?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r10909: Give better shutdown messages
[Samba/nascimento.git] / source3 / rpc_server / srv_lsa_nt.c
blob15d420538ef11d8f957f44b5c2864d96e03da523
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Jeremy Allison 2001,
8 * Copyright (C) Rafal Szczesniak 2002,
9 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
10 * Copyright (C) Simo Sorce 2003.
11 * Copyright (C) Gerald (Jerry) Carter 2005.
12 *
13 * This program is free software; you can redistribute it and/or modify
14 * it under the terms of the GNU General Public License as published by
15 * the Free Software Foundation; either version 2 of the License, or
16 * (at your option) any later version.
17 *
18 * This program is distributed in the hope that it will be useful,
19 * but WITHOUT ANY WARRANTY; without even the implied warranty of
20 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21 * GNU General Public License for more details.
22 *
23 * You should have received a copy of the GNU General Public License
24 * along with this program; if not, write to the Free Software
25 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 */
27
28 /* This is the implementation of the lsa server code. */
29
30 #include "includes.h"
31
32 #undef DBGC_CLASS
33 #define DBGC_CLASS DBGC_RPC_SRV
34
35 extern PRIVS privs[];
36
37 struct lsa_info {
38 DOM_SID sid;
39 uint32 access;
40 };
41
42 struct generic_mapping lsa_generic_mapping = {
43 POLICY_READ,
44 POLICY_WRITE,
45 POLICY_EXECUTE,
46 POLICY_ALL_ACCESS
47 };
48
49 /*******************************************************************
50 Function to free the per handle data.
51 ********************************************************************/
52
53 static void free_lsa_info(void *ptr)
54 {
55 struct lsa_info *lsa = (struct lsa_info *)ptr;
56
57 SAFE_FREE(lsa);
58 }
59
60 /***************************************************************************
61 Init dom_query
62 ***************************************************************************/
63
64 static void init_dom_query(DOM_QUERY *d_q, const char *dom_name, DOM_SID *dom_sid)
65 {
66 d_q->buffer_dom_name = (dom_name != NULL) ? 1 : 0; /* domain buffer pointer */
67 d_q->buffer_dom_sid = (dom_sid != NULL) ? 1 : 0; /* domain sid pointer */
68
69 /* this string is supposed to be non-null terminated. */
70 /* But the maxlen in this UNISTR2 must include the terminating null. */
71 init_unistr2(&d_q->uni_domain_name, dom_name, UNI_BROKEN_NON_NULL);
72
73 /*
74 * I'm not sure why this really odd combination of length
75 * values works, but it does appear to. I need to look at
76 * this *much* more closely - but at the moment leave alone
77 * until it's understood. This allows a W2k client to join
78 * a domain with both odd and even length names... JRA.
79 */
80
81 /*
82 * IMPORTANT NOTE !!!!
83 * The two fields below probably are reversed in meaning, ie.
84 * the first field is probably the str_len, the second the max
85 * len. Both are measured in bytes anyway.
86 */
87
88 d_q->uni_dom_str_len = d_q->uni_domain_name.uni_max_len * 2;
89 d_q->uni_dom_max_len = d_q->uni_domain_name.uni_str_len * 2;
90
91 if (dom_sid != NULL)
92 init_dom_sid2(&d_q->dom_sid, dom_sid);
93 }
94
95 /***************************************************************************
96 init_dom_ref - adds a domain if it's not already in, returns the index.
97 ***************************************************************************/
98
99 static int init_dom_ref(DOM_R_REF *ref, char *dom_name, DOM_SID *dom_sid)
100 {
101 int num = 0;
102
103 if (dom_name != NULL) {
104 for (num = 0; num < ref->num_ref_doms_1; num++) {
105 fstring domname;
106 rpcstr_pull(domname, ref->ref_dom[num].uni_dom_name.buffer, sizeof(domname), -1, 0);
107 if (strequal(domname, dom_name))
108 return num;
109 }
110 } else {
111 num = ref->num_ref_doms_1;
112 }
113
114 if (num >= MAX_REF_DOMAINS) {
115 /* index not found, already at maximum domain limit */
116 return -1;
117 }
118
119 ref->num_ref_doms_1 = num+1;
120 ref->ptr_ref_dom = 1;
121 ref->max_entries = MAX_REF_DOMAINS;
122 ref->num_ref_doms_2 = num+1;
123
124 ref->hdr_ref_dom[num].ptr_dom_sid = dom_sid != NULL ? 1 : 0;
125
126 init_unistr2(&ref->ref_dom[num].uni_dom_name, dom_name, UNI_FLAGS_NONE);
127 init_uni_hdr(&ref->hdr_ref_dom[num].hdr_dom_name, &ref->ref_dom[num].uni_dom_name);
128
129 init_dom_sid2(&ref->ref_dom[num].ref_dom, dom_sid );
130
131 return num;
132 }
133
134 /***************************************************************************
135 init_lsa_rid2s
136 ***************************************************************************/
137
138 static void init_lsa_rid2s(DOM_R_REF *ref, DOM_RID2 *rid2,
139 int num_entries, UNISTR2 *name,
140 uint32 *mapped_count, BOOL endian)
141 {
142 int i;
143 int total = 0;
144 *mapped_count = 0;
145
146 SMB_ASSERT(num_entries <= MAX_LOOKUP_SIDS);
147
148 become_root(); /* lookup_name can require root privs */
149
150 for (i = 0; i < num_entries; i++) {
151 BOOL status = False;
152 DOM_SID sid;
153 uint32 rid = 0xffffffff;
154 int dom_idx = -1;
155 pstring full_name;
156 fstring dom_name, user;
157 enum SID_NAME_USE name_type = SID_NAME_UNKNOWN;
158
159 /* Split name into domain and user component */
160
161 unistr2_to_ascii(full_name, &name[i], sizeof(full_name));
162 split_domain_name(full_name, dom_name, user);
163
164 /* Lookup name */
165
166 DEBUG(5, ("init_lsa_rid2s: looking up name %s\n", full_name));
167
168 status = lookup_name(dom_name, user, &sid, &name_type);
169
170 if((name_type == SID_NAME_UNKNOWN) && (lp_server_role() == ROLE_DOMAIN_MEMBER) && (strncmp(dom_name, full_name, strlen(dom_name)) != 0)) {
171 DEBUG(5, ("init_lsa_rid2s: domain name not provided and local account not found, using member domain\n"));
172 fstrcpy(dom_name, lp_workgroup());
173 status = lookup_name(dom_name, user, &sid, &name_type);
174 }
175
176 if (name_type == SID_NAME_WKN_GRP) {
177 /* BUILTIN aliases are still aliases :-) */
178 name_type = SID_NAME_ALIAS;
179 }
180
181 DEBUG(5, ("init_lsa_rid2s: %s\n", status ? "found" :
182 "not found"));
183
184 if (status && name_type != SID_NAME_UNKNOWN) {
185 sid_split_rid(&sid, &rid);
186 dom_idx = init_dom_ref(ref, dom_name, &sid);
187 (*mapped_count)++;
188 } else {
189 dom_idx = -1;
190 rid = 0;
191 name_type = SID_NAME_UNKNOWN;
192 }
193
194 init_dom_rid2(&rid2[total], rid, name_type, dom_idx);
195 total++;
196 }
197
198 unbecome_root();
199 }
200
201 /***************************************************************************
202 init_reply_lookup_names
203 ***************************************************************************/
204
205 static void init_reply_lookup_names(LSA_R_LOOKUP_NAMES *r_l,
206 DOM_R_REF *ref, uint32 num_entries,
207 DOM_RID2 *rid2, uint32 mapped_count)
208 {
209 r_l->ptr_dom_ref = 1;
210 r_l->dom_ref = ref;
211
212 r_l->num_entries = num_entries;
213 r_l->ptr_entries = 1;
214 r_l->num_entries2 = num_entries;
215 r_l->dom_rid = rid2;
216
217 r_l->mapped_count = mapped_count;
218 }
219
220 /***************************************************************************
221 Init lsa_trans_names.
222 ***************************************************************************/
223
224 static void init_lsa_trans_names(TALLOC_CTX *ctx, DOM_R_REF *ref, LSA_TRANS_NAME_ENUM *trn,
225 int num_entries, DOM_SID2 *sid,
226 uint32 *mapped_count)
227 {
228 int i;
229 int total = 0;
230 *mapped_count = 0;
231
232 /* Allocate memory for list of names */
233
234 if (num_entries > 0) {
235 if (!(trn->name = TALLOC_ARRAY(ctx, LSA_TRANS_NAME, num_entries))) {
236 DEBUG(0, ("init_lsa_trans_names(): out of memory\n"));
237 return;
238 }
239
240 if (!(trn->uni_name = TALLOC_ARRAY(ctx, UNISTR2, num_entries))) {
241 DEBUG(0, ("init_lsa_trans_names(): out of memory\n"));
242 return;
243 }
244 }
245
246 become_root(); /* Need root to get to passdb to for local sids */
247
248 for (i = 0; i < num_entries; i++) {
249 BOOL status = False;
250 DOM_SID find_sid = sid[i].sid;
251 uint32 rid = 0xffffffff;
252 int dom_idx = -1;
253 fstring name, dom_name;
254 enum SID_NAME_USE sid_name_use = (enum SID_NAME_USE)0;
255
256 sid_to_string(name, &find_sid);
257 DEBUG(5, ("init_lsa_trans_names: looking up sid %s\n", name));
258
259 /* Lookup sid from winbindd */
260
261 status = lookup_sid(&find_sid, dom_name, name, &sid_name_use);
262
263 DEBUG(5, ("init_lsa_trans_names: %s\n", status ? "found" :
264 "not found"));
265
266 if (!status) {
267 sid_name_use = SID_NAME_UNKNOWN;
268 memset(dom_name, '\0', sizeof(dom_name));
269 sid_to_string(name, &find_sid);
270 dom_idx = -1;
271
272 DEBUG(10,("init_lsa_trans_names: added unknown user '%s' to "
273 "referenced list.\n", name ));
274 } else {
275 (*mapped_count)++;
276 /* Store domain sid in ref array */
277 if (find_sid.num_auths == 5) {
278 sid_split_rid(&find_sid, &rid);
279 }
280 dom_idx = init_dom_ref(ref, dom_name, &find_sid);
281
282 DEBUG(10,("init_lsa_trans_names: added %s '%s\\%s' (%d) to referenced list.\n",
283 sid_type_lookup(sid_name_use), dom_name, name, sid_name_use ));
284
285 }
286
287 init_lsa_trans_name(&trn->name[total], &trn->uni_name[total],
288 sid_name_use, name, dom_idx);
289 total++;
290 }
291
292 unbecome_root();
293
294 trn->num_entries = total;
295 trn->ptr_trans_names = 1;
296 trn->num_entries2 = total;
297 }
298
299 /***************************************************************************
300 Init_reply_lookup_sids.
301 ***************************************************************************/
302
303 static void init_reply_lookup_sids(LSA_R_LOOKUP_SIDS *r_l,
304 DOM_R_REF *ref, LSA_TRANS_NAME_ENUM *names,
305 uint32 mapped_count)
306 {
307 r_l->ptr_dom_ref = 1;
308 r_l->dom_ref = ref;
309 r_l->names = names;
310 r_l->mapped_count = mapped_count;
311 }
312
313 static NTSTATUS lsa_get_generic_sd(TALLOC_CTX *mem_ctx, SEC_DESC **sd, size_t *sd_size)
314 {
315 DOM_SID local_adm_sid;
316 DOM_SID adm_sid;
317
318 SEC_ACE ace[3];
319 SEC_ACCESS mask;
320
321 SEC_ACL *psa = NULL;
322
323 init_sec_access(&mask, POLICY_EXECUTE);
324 init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
325
326 sid_copy(&adm_sid, get_global_sam_sid());
327 sid_append_rid(&adm_sid, DOMAIN_GROUP_RID_ADMINS);
328 init_sec_access(&mask, POLICY_ALL_ACCESS);
329 init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
330
331 sid_copy(&local_adm_sid, &global_sid_Builtin);
332 sid_append_rid(&local_adm_sid, BUILTIN_ALIAS_RID_ADMINS);
333 init_sec_access(&mask, POLICY_ALL_ACCESS);
334 init_sec_ace(&ace[2], &local_adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
335
336 if((psa = make_sec_acl(mem_ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
337 return NT_STATUS_NO_MEMORY;
338
339 if((*sd = make_sec_desc(mem_ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, &adm_sid, NULL, NULL, psa, sd_size)) == NULL)
340 return NT_STATUS_NO_MEMORY;
341
342 return NT_STATUS_OK;
343 }
344
345 #if 0 /* AD DC work in ongoing in Samba 4 */
346
347 /***************************************************************************
348 Init_dns_dom_info.
349 ***************************************************************************/
350
351 static void init_dns_dom_info(LSA_DNS_DOM_INFO *r_l, const char *nb_name,
352 const char *dns_name, const char *forest_name,
353 struct uuid *dom_guid, DOM_SID *dom_sid)
354 {
355 if (nb_name && *nb_name) {
356 init_unistr2(&r_l->uni_nb_dom_name, nb_name, UNI_FLAGS_NONE);
357 init_uni_hdr(&r_l->hdr_nb_dom_name, &r_l->uni_nb_dom_name);
358 r_l->hdr_nb_dom_name.uni_max_len += 2;
359 r_l->uni_nb_dom_name.uni_max_len += 1;
360 }
361
362 if (dns_name && *dns_name) {
363 init_unistr2(&r_l->uni_dns_dom_name, dns_name, UNI_FLAGS_NONE);
364 init_uni_hdr(&r_l->hdr_dns_dom_name, &r_l->uni_dns_dom_name);
365 r_l->hdr_dns_dom_name.uni_max_len += 2;
366 r_l->uni_dns_dom_name.uni_max_len += 1;
367 }
368
369 if (forest_name && *forest_name) {
370 init_unistr2(&r_l->uni_forest_name, forest_name, UNI_FLAGS_NONE);
371 init_uni_hdr(&r_l->hdr_forest_name, &r_l->uni_forest_name);
372 r_l->hdr_forest_name.uni_max_len += 2;
373 r_l->uni_forest_name.uni_max_len += 1;
374 }
375
376 /* how do we init the guid ? probably should write an init fn */
377 if (dom_guid) {
378 memcpy(&r_l->dom_guid, dom_guid, sizeof(struct uuid));
379 }
380
381 if (dom_sid) {
382 r_l->ptr_dom_sid = 1;
383 init_dom_sid2(&r_l->dom_sid, dom_sid);
384 }
385 }
386 #endif /* AD DC work in ongoing in Samba 4 */
387
388
389 /***************************************************************************
390 _lsa_open_policy2.
