sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-12-13 16:23:50 +03:00
Code Activity

port sec_desc headers reordering from HEAD.

Browse Source 
Thanks to Andrew Brtlet for the diff :-)
This commit is contained in:
Simo Sorce
-
parent 8abe71c4d7
commit cf67981e73
6 changed files with 297 additions and 225 deletions
Download Patch File Download Diff File Expand all files Collapse all files

166
source/include/rpc_samr.h
View File

@@ -147,172 +147,6 @@ SamrTestPrivateFunctionsUser
#define SAMR_SET_USERINFO 0x3A
#define SAMR_CONNECT4 0x3E
/* Access bits to the SAM-object */
#define SAMR_ACCESS_UNKNOWN_1 0x00000001
#define SAMR_ACCESS_SHUTDOWN_SERVER 0x00000002
#define SAMR_ACCESS_UNKNOWN_4 0x00000004
#define SAMR_ACCESS_UNKNOWN_8 0x00000008
#define SAMR_ACCESS_ENUM_DOMAINS 0x00000010
#define SAMR_ACCESS_OPEN_DOMAIN 0x00000020
#define SAMR_ALL_ACCESS ( STANDARD_RIGHTS_REQUIRED_ACCESS | \
SAMR_ACCESS_OPEN_DOMAIN | \
SAMR_ACCESS_ENUM_DOMAINS | \
SAMR_ACCESS_UNKNOWN_8 | \
SAMR_ACCESS_UNKNOWN_4 | \
SAMR_ACCESS_SHUTDOWN_SERVER | \
SAMR_ACCESS_UNKNOWN_1 )
#define SAMR_READ ( STANDARD_RIGHTS_READ_ACCESS | \
SAMR_ACCESS_ENUM_DOMAINS )
#define SAMR_WRITE ( STANDARD_RIGHTS_WRITE_ACCESS | \
SAMR_ACCESS_UNKNOWN_8 | \
SAMR_ACCESS_UNKNOWN_4 | \
SAMR_ACCESS_SHUTDOWN_SERVER )
#define SAMR_EXECUTE ( STANDARD_RIGHTS_EXECUTE_ACCESS | \
SAMR_ACCESS_OPEN_DOMAIN | \
SAMR_ACCESS_UNKNOWN_1 )
/* Access bits to Domain-objects */
#define DOMAIN_ACCESS_LOOKUP_INFO_1 0x000000001
#define DOMAIN_ACCESS_SET_INFO_1 0x000000002
#define DOMAIN_ACCESS_LOOKUP_INFO_2 0x000000004
#define DOMAIN_ACCESS_SET_INFO_2 0x000000008
#define DOMAIN_ACCESS_CREATE_USER 0x000000010
#define DOMAIN_ACCESS_CREATE_GROUP 0x000000020
#define DOMAIN_ACCESS_CREATE_ALIAS 0x000000040
#define DOMAIN_ACCESS_LOOKUP_ALIAS_BY_MEM 0x000000080
#define DOMAIN_ACCESS_ENUM_ACCOUNTS 0x000000100
#define DOMAIN_ACCESS_OPEN_ACCOUNT 0x000000200
#define DOMAIN_ACCESS_SET_INFO_3 0x000000400
#define DOMAIN_ALL_ACCESS ( STANDARD_RIGHTS_REQUIRED_ACCESS | \
DOMAIN_ACCESS_SET_INFO_3 | \
DOMAIN_ACCESS_OPEN_ACCOUNT | \
DOMAIN_ACCESS_ENUM_ACCOUNTS | \
DOMAIN_ACCESS_LOOKUP_ALIAS_BY_MEM | \
DOMAIN_ACCESS_CREATE_ALIAS | \
DOMAIN_ACCESS_CREATE_GROUP | \
DOMAIN_ACCESS_CREATE_USER | \
DOMAIN_ACCESS_SET_INFO_2 | \
DOMAIN_ACCESS_LOOKUP_INFO_2 | \
DOMAIN_ACCESS_SET_INFO_1 | \
DOMAIN_ACCESS_LOOKUP_INFO_1 )
#define DOMAIN_READ ( STANDARD_RIGHTS_READ_ACCESS | \
DOMAIN_ACCESS_LOOKUP_ALIAS_BY_MEM | \
DOMAIN_ACCESS_LOOKUP_INFO_2 )
#define DOMAIN_WRITE ( STANDARD_RIGHTS_WRITE_ACCESS | \
DOMAIN_ACCESS_SET_INFO_3 | \
DOMAIN_ACCESS_CREATE_ALIAS | \
DOMAIN_ACCESS_CREATE_GROUP | \
DOMAIN_ACCESS_CREATE_USER | \
DOMAIN_ACCESS_SET_INFO_2 | \
DOMAIN_ACCESS_SET_INFO_1 )
#define DOMAIN_EXECUTE ( STANDARD_RIGHTS_EXECUTE_ACCESS | \
DOMAIN_ACCESS_OPEN_ACCOUNT | \
DOMAIN_ACCESS_ENUM_ACCOUNTS | \
DOMAIN_ACCESS_LOOKUP_INFO_1 )
/* Access bits to User-objects */
#define USER_ACCESS_GET_NAME_ETC 0x00000001
#define USER_ACCESS_GET_LOCALE 0x00000002
#define USER_ACCESS_SET_LOC_COM 0x00000004
#define USER_ACCESS_GET_LOGONINFO 0x00000008
#define USER_ACCESS_UNKNOWN_10 0x00000010
#define USER_ACCESS_SET_ATTRIBUTES 0x00000020
