sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Code

s3-samr: remove duplicate copies of SAM server specific access rights.

Browse Source 
Guenther
This commit is contained in:
Günther Deschner 2008-10-23 19:01:04 +02:00
parent 65eca73272
commit 700cece822
3 changed files with 8 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
source3/include/rpc_secdes.h
View File

@ -214,37 +214,6 @@ struct standard_mapping {
SA_RIGHT_FILE_WRITE_DATA | \
SA_RIGHT_FILE_READ_DATA)
/* SAM server specific access rights */
#define SA_RIGHT_SAM_CONNECT_SERVER 0x00000001
#define SA_RIGHT_SAM_SHUTDOWN_SERVER 0x00000002
#define SA_RIGHT_SAM_INITIALISE_SERVER 0x00000004
#define SA_RIGHT_SAM_CREATE_DOMAIN 0x00000008
#define SA_RIGHT_SAM_ENUM_DOMAINS 0x00000010
#define SA_RIGHT_SAM_OPEN_DOMAIN 0x00000020
#define SA_RIGHT_SAM_ALL_ACCESS 0x0000003F
#define GENERIC_RIGHTS_SAM_ALL_ACCESS \
(STANDARD_RIGHTS_REQUIRED_ACCESS| \
SA_RIGHT_SAM_ALL_ACCESS)
#define GENERIC_RIGHTS_SAM_READ \
(STANDARD_RIGHTS_READ_ACCESS | \
SA_RIGHT_SAM_ENUM_DOMAINS)
#define GENERIC_RIGHTS_SAM_WRITE \
(STANDARD_RIGHTS_WRITE_ACCESS | \
SA_RIGHT_SAM_CREATE_DOMAIN | \
SA_RIGHT_SAM_INITIALISE_SERVER | \
SA_RIGHT_SAM_SHUTDOWN_SERVER)
#define GENERIC_RIGHTS_SAM_EXECUTE \
(STANDARD_RIGHTS_EXECUTE_ACCESS | \
SA_RIGHT_SAM_OPEN_DOMAIN | \
SA_RIGHT_SAM_CONNECT_SERVER)
/* Domain Object specific access rights */
#define SA_RIGHT_DOMAIN_LOOKUP_INFO_1 0x00000001

14
source3/rpc_server/srv_samr_nt.c
View File

@ -622,7 +622,7 @@ NTSTATUS _samr_OpenDomain(pipes_struct *p,
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(info->acc_granted,
SA_RIGHT_SAM_OPEN_DOMAIN,
SAMR_ACCESS_OPEN_DOMAIN,
"_samr_OpenDomain" );
if ( !NT_STATUS_IS_OK(status) )
@ -2891,7 +2891,7 @@ NTSTATUS _samr_QueryDomainInfo(pipes_struct *p,
}
status = access_check_samr_function(info->acc_granted,
SA_RIGHT_SAM_OPEN_DOMAIN,
SAMR_ACCESS_OPEN_DOMAIN,
"_samr_QueryDomainInfo" );
if ( !NT_STATUS_IS_OK(status) )
@ -3284,14 +3284,14 @@ NTSTATUS _samr_Connect(pipes_struct *p,
if ((info = get_samr_info_by_sid(NULL)) == NULL)
return NT_STATUS_NO_MEMORY;
/* don't give away the farm but this is probably ok. The SA_RIGHT_SAM_ENUM_DOMAINS
/* don't give away the farm but this is probably ok. The SAMR_ACCESS_ENUM_DOMAINS
was observed from a win98 client trying to enumerate users (when configured
user level access control on shares) --jerry */
map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
se_map_generic( &des_access, &sam_generic_mapping );
info->acc_granted = des_access & (SA_RIGHT_SAM_ENUM_DOMAINS|SA_RIGHT_SAM_OPEN_DOMAIN);
info->acc_granted = des_access & (SAMR_ACCESS_ENUM_DOMAINS|SAMR_ACCESS_OPEN_DOMAIN);
/* get a (unique) handle. open a policy on it. */
if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
@ -3474,11 +3474,11 @@ NTSTATUS _samr_LookupDomain(pipes_struct *p,
if (!find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info))
return NT_STATUS_INVALID_HANDLE;
/* win9x user manager likes to use SA_RIGHT_SAM_ENUM_DOMAINS here.
/* win9x user manager likes to use SAMR_ACCESS_ENUM_DOMAINS here.
Reverted that change so we will work with RAS servers again */
status = access_check_samr_function(info->acc_granted,
SA_RIGHT_SAM_OPEN_DOMAIN,
SAMR_ACCESS_OPEN_DOMAIN,
"_samr_LookupDomain");
if (!NT_STATUS_IS_OK(status)) {
return status;
@ -3524,7 +3524,7 @@ NTSTATUS _samr_EnumDomains(pipes_struct *p,
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(info->acc_granted,
SA_RIGHT_SAM_ENUM_DOMAINS,
SAMR_ACCESS_ENUM_DOMAINS,
"_samr_EnumDomains");
if (!NT_STATUS_IS_OK(status)) {
return status;

2
source3/utils/net_rpc.c
View File

@ -6113,7 +6113,7 @@ static int rpc_trustdom_list(struct net_context *c, int argc, const char **argv)
/* SamrConnect2 */
nt_status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
pipe_hnd->desthost,
SA_RIGHT_SAM_OPEN_DOMAIN,
SAMR_ACCESS_OPEN_DOMAIN,
&connect_hnd);
if (!NT_STATUS_IS_OK(nt_status)) {
DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",