391 ***************************************************************************/
392
393 NTSTATUS _lsa_open_policy2(pipes_struct *p, LSA_Q_OPEN_POL2 *q_u, LSA_R_OPEN_POL2 *r_u)
394 {
395 struct lsa_info *info;
396 SEC_DESC *psd = NULL;
397 size_t sd_size;
398 uint32 des_access=q_u->des_access;
399 uint32 acc_granted;
400 NTSTATUS status;
401
402
403 /* map the generic bits to the lsa policy ones */
404 se_map_generic(&des_access, &lsa_generic_mapping);
405
406 /* get the generic lsa policy SD until we store it */
407 lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
408
409 if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status)) {
410 if (geteuid() != 0) {
411 return status;
412 }
413 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
414 acc_granted, des_access));
415 DEBUGADD(4,("but overwritten by euid == 0\n"));
416 }
417
418 /* This is needed for lsa_open_account and rpcclient .... :-) */
419
420 if (geteuid() == 0)
421 acc_granted = POLICY_ALL_ACCESS;
422
423 /* associate the domain SID with the (unique) handle. */
424 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
425 return NT_STATUS_NO_MEMORY;
426
427 ZERO_STRUCTP(info);
428 sid_copy(&info->sid,get_global_sam_sid());
429 info->access = acc_granted;
430
431 /* set up the LSA QUERY INFO response */
432 if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
433 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
434
435 return NT_STATUS_OK;
436 }
437
438 /***************************************************************************
439 _lsa_open_policy
440 ***************************************************************************/
441
442 NTSTATUS _lsa_open_policy(pipes_struct *p, LSA_Q_OPEN_POL *q_u, LSA_R_OPEN_POL *r_u)
443 {
444 struct lsa_info *info;
445 SEC_DESC *psd = NULL;
446 size_t sd_size;
447 uint32 des_access=q_u->des_access;
448 uint32 acc_granted;
449 NTSTATUS status;
450
451
452 /* map the generic bits to the lsa policy ones */
453 se_map_generic(&des_access, &lsa_generic_mapping);
454
455 /* get the generic lsa policy SD until we store it */
456 lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
457
458 if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status)) {
459 if (geteuid() != 0) {
460 return status;
461 }
462 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
463 acc_granted, des_access));
464 DEBUGADD(4,("but overwritten by euid == 0\n"));
465 acc_granted = des_access;
466 }
467
468 /* associate the domain SID with the (unique) handle. */
469 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
470 return NT_STATUS_NO_MEMORY;
471
472 ZERO_STRUCTP(info);
473 sid_copy(&info->sid,get_global_sam_sid());
474 info->access = acc_granted;
475
476 /* set up the LSA QUERY INFO response */
477 if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
478 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
479
480 return NT_STATUS_OK;
481 }
482
483 /***************************************************************************
484 _lsa_enum_trust_dom - this needs fixing to do more than return NULL ! JRA.
485 ufff, done :) mimir
486 ***************************************************************************/
487
488 NTSTATUS _lsa_enum_trust_dom(pipes_struct *p, LSA_Q_ENUM_TRUST_DOM *q_u, LSA_R_ENUM_TRUST_DOM *r_u)
489 {
490 struct lsa_info *info;
491 uint32 enum_context = q_u->enum_context;
492
493 /*
494 * preferred length is set to 5 as a "our" preferred length
495 * nt sets this parameter to 2
496 * update (20.08.2002): it's not preferred length, but preferred size!
497 * it needs further investigation how to optimally choose this value
498 */
499 uint32 max_num_domains = q_u->preferred_len < 5 ? q_u->preferred_len : 10;
500 TRUSTDOM **trust_doms;
501 uint32 num_domains;
502 NTSTATUS nt_status;
503
504 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
505 return NT_STATUS_INVALID_HANDLE;
506
507 /* check if the user have enough rights */
508 if (!(info->access & POLICY_VIEW_LOCAL_INFORMATION))
509 return NT_STATUS_ACCESS_DENIED;
510
511 nt_status = secrets_get_trusted_domains(p->mem_ctx, (int *)&enum_context, max_num_domains, (int *)&num_domains, &trust_doms);
512
513 if (!NT_STATUS_IS_OK(nt_status) &&
514 !NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES) &&
515 !NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MORE_ENTRIES)) {
516 return nt_status;
517 } else {
518 r_u->status = nt_status;
519 }
520
521 /* set up the lsa_enum_trust_dom response */
522
523 init_r_enum_trust_dom(p->mem_ctx, r_u, enum_context, max_num_domains, num_domains, trust_doms);
524
525 return r_u->status;
526 }
527
528 /***************************************************************************
529 _lsa_query_info. See the POLICY_INFOMATION_CLASS docs at msdn.
530 ***************************************************************************/
531
532 NTSTATUS _lsa_query_info(pipes_struct *p, LSA_Q_QUERY_INFO *q_u, LSA_R_QUERY_INFO *r_u)
533 {
534 struct lsa_info *handle;
535 LSA_INFO_UNION *info = &r_u->dom;
536 DOM_SID domain_sid;
537 const char *name;
538 DOM_SID *sid = NULL;
539
540 r_u->status = NT_STATUS_OK;
541
542 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
543 return NT_STATUS_INVALID_HANDLE;
544
545 switch (q_u->info_class) {
546 case 0x02:
547 {
548 unsigned int i;
549 /* check if the user have enough rights */
550 if (!(handle->access & POLICY_VIEW_AUDIT_INFORMATION))
551 return NT_STATUS_ACCESS_DENIED;
552
553 /* fake info: We audit everything. ;) */
554 info->id2.auditing_enabled = 1;
555 info->id2.count1 = 7;
556 info->id2.count2 = 7;
557 if ((info->id2.auditsettings = TALLOC_ARRAY(p->mem_ctx,uint32, 7)) == NULL)
558 return NT_STATUS_NO_MEMORY;
559 for (i = 0; i < 7; i++)
560 info->id2.auditsettings[i] = 3;
561 break;
562 }
563 case 0x03:
564 /* check if the user have enough rights */
565 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
566 return NT_STATUS_ACCESS_DENIED;
567
568 /* Request PolicyPrimaryDomainInformation. */
569 switch (lp_server_role()) {
570 case ROLE_DOMAIN_PDC:
571 case ROLE_DOMAIN_BDC:
572 name = get_global_sam_name();
573 sid = get_global_sam_sid();
574 break;
575 case ROLE_DOMAIN_MEMBER:
576 name = lp_workgroup();
577 /* We need to return the Domain SID here. */
578 if (secrets_fetch_domain_sid(lp_workgroup(), &domain_sid))
579 sid = &domain_sid;
580 else
581 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
582 break;
583 case ROLE_STANDALONE:
584 name = lp_workgroup();
585 sid = NULL;
586 break;
587 default:
588 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
589 }
590 init_dom_query(&r_u->dom.id3, name, sid);
591 break;
592 case 0x05:
593 /* check if the user have enough rights */
594 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
595 return NT_STATUS_ACCESS_DENIED;
596
597 /* Request PolicyAccountDomainInformation. */
598 name = get_global_sam_name();
599 sid = get_global_sam_sid();
600 init_dom_query(&r_u->dom.id5, name, sid);
601 break;
602 case 0x06:
603 /* check if the user have enough rights */
604 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
605 return NT_STATUS_ACCESS_DENIED;
606
607 switch (lp_server_role()) {
608 case ROLE_DOMAIN_BDC:
609 /*
610 * only a BDC is a backup controller
611 * of the domain, it controls.
612 */
613 info->id6.server_role = 2;
614 break;
615 default:
616 /*
617 * any other role is a primary
618 * of the domain, it controls.
619 */
620 info->id6.server_role = 3;
621 break;
622 }
623 break;
624 default:
625 DEBUG(0,("_lsa_query_info: unknown info level in Lsa Query: %d\n", q_u->info_class));
626 r_u->status = NT_STATUS_INVALID_INFO_CLASS;
627 break;
628 }
629
630 if (NT_STATUS_IS_OK(r_u->status)) {
631 r_u->undoc_buffer = 0x22000000; /* bizarre */
632 r_u->info_class = q_u->info_class;
633 }
634
635 return r_u->status;
636 }
637
638 /***************************************************************************
639 _lsa_lookup_sids
640 ***************************************************************************/
641
642 NTSTATUS _lsa_lookup_sids(pipes_struct *p, LSA_Q_LOOKUP_SIDS *q_u, LSA_R_LOOKUP_SIDS *r_u)
643 {
644 struct lsa_info *handle;
645 DOM_SID2 *sid = q_u->sids.sid;
646 int num_entries = q_u->sids.num_entries;
647 DOM_R_REF *ref = NULL;
648 LSA_TRANS_NAME_ENUM *names = NULL;
649 uint32 mapped_count = 0;
650
651 if (num_entries > MAX_LOOKUP_SIDS) {
652 num_entries = 0;
653 DEBUG(5,("_lsa_lookup_sids: limit of %d exceeded, truncating SID lookup list to %d\n", MAX_LOOKUP_SIDS, num_entries));
654 r_u->status = NT_STATUS_NONE_MAPPED;
655 }
656
657 ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
658 names = TALLOC_ZERO_P(p->mem_ctx, LSA_TRANS_NAME_ENUM);
659
660 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle)) {
661 r_u->status = NT_STATUS_INVALID_HANDLE;
662 goto done;
663 }
664
665 /* check if the user have enough rights */
666 if (!(handle->access & POLICY_LOOKUP_NAMES)) {
667 r_u->status = NT_STATUS_ACCESS_DENIED;
668 goto done;
669 }
670 if (!ref || !names)
671 return NT_STATUS_NO_MEMORY;
672
673 done:
674
675 /* set up the LSA Lookup SIDs response */
676 init_lsa_trans_names(p->mem_ctx, ref, names, num_entries, sid, &mapped_count);
677 if (NT_STATUS_IS_OK(r_u->status)) {
678 if (mapped_count == 0)
679 r_u->status = NT_STATUS_NONE_MAPPED;
680 else if (mapped_count != num_entries)
681 r_u->status = STATUS_SOME_UNMAPPED;
682 }
683 init_reply_lookup_sids(r_u, ref, names, mapped_count);
684
685 return r_u->status;
686 }
687
688 /***************************************************************************
689 lsa_reply_lookup_names
690 ***************************************************************************/
691
692 NTSTATUS _lsa_lookup_names(pipes_struct *p,LSA_Q_LOOKUP_NAMES *q_u, LSA_R_LOOKUP_NAMES *r_u)
693 {
694 struct lsa_info *handle;
695 UNISTR2 *names = q_u->uni_name;
696 int num_entries = q_u->num_entries;
697 DOM_R_REF *ref;
698 DOM_RID2 *rids;
699 uint32 mapped_count = 0;
700
701 if (num_entries > MAX_LOOKUP_SIDS) {
702 num_entries = MAX_LOOKUP_SIDS;
703 DEBUG(5,("_lsa_lookup_names: truncating name lookup list to %d\n", num_entries));
704 }
705
706 ref = TALLOC_ZERO_P(p->mem_ctx, DOM_R_REF);
707 rids = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_RID2, num_entries);
708
709 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle)) {
710 r_u->status = NT_STATUS_INVALID_HANDLE;
711 goto done;
712 }
713
714 /* check if the user have enough rights */
715 if (!(handle->access & POLICY_LOOKUP_NAMES)) {
716 r_u->status = NT_STATUS_ACCESS_DENIED;
717 goto done;
718 }
719
720 if (!ref || !rids)
721 return NT_STATUS_NO_MEMORY;
722
723 done:
724
725 /* set up the LSA Lookup RIDs response */
726 init_lsa_rid2s(ref, rids, num_entries, names, &mapped_count, p->endian);
727 if (NT_STATUS_IS_OK(r_u->status)) {
728 if (mapped_count == 0)
729 r_u->status = NT_STATUS_NONE_MAPPED;
730 else if (mapped_count != num_entries)
731 r_u->status = STATUS_SOME_UNMAPPED;
732 }
733 init_reply_lookup_names(r_u, ref, num_entries, rids, mapped_count);
734
735 return r_u->status;
736 }
737
738 /***************************************************************************
739 _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
740 ***************************************************************************/
741
742 NTSTATUS _lsa_close(pipes_struct *p, LSA_Q_CLOSE *q_u, LSA_R_CLOSE *r_u)
743 {
744 if (!find_policy_by_hnd(p, &q_u->pol, NULL))
745 return NT_STATUS_INVALID_HANDLE;
746
747 close_policy_hnd(p, &q_u->pol);
748 return NT_STATUS_OK;
749 }
750
751 /***************************************************************************
752 ***************************************************************************/
753
754 NTSTATUS _lsa_open_secret(pipes_struct *p, LSA_Q_OPEN_SECRET *q_u, LSA_R_OPEN_SECRET *r_u)
755 {
756 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
757 }
758
759 /***************************************************************************
760 ***************************************************************************/
761
762 NTSTATUS _lsa_open_trusted_domain(pipes_struct *p, LSA_Q_OPEN_TRUSTED_DOMAIN *q_u, LSA_R_OPEN_TRUSTED_DOMAIN *r_u)
763 {
764 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
765 }
766
767 /***************************************************************************
768 ***************************************************************************/
769
770 NTSTATUS _lsa_create_trusted_domain(pipes_struct *p, LSA_Q_CREATE_TRUSTED_DOMAIN *q_u, LSA_R_CREATE_TRUSTED_DOMAIN *r_u)
771 {
772 return NT_STATUS_ACCESS_DENIED;
773 }
774
775 /***************************************************************************
776 ***************************************************************************/
777
778 NTSTATUS _lsa_create_secret(pipes_struct *p, LSA_Q_CREATE_SECRET *q_u, LSA_R_CREATE_SECRET *r_u)
779 {
780 return NT_STATUS_ACCESS_DENIED;
781 }
782
783 /***************************************************************************
784 ***************************************************************************/
785
786 NTSTATUS _lsa_set_secret(pipes_struct *p, LSA_Q_SET_SECRET *q_u, LSA_R_SET_SECRET *r_u)
787 {
788 return NT_STATUS_ACCESS_DENIED;
789 }
790
791 /***************************************************************************
792 ***************************************************************************/
793
794 NTSTATUS _lsa_delete_object(pipes_struct *p, LSA_Q_DELETE_OBJECT *q_u, LSA_R_DELETE_OBJECT *r_u)
795 {
796 return NT_STATUS_ACCESS_DENIED;
797 }
798
799 /***************************************************************************
800 _lsa_enum_privs.