#define USER_ACCESS_CHANGE_PASSWORD 0x00000040
#define USER_ACCESS_SET_PASSWORD 0x00000080
#define USER_ACCESS_GET_GROUPS 0x00000100
#define USER_ACCESS_UNKNOWN_200 0x00000200
#define USER_ACCESS_UNKNOWN_400 0x00000400
#define USER_ALL_ACCESS ( STANDARD_RIGHTS_REQUIRED_ACCESS | \
USER_ACCESS_UNKNOWN_400 | \
USER_ACCESS_UNKNOWN_200 | \
USER_ACCESS_GET_GROUPS | \
USER_ACCESS_SET_PASSWORD | \
USER_ACCESS_CHANGE_PASSWORD | \
USER_ACCESS_SET_ATTRIBUTES | \
USER_ACCESS_UNKNOWN_10 | \
USER_ACCESS_GET_LOGONINFO | \
USER_ACCESS_SET_LOC_COM | \
USER_ACCESS_GET_LOCALE | \
USER_ACCESS_GET_NAME_ETC )
#define USER_READ ( STANDARD_RIGHTS_READ_ACCESS | \
USER_ACCESS_UNKNOWN_200 | \
USER_ACCESS_GET_GROUPS | \
USER_ACCESS_UNKNOWN_10 | \
USER_ACCESS_GET_LOGONINFO | \
USER_ACCESS_GET_LOCALE )
#define USER_WRITE ( STANDARD_RIGHTS_WRITE_ACCESS | \
USER_ACCESS_CHANGE_PASSWORD | \
USER_ACCESS_SET_LOC_COM )
#define USER_EXECUTE ( STANDARD_RIGHTS_EXECUTE_ACCESS | \
USER_ACCESS_CHANGE_PASSWORD | \
USER_ACCESS_GET_NAME_ETC )
/* Access bits to Group-objects */
#define GROUP_ACCESS_LOOKUP_INFO 0x00000001
#define GROUP_ACCESS_SET_INFO 0x00000002
#define GROUP_ACCESS_ADD_MEMBER 0x00000004
#define GROUP_ACCESS_REMOVE_MEMBER 0x00000008
#define GROUP_ACCESS_GET_MEMBERS 0x00000010
#define GROUP_ALL_ACCESS ( STANDARD_RIGHTS_REQUIRED_ACCESS | \
GROUP_ACCESS_GET_MEMBERS | \
GROUP_ACCESS_REMOVE_MEMBER | \
GROUP_ACCESS_ADD_MEMBER | \
GROUP_ACCESS_SET_INFO | \
GROUP_ACCESS_LOOKUP_INFO )
#define GROUP_READ ( STANDARD_RIGHTS_READ_ACCESS | \
GROUP_ACCESS_GET_MEMBERS )
#define GROUP_WRITE ( STANDARD_RIGHTS_WRITE_ACCESS | \
GROUP_ACCESS_REMOVE_MEMBER | \
GROUP_ACCESS_ADD_MEMBER | \
GROUP_ACCESS_SET_INFO )
#define GROUP_EXECUTE ( STANDARD_RIGHTS_EXECUTE_ACCESS | \
GROUP_ACCESS_LOOKUP_INFO )
/* Access bits to Alias-objects */
#define ALIAS_ACCESS_ADD_MEMBER 0x00000001
#define ALIAS_ACCESS_REMOVE_MEMBER 0x00000002
#define ALIAS_ACCESS_GET_MEMBERS 0x00000004
#define ALIAS_ACCESS_LOOKUP_INFO 0x00000008
#define ALIAS_ACCESS_SET_INFO 0x00000010
#define ALIAS_ALL_ACCESS ( STANDARD_RIGHTS_REQUIRED_ACCESS | \
ALIAS_ACCESS_GET_MEMBERS | \
ALIAS_ACCESS_REMOVE_MEMBER | \
ALIAS_ACCESS_ADD_MEMBER | \
ALIAS_ACCESS_SET_INFO | \
ALIAS_ACCESS_LOOKUP_INFO )
#define ALIAS_READ ( STANDARD_RIGHTS_READ_ACCESS | \
ALIAS_ACCESS_GET_MEMBERS )
#define ALIAS_WRITE ( STANDARD_RIGHTS_WRITE_ACCESS | \
ALIAS_ACCESS_REMOVE_MEMBER | \
ALIAS_ACCESS_ADD_MEMBER | \
ALIAS_ACCESS_SET_INFO )
#define ALIAS_EXECUTE ( STANDARD_RIGHTS_EXECUTE_ACCESS | \
ALIAS_ACCESS_LOOKUP_INFO )
typedef struct _DISP_USER_INFO {
SAM_ACCOUNT *sam;

247
source/include/rpc_secdes.h
View File

@@ -31,6 +31,7 @@
#define SEC_RIGHTS_READ 0x00020019
#define SEC_RIGHTS_FULL_CONTROL 0x000f003f
#define SEC_RIGHTS_MAXIMUM_ALLOWED 0x02000000
/* for ADS */
#define SEC_RIGHTS_LIST_CONTENTS 0x4
#define SEC_RIGHTS_LIST_OBJECT 0x80
@@ -211,4 +212,250 @@ typedef struct standard_mapping {
uint32 std_all;
} STANDARD_MAPPING;
/* Security Access Masks Rights */
#define SPECIFIC_RIGHTS_MASK 0x0000FFFF
#define STANDARD_RIGHTS_MASK 0x00FF0000
#define GENERIC_RIGHTS_MASK 0xF0000000
#define SEC_RIGHT_SYSTEM_SECURITY 0x01000000
#define SEC_RIGHