r
)
2442 p
->rng_fault_state
= True
;
2443 return NT_STATUS_NOT_IMPLEMENTED
;
2446 NTSTATUS
_lsa_TestCall(pipes_struct
*p
, struct lsa_TestCall
*r
)
2448 p
->rng_fault_state
= True
;
2449 return NT_STATUS_NOT_IMPLEMENTED
;
2452 NTSTATUS
_lsa_LookupSids2(pipes_struct
*p
, struct lsa_LookupSids2
*r
)
2454 p
->rng_fault_state
= True
;
2455 return NT_STATUS_NOT_IMPLEMENTED
;
2458 NTSTATUS
_lsa_LookupNames2(pipes_struct
*p
, struct lsa_LookupNames2
*r
)
2460 p
->rng_fault_state
= True
;
2461 return NT_STATUS_NOT_IMPLEMENTED
;
2464 NTSTATUS
_lsa_CreateTrustedDomainEx2(pipes_struct
*p
, struct lsa_CreateTrustedDomainEx2
*r
)
2466 p
->rng_fault_state
= True
;
2467 return NT_STATUS_NOT_IMPLEMENTED
;
2470 NTSTATUS
_lsa_CREDRWRITE(pipes_struct
*p
, struct lsa_CREDRWRITE
*r
)
2472 p
->rng_fault_state
= True
;
2473 return NT_STATUS_NOT_IMPLEMENTED
;
2476 NTSTATUS
_lsa_CREDRREAD(pipes_struct
*p
, struct lsa_CREDRREAD
*r
)
2478 p
->rng_fault_state
= True
;
2479 return NT_STATUS_NOT_IMPLEMENTED
;
2482 NTSTATUS
_lsa_CREDRENUMERATE(pipes_struct
*p
, struct lsa_CREDRENUMERATE
*r
)
2484 p
->rng_fault_state
= True
;
2485 return NT_STATUS_NOT_IMPLEMENTED
;
2488 NTSTATUS
_lsa_CREDRWRITEDOMAINCREDENTIALS(pipes_struct
*p
, struct lsa_CREDRWRITEDOMAINCREDENTIALS
*r
)
2490 p
->rng_fault_state
= True
;
2491 return NT_STATUS_NOT_IMPLEMENTED
;
2494 NTSTATUS
_lsa_CREDRREADDOMAINCREDENTIALS(pipes_struct
*p
, struct lsa_CREDRREADDOMAINCREDENTIALS
*r
)
2496 p
->rng_fault_state
= True
;
2497 return NT_STATUS_NOT_IMPLEMENTED
;
2500 NTSTATUS
_lsa_CREDRDELETE(pipes_struct
*p
, struct lsa_CREDRDELETE
*r
)
2502 p
->rng_fault_state
= True
;
2503 return NT_STATUS_NOT_IMPLEMENTED
;
2506 NTSTATUS
_lsa_CREDRGETTARGETINFO(pipes_struct
*p
, struct lsa_CREDRGETTARGETINFO
*r
)
2508 p
->rng_fault_state
= True
;
2509 return NT_STATUS_NOT_IMPLEMENTED
;
2512 NTSTATUS
_lsa_CREDRPROFILELOADED(pipes_struct
*p
, struct lsa_CREDRPROFILELOADED
*r
)
2514 p
->rng_fault_state
= True
;
2515 return NT_STATUS_NOT_IMPLEMENTED
;
2518 NTSTATUS
_lsa_LookupNames3(pipes_struct
*p
, struct lsa_LookupNames3
*r
)
2520 p
->rng_fault_state
= True
;
2521 return NT_STATUS_NOT_IMPLEMENTED
;
2524 NTSTATUS
_lsa_CREDRGETSESSIONTYPES(pipes_struct
*p
, struct lsa_CREDRGETSESSIONTYPES
*r
)
2526 p
->rng_fault_state
= True
;
2527 return NT_STATUS_NOT_IMPLEMENTED
;
2530 NTSTATUS
_lsa_LSARREGISTERAUDITEVENT(pipes_struct
*p
, struct lsa_LSARREGISTERAUDITEVENT
*r
)
2532 p
->rng_fault_state
= True
;
2533 return NT_STATUS_NOT_IMPLEMENTED
;
2536 NTSTATUS
_lsa_LSARGENAUDITEVENT(pipes_struct
*p
, struct lsa_LSARGENAUDITEVENT
*r
)
2538 p
->rng_fault_state
= True
;
2539 return NT_STATUS_NOT_IMPLEMENTED
;
2542 NTSTATUS
_lsa_LSARUNREGISTERAUDITEVENT(pipes_struct
*p
, struct lsa_LSARUNREGISTERAUDITEVENT
*r
)
2544 p
->rng_fault_state
= True
;
2545 return NT_STATUS_NOT_IMPLEMENTED
;
2548 NTSTATUS
_lsa_LSARQUERYFORESTTRUSTINFORMATION(pipes_struct
*p
, struct lsa_LSARQUERYFORESTTRUSTINFORMATION
*r
)
2550 p
->rng_fault_state
= True
;
2551 return NT_STATUS_NOT_IMPLEMENTED
;
2554 NTSTATUS
_lsa_LSARSETFORESTTRUSTINFORMATION(pipes_struct
*p
, struct lsa_LSARSETFORESTTRUSTINFORMATION
*r
)
2556 p
->rng_fault_state
= True
;
2557 return NT_STATUS_NOT_IMPLEMENTED
;
2560 NTSTATUS
_lsa_CREDRRENAME(pipes_struct
*p
, struct lsa_CREDRRENAME
*r
)
2562 p
->rng_fault_state
= True
;
2563 return NT_STATUS_NOT_IMPLEMENTED
;
2566 NTSTATUS
_lsa_LookupSids3(pipes_struct
*p
, struct lsa_LookupSids3
*r
)
2568 p
->rng_fault_state
= True
;
2569 return NT_STATUS_NOT_IMPLEMENTED
;
2572 NTSTATUS
_lsa_LookupNames4(pipes_struct
*p
, struct lsa_LookupNames4
*r
)
2574 p
->rng_fault_state
= True
;
2575 return NT_STATUS_NOT_IMPLEMENTED
;
2578 NTSTATUS
_lsa_LSAROPENPOLICYSCE(pipes_struct
*p
, struct lsa_LSAROPENPOLICYSCE
*r
)
2580 p
->rng_fault_state
= True
;
2581 return NT_STATUS_NOT_IMPLEMENTED
;
2584 NTSTATUS
_lsa_LSARADTREGISTERSECURITYEVENTSOURCE(pipes_struct
*p
, struct lsa_LSARADTREGISTERSECURITYEVENTSOURCE
*r
)
2586 p
->rng_fault_state
= True
;
2587 return NT_STATUS_NOT_IMPLEMENTED
;
2590 NTSTATUS
_lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE(pipes_struct
*p
, struct lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE
*r
)
2592 p
->rng_fault_state
= True
;
2593 return NT_STATUS_NOT_IMPLEMENTED
;
2596 NTSTATUS
_lsa_LSARADTREPORTSECURITYEVENT(pipes_struct
*p
, struct lsa_LSARADTREPORTSECURITYEVENT
*r
)
2598 p
->rng_fault_state
= True
;
2599 return NT_STATUS_NOT_IMPLEMENTED
;