801 ***************************************************************************/
802
803 NTSTATUS _lsa_enum_privs(pipes_struct *p, LSA_Q_ENUM_PRIVS *q_u, LSA_R_ENUM_PRIVS *r_u)
804 {
805 struct lsa_info *handle;
806 uint32 i;
807 uint32 enum_context = q_u->enum_context;
808 int num_privs = count_all_privileges();
809 LSA_PRIV_ENTRY *entries = NULL;
810 LUID_ATTR luid;
811
812 /* remember that the enum_context starts at 0 and not 1 */
813
814 if ( enum_context >= num_privs )
815 return NT_STATUS_NO_MORE_ENTRIES;
816
817 DEBUG(10,("_lsa_enum_privs: enum_context:%d total entries:%d\n",
818 enum_context, num_privs));
819
820 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
821 return NT_STATUS_INVALID_HANDLE;
822
823 /* check if the user have enough rights
824 I don't know if it's the right one. not documented. */
825
826 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
827 return NT_STATUS_ACCESS_DENIED;
828
829 if ( !(entries = TALLOC_ZERO_ARRAY(p->mem_ctx, LSA_PRIV_ENTRY, num_privs )) )
830 return NT_STATUS_NO_MEMORY;
831
832 for (i = 0; i < num_privs; i++) {
833 if( i < enum_context) {
834 init_unistr2(&entries[i].name, NULL, UNI_FLAGS_NONE);
835 init_uni_hdr(&entries[i].hdr_name, &entries[i].name);
836
837 entries[i].luid_low = 0;
838 entries[i].luid_high = 0;
839 } else {
840 init_unistr2(&entries[i].name, privs[i].name, UNI_FLAGS_NONE);
841 init_uni_hdr(&entries[i].hdr_name, &entries[i].name);
842
843 luid = get_privilege_luid( &privs[i].se_priv );
844
845 entries[i].luid_low = luid.luid.low;
846 entries[i].luid_high = luid.luid.high;
847 }
848 }
849
850 enum_context = num_privs;
851
852 init_lsa_r_enum_privs(r_u, enum_context, num_privs, entries);
853
854 return NT_STATUS_OK;
855 }
856
857 /***************************************************************************
858 _lsa_priv_get_dispname.
859 ***************************************************************************/
860
861 NTSTATUS _lsa_priv_get_dispname(pipes_struct *p, LSA_Q_PRIV_GET_DISPNAME *q_u, LSA_R_PRIV_GET_DISPNAME *r_u)
862 {
863 struct lsa_info *handle;
864 fstring name_asc;
865 const char *description;
866
867 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
868 return NT_STATUS_INVALID_HANDLE;
869
870 /* check if the user have enough rights */
871
872 /*
873 * I don't know if it's the right one. not documented.
874 */
875 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
876 return NT_STATUS_ACCESS_DENIED;
877
878 unistr2_to_ascii(name_asc, &q_u->name, sizeof(name_asc));
879
880 DEBUG(10,("_lsa_priv_get_dispname: name = %s\n", name_asc));
881
882 description = get_privilege_dispname( name_asc );
883
884 if ( description ) {
885 DEBUG(10,("_lsa_priv_get_dispname: display name = %s\n", description));
886
887 init_unistr2(&r_u->desc, description, UNI_FLAGS_NONE);
888 init_uni_hdr(&r_u->hdr_desc, &r_u->desc);
889
890 r_u->ptr_info = 0xdeadbeef;
891 r_u->lang_id = q_u->lang_id;
892
893 return NT_STATUS_OK;
894 } else {
895 DEBUG(10,("_lsa_priv_get_dispname: doesn't exist\n"));
896
897 r_u->ptr_info = 0;
898
899 return NT_STATUS_NO_SUCH_PRIVILEGE;
900 }
901 }
902
903 /***************************************************************************
904 _lsa_enum_accounts.
905 ***************************************************************************/
906
907 NTSTATUS _lsa_enum_accounts(pipes_struct *p, LSA_Q_ENUM_ACCOUNTS *q_u, LSA_R_ENUM_ACCOUNTS *r_u)
908 {
909 struct lsa_info *handle;
910 DOM_SID *sid_list;
911 int i, j, num_entries;
912 LSA_SID_ENUM *sids=&r_u->sids;
913 NTSTATUS ret;
914
915 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
916 return NT_STATUS_INVALID_HANDLE;
917
918 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
919 return NT_STATUS_ACCESS_DENIED;
920
921 sid_list = NULL;
922 num_entries = 0;
923
924 /* The only way we can currently find out all the SIDs that have been
925 privileged is to scan all privileges */
926
927 if (!NT_STATUS_IS_OK(ret = privilege_enumerate_accounts(&sid_list, &num_entries))) {
928 return ret;
929 }
930
931 if (q_u->enum_context >= num_entries)
932 return NT_STATUS_NO_MORE_ENTRIES;
933
934 sids->ptr_sid = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_entries-q_u->enum_context);
935 sids->sid = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_SID2, num_entries-q_u->enum_context);
936
937 if (sids->ptr_sid==NULL || sids->sid==NULL) {
938 SAFE_FREE(sid_list);
939 return NT_STATUS_NO_MEMORY;
940 }
941
942 for (i = q_u->enum_context, j = 0; i < num_entries; i++, j++) {
943 init_dom_sid2(&(*sids).sid[j], &sid_list[i]);
944 (*sids).ptr_sid[j] = 1;
945 }
946
947 SAFE_FREE(sid_list);
948
949 init_lsa_r_enum_accounts(r_u, num_entries);
950
951 return NT_STATUS_OK;
952 }
953
954
955 NTSTATUS _lsa_unk_get_connuser(pipes_struct *p, LSA_Q_UNK_GET_CONNUSER *q_u, LSA_R_UNK_GET_CONNUSER *r_u)
956 {
957 fstring username, domname;
958 user_struct *vuser = get_valid_user_struct(p->vuid);
959
960 if (vuser == NULL)
961 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
962
963 fstrcpy(username, vuser->user.smb_name);
964 fstrcpy(domname, vuser->user.domain);
965
966 r_u->ptr_user_name = 1;
967 init_unistr2(&r_u->uni2_user_name, username, UNI_STR_TERMINATE);
968 init_uni_hdr(&r_u->hdr_user_name, &r_u->uni2_user_name);
969
970 r_u->unk1 = 1;
971
972 r_u->ptr_dom_name = 1;
973 init_unistr2(&r_u->uni2_dom_name, domname, UNI_STR_TERMINATE);
974 init_uni_hdr(&r_u->hdr_dom_name, &r_u->uni2_dom_name);
975
976 r_u->status = NT_STATUS_OK;
977
978 return r_u->status;
979 }
980
981 /***************************************************************************
982 Lsa Create Account
983 ***************************************************************************/
984
985 NTSTATUS _lsa_create_account(pipes_struct *p, LSA_Q_CREATEACCOUNT *q_u, LSA_R_CREATEACCOUNT *r_u)
986 {
987 struct lsa_info *handle;
988 struct lsa_info *info;
989
990 /* find the connection policy handle. */
991 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
992 return NT_STATUS_INVALID_HANDLE;
993
994 /* check if the user have enough rights */
995
996 /*
997 * I don't know if it's the right one. not documented.
998 * but guessed with rpcclient.
999 */
1000 if (!(handle->access & POLICY_GET_PRIVATE_INFORMATION))
1001 return NT_STATUS_ACCESS_DENIED;
1002
1003 /* check to see if the pipe_user is a Domain Admin since
1004 account_pol.tdb was already opened as root, this is all we have */
1005
1006 if ( !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1007 return NT_STATUS_ACCESS_DENIED;
1008
1009 if ( is_privileged_sid( &q_u->sid.sid ) )
1010 return NT_STATUS_OBJECT_NAME_COLLISION;
1011
1012 /* associate the user/group SID with the (unique) handle. */
1013
1014 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
1015 return NT_STATUS_NO_MEMORY;
1016
1017 ZERO_STRUCTP(info);
1018 info->sid = q_u->sid.sid;
1019 info->access = q_u->access;
1020
1021 /* get a (unique) handle. open a policy on it. */
1022 if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
1023 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1024
1025 return privilege_create_account( &info->sid );
1026 }
1027
1028
1029 /***************************************************************************
1030 Lsa Open Account
1031 ***************************************************************************/
1032
1033 NTSTATUS _lsa_open_account(pipes_struct *p, LSA_Q_OPENACCOUNT *q_u, LSA_R_OPENACCOUNT *r_u)
1034 {
1035 struct lsa_info *handle;
1036 struct lsa_info *info;
1037
1038 /* find the connection policy handle. */
1039 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
1040 return NT_STATUS_INVALID_HANDLE;
1041
1042 /* check if the user have enough rights */
1043
1044 /*
1045 * I don't know if it's the right one. not documented.
1046 * but guessed with rpcclient.
1047 */
1048 if (!(handle->access & POLICY_GET_PRIVATE_INFORMATION))
1049 return NT_STATUS_ACCESS_DENIED;
1050
1051 /* TODO: Fis the parsing routine before reenabling this check! */
1052 #if 0
1053 if (!lookup_sid(&handle->sid, dom_name, name, &type))
1054 return NT_STATUS_ACCESS_DENIED;
1055 #endif
1056 /* associate the user/group SID with the (unique) handle. */
1057 if ((info = SMB_MALLOC_P(struct lsa_info)) == NULL)
1058 return NT_STATUS_NO_MEMORY;
1059
1060 ZERO_STRUCTP(info);
1061 info->sid = q_u->sid.sid;
1062 info->access = q_u->access;
1063
1064 /* get a (unique) handle. open a policy on it. */
1065 if (!create_policy_hnd(p, &r_u->pol, free_lsa_info, (void *)info))
1066 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1067
1068 return NT_STATUS_OK;
1069 }
1070
1071 /***************************************************************************
1072 For a given SID, enumerate all the privilege this account has.
1073 ***************************************************************************/
1074
1075 NTSTATUS _lsa_enum_privsaccount(pipes_struct *p, prs_struct *ps, LSA_Q_ENUMPRIVSACCOUNT *q_u, LSA_R_ENUMPRIVSACCOUNT *r_u)
1076 {
1077 struct lsa_info *info=NULL;
1078 SE_PRIV mask;
1079 PRIVILEGE_SET privileges;
1080
1081 /* find the connection policy handle. */
1082 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1083 return NT_STATUS_INVALID_HANDLE;
1084
1085 if ( !get_privileges_for_sids( &mask, &info->sid, 1 ) )
1086 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1087
1088 privilege_set_init( &privileges );
1089
1090 if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
1091
1092 DEBUG(10,("_lsa_enum_privsaccount: %s has %d privileges\n",
1093 sid_string_static(&info->sid), privileges.count));
1094
1095 r_u->status = init_lsa_r_enum_privsaccount(ps->mem_ctx, r_u, privileges.set, privileges.count, 0);
1096 }
1097 else
1098 r_u->status = NT_STATUS_NO_SUCH_PRIVILEGE;
1099
1100 privilege_set_free( &privileges );
1101
1102 return r_u->status;
1103 }
1104
1105 /***************************************************************************
1106
1107 ***************************************************************************/
1108
1109 NTSTATUS _lsa_getsystemaccount(pipes_struct *p, LSA_Q_GETSYSTEMACCOUNT *q_u, LSA_R_GETSYSTEMACCOUNT *r_u)
1110 {
1111 struct lsa_info *info=NULL;
1112 fstring name, dom_name;
1113 enum SID_NAME_USE type;
1114
1115 /* find the connection policy handle. */
1116
1117 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1118 return NT_STATUS_INVALID_HANDLE;
1119
1120 if (!lookup_sid(&info->sid, dom_name, name, &type))
1121 return NT_STATUS_ACCESS_DENIED;
1122
1123 /*
1124 0x01 -> Log on locally
1125 0x02 -> Access this computer from network
1126 0x04 -> Log on as a batch job
1127 0x10 -> Log on as a service
1128
1129 they can be ORed together
1130 */
1131
1132 r_u->access = PR_LOG_ON_LOCALLY | PR_ACCESS_FROM_NETWORK;
1133
1134 return NT_STATUS_OK;
1135 }
1136
1137 /***************************************************************************
1138 update the systemaccount information
1139 ***************************************************************************/
1140
1141 NTSTATUS _lsa_setsystemaccount(pipes_struct *p, LSA_Q_SETSYSTEMACCOUNT *q_u, LSA_R_SETSYSTEMACCOUNT *r_u)
1142 {
1143 struct lsa_info *info=NULL;
1144 GROUP_MAP map;
1145 r_u->status = NT_STATUS_OK;
1146
1147 /* find the connection policy handle. */
1148 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1149 return NT_STATUS_INVALID_HANDLE;
1150
1151 /* check to see if the pipe_user is a Domain Admin since
1152 account_pol.tdb was already opened as root, this is all we have */
1153
1154 if ( !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1155 return NT_STATUS_ACCESS_DENIED;
1156
1157 if (!pdb_getgrsid(&map, info->sid))
1158 return NT_STATUS_NO_SUCH_GROUP;
1159
1160 if(!pdb_update_group_mapping_entry(&map))
1161 return NT_STATUS_NO_SUCH_GROUP;
1162
1163 return r_u->status;
1164 }
1165
1166 /***************************************************************************
1167 For a given SID, add some privileges.
1168 ***************************************************************************/
1169
1170 NTSTATUS _lsa_addprivs(pipes_struct *p, LSA_Q_ADDPRIVS *q_u, LSA_R_ADDPRIVS *r_u)
1171 {
1172 struct lsa_info *info = NULL;
1173 SE_PRIV mask;
1174 PRIVILEGE_SET *set = NULL;
1175 struct current_user user;
1176
1177 /* find the connection policy handle. */
1178 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1179 return NT_STATUS_INVALID_HANDLE;
1180
1181 /* check to see if the pipe_user is root or a Domain Admin since
1182 account_pol.tdb was already opened as root, this is all we have */
1183
1184 get_current_user( &user, p );
1185 if ( user.uid != sec_initial_uid()
1186 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1187 {
1188 return NT_STATUS_ACCESS_DENIED;
1189 }
1190
1191 set = &q_u->set;
1192
1193 if ( !privilege_set_to_se_priv( &mask, set ) )
1194 return NT_STATUS_NO_SUCH_PRIVILEGE;
1195
1196 if ( !grant_privilege( &info->sid, &mask ) ) {
1197 DEBUG(3,("_lsa_addprivs: grant_privilege(%s) failed!\n",
1198 sid_string_static(&info->sid) ));
1199 DEBUG(3,("Privilege mask:\n"));
1200 dump_se_priv( DBGC_ALL, 3, &mask );
1201 return NT_STATUS_NO_SUCH_PRIVILEGE;
1202 }
1203
1204 return NT_STATUS_OK;
1205 }
1206
1207 /***************************************************************************
1208 For a given SID, remove some privileges.
1209 ***************************************************************************/
1210
1211 NTSTATUS _lsa_removeprivs(pipes_struct *p, LSA_Q_REMOVEPRIVS *q_u, LSA_R_REMOVEPRIVS *r_u)
1212 {
1213 struct lsa_info *info = NULL;
1214 SE_PRIV mask;
1215 PRIVILEGE_SET *set = NULL;
1216 struct current_user user;
1217
1218 /* find the connection policy handle. */
1219 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1220 return NT_STATUS_INVALID_HANDLE;
1221
1222 /* check to see if the pipe_user is root or a Domain Admin since
1223 account_pol.tdb was already opened as root, this is all we have */
1224
1225 get_current_user( &user, p );
1226 if ( user.uid != sec_initial_uid()
1227 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1228 {
1229 return NT_STATUS_ACCESS_DENIED;
1230 }
1231
1232 set = &q_u->set;
1233
1234 if ( !privilege_set_to_se_priv( &mask, set ) )
1235 return NT_STATUS_NO_SUCH_PRIVILEGE;
1236
1237 if ( !revoke_privilege( &info->sid, &mask ) ) {
1238 DEBUG(3,("_lsa_removeprivs: revoke_privilege(%s) failed!\n",
1239 sid_string_static(&info->sid) ));
1240 DEBUG(3,("Privilege mask:\n"));
1241 dump_se_priv( DBGC_ALL, 3, &mask );
1242 return NT_STATUS_NO_SUCH_PRIVILEGE;
1243 }
1244
1245 return NT_STATUS_OK;
1246 }
1247
1248 /***************************************************************************
1249 For a given SID, remove some privileges.
1250 ***************************************************************************/
1251
1252 NTSTATUS _lsa_query_secobj(pipes_struct *p, LSA_Q_QUERY_SEC_OBJ *q_u, LSA_R_QUERY_SEC_OBJ *r_u)
1253 {
1254 struct lsa_info *handle=NULL;
1255 SEC_DESC *psd = NULL;
1256 size_t sd_size;
1257 NTSTATUS status;
1258
1259 r_u->status = NT_STATUS_OK;
1260
1261 /* find the connection policy handle. */
1262 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
1263 return NT_STATUS_INVALID_HANDLE;
1264
1265 /* check if the user have enough rights */
1266 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
1267 return NT_STATUS_ACCESS_DENIED;
1268
1269
1270 switch (q_u->sec_info) {
1271 case 1:
1272 /* SD contains only the owner */
1273
1274 status=lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
1275 if(!NT_STATUS_IS_OK(status))
1276 return NT_STATUS_NO_MEMORY;
1277
1278
1279 if((r_u->buf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1280 return NT_STATUS_NO_MEMORY;
1281 break;
1282 case 4:
1283 /* SD contains only the ACL */
1284
1285 status=lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size);
1286 if(!NT_STATUS_IS_OK(status))
1287 return NT_STATUS_NO_MEMORY;
1288
1289 if((r_u->buf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
1290 return NT_STATUS_NO_MEMORY;
1291 break;
1292 default:
1293 return NT_STATUS_INVALID_LEVEL;
1294 }
1295
1296 r_u->ptr=1;
1297
1298 return r_u->status;
1299 }
1300
1301 #if 0 /* AD DC work in ongoing in Samba 4 */
1302
1303 /***************************************************************************
1304 ***************************************************************************/
1305
1306 NTSTATUS _lsa_query_info2(pipes_struct *p, LSA_Q_QUERY_INFO2 *q_u, LSA_R_QUERY_INFO2 *r_u)
1307 {
1308 struct lsa_info *handle;
1309 const char *nb_name;
1310 char *dns_name = NULL;
1311 char *forest_name = NULL;
1312 DOM_SID *sid = NULL;
1313 struct uuid guid;
1314 fstring dnsdomname;
1315
1316 ZERO_STRUCT(guid);
1317 r_u->status = NT_STATUS_OK;
1318
1319 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&handle))
1320 return NT_STATUS_INVALID_HANDLE;
1321
1322 switch (q_u->info_class) {
1323 case 0x0c:
1324 /* check if the user have enough rights */
1325 if (!(handle->access & POLICY_VIEW_LOCAL_INFORMATION))
1326 return NT_STATUS_ACCESS_DENIED;
1327
1328 /* Request PolicyPrimaryDomainInformation. */
1329 switch (lp_server_role()) {
1330 case ROLE_DOMAIN_PDC:
1331 case ROLE_DOMAIN_BDC:
1332 nb_name = get_global_sam_name();
1333 /* ugly temp hack for these next two */
1334
1335 /* This should be a 'netbios domain -> DNS domain' mapping */
1336 dnsdomname[0] = '\0';
1337 get_mydnsdomname(dnsdomname);
1338 strlower_m(dnsdomname);
1339
1340 dns_name = dnsdomname;
1341 forest_name = dnsdomname;
1342
1343 sid = get_global_sam_sid();
1344 secrets_fetch_domain_guid(lp_workgroup(), &guid);
1345 break;
1346 default:
1347 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1348 }
1349 init_dns_dom_info(&r_u->info.dns_dom_info, nb_name, dns_name,
1350 forest_name,&guid,sid);
1351 break;
1352 default:
1353 DEBUG(0,("_lsa_query_info2: unknown info level in Lsa Query: %d\n", q_u->info_class));
1354 r_u->status = NT_STATUS_INVALID_INFO_CLASS;
1355 break;
1356 }
1357
1358 if (NT_STATUS_IS_OK(r_u->status)) {
1359 r_u->ptr = 0x1;
1360 r_u->info_class = q_u->info_class;
1361 }
1362
1363 return r_u->status;
1364 }
1365 #endif /* AD DC work in ongoing in Samba 4 */
1366
1367 /***************************************************************************
1368 ***************************************************************************/
1369
1370 NTSTATUS _lsa_add_acct_rights(pipes_struct *p, LSA_Q_ADD_ACCT_RIGHTS *q_u, LSA_R_ADD_ACCT_RIGHTS *r_u)
1371 {
1372 struct lsa_info *info = NULL;
1373 int i = 0;
1374 DOM_SID sid;
1375 fstring privname;
1376 UNISTR4_ARRAY *uni_privnames = q_u->rights;
1377 struct current_user user;
1378
1379
1380 /* find the connection policy handle. */
1381 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1382 return NT_STATUS_INVALID_HANDLE;
1383
1384 /* check to see if the pipe_user is a Domain Admin since
1385 account_pol.tdb was already opened as root, this is all we have */
1386
1387 get_current_user( &user, p );
1388 if ( user.uid != sec_initial_uid()
1389 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1390 {
1391 return NT_STATUS_ACCESS_DENIED;
1392 }
1393
1394 /* according to an NT4 PDC, you can add privileges to SIDs even without
1395 call_lsa_create_account() first. And you can use any arbitrary SID. */
1396
1397 sid_copy( &sid, &q_u->sid.sid );
1398
1399 /* just a little sanity check */
1400
1401 if ( q_u->count != uni_privnames->count ) {
1402 DEBUG(0,("_lsa_add_acct_rights: count != number of UNISTR2 elements!\n"));
1403 return NT_STATUS_INVALID_HANDLE;
1404 }
1405
1406 for ( i=0; i<q_u->count; i++ ) {
1407 UNISTR4 *uni4_str = &uni_privnames->strings[i];
1408
1409 /* only try to add non-null strings */
1410
1411 if ( !uni4_str->string )
1412 continue;
1413
1414 rpcstr_pull( privname, uni4_str->string->buffer, sizeof(privname), -1, STR_TERMINATE );
1415
1416 if ( !grant_privilege_by_name( &sid, privname ) ) {
1417 DEBUG(2,("_lsa_add_acct_rights: Failed to add privilege [%s]\n", privname ));
1418 return NT_STATUS_NO_SUCH_PRIVILEGE;
1419 }
1420 }
1421
1422 return NT_STATUS_OK;
1423 }
1424
1425 /***************************************************************************
1426 ***************************************************************************/
1427
1428 NTSTATUS _lsa_remove_acct_rights(pipes_struct *p, LSA_Q_REMOVE_ACCT_RIGHTS *q_u, LSA_R_REMOVE_ACCT_RIGHTS *r_u)
1429 {
1430 struct lsa_info *info = NULL;
1431 int i = 0;
1432 DOM_SID sid;
1433 fstring privname;
1434 UNISTR4_ARRAY *uni_privnames = q_u->rights;
1435 struct current_user user;
1436
1437
1438 /* find the connection policy handle. */
1439 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1440 return NT_STATUS_INVALID_HANDLE;
1441
1442 /* check to see if the pipe_user is a Domain Admin since
1443 account_pol.tdb was already opened as root, this is all we have */
1444
1445 get_current_user( &user, p );
1446 if ( user.uid != sec_initial_uid()
1447 && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
1448 {
1449 return NT_STATUS_ACCESS_DENIED;
1450 }
1451
1452 sid_copy( &sid, &q_u->sid.sid );
1453
1454 if ( q_u->removeall ) {
1455 if ( !revoke_all_privileges( &sid ) )
1456 return NT_STATUS_ACCESS_DENIED;
1457
1458 return NT_STATUS_OK;
1459 }
1460
1461 /* just a little sanity check */
1462
1463 if ( q_u->count != uni_privnames->count ) {
1464 DEBUG(0,("_lsa_add_acct_rights: count != number of UNISTR2 elements!\n"));
1465 return NT_STATUS_INVALID_HANDLE;
1466 }
1467
1468 for ( i=0; i<q_u->count; i++ ) {
1469 UNISTR4 *uni4_str = &uni_privnames->strings[i];
1470
1471 /* only try to add non-null strings */
1472
1473 if ( !uni4_str->string )
1474 continue;
1475
1476 rpcstr_pull( privname, uni4_str->string->buffer, sizeof(privname), -1, STR_TERMINATE );
1477
1478 if ( !revoke_privilege_by_name( &sid, privname ) ) {
1479 DEBUG(2,("_lsa_remove_acct_rights: Failed to revoke privilege [%s]\n", privname ));
1480 return NT_STATUS_NO_SUCH_PRIVILEGE;
1481 }
1482 }
1483
1484 return NT_STATUS_OK;
1485 }
1486
1487
1488 /***************************************************************************
1489 ***************************************************************************/
1490
1491 NTSTATUS _lsa_enum_acct_rights(pipes_struct *p, LSA_Q_ENUM_ACCT_RIGHTS *q_u, LSA_R_ENUM_ACCT_RIGHTS *r_u)
1492 {
1493 struct lsa_info *info = NULL;
1494 DOM_SID sid;
1495 PRIVILEGE_SET privileges;
1496 SE_PRIV mask;
1497
1498
1499 /* find the connection policy handle. */
1500
1501 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1502 return NT_STATUS_INVALID_HANDLE;
1503
1504 /* according to an NT4 PDC, you can add privileges to SIDs even without
1505 call_lsa_create_account() first. And you can use any arbitrary SID. */
1506
1507 sid_copy( &sid, &q_u->sid.sid );
1508
1509 if ( !get_privileges_for_sids( &mask, &sid, 1 ) )
1510 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1511
1512 privilege_set_init( &privileges );
1513
1514 if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
1515
1516 DEBUG(10,("_lsa_enum_acct_rights: %s has %d privileges\n",
1517 sid_string_static(&sid), privileges.count));
1518
1519 r_u->status = init_r_enum_acct_rights( r_u, &privileges );
1520 }
1521 else
1522 r_u->status = NT_STATUS_NO_SUCH_PRIVILEGE;
1523
1524 privilege_set_free( &privileges );
1525
1526 return r_u->status;
1527 }
1528
1529
1530 /***************************************************************************
1531 ***************************************************************************/
1532
1533 NTSTATUS _lsa_lookup_priv_value(pipes_struct *p, LSA_Q_LOOKUP_PRIV_VALUE *q_u, LSA_R_LOOKUP_PRIV_VALUE *r_u)
1534 {
1535 struct lsa_info *info = NULL;
1536 fstring name;
1537 LUID_ATTR priv_luid;
1538 SE_PRIV mask;
1539
1540 /* find the connection policy handle. */
1541
1542 if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1543 return NT_STATUS_INVALID_HANDLE;
1544
1545 unistr2_to_ascii(name, &q_u->privname.unistring, sizeof(name));
1546
1547 DEBUG(10,("_lsa_lookup_priv_value: name = %s\n", name));
1548
1549 if ( !se_priv_from_name( name, &mask ) )
1550 return NT_STATUS_NO_SUCH_PRIVILEGE;
1551
1552 priv_luid = get_privilege_luid( &mask );
1553
1554 r_u->luid.low = priv_luid.luid.low;
1555 r_u->luid.high = priv_luid.luid.high;
1556
1557
1558 return NT_STATUS_OK;
1559 }
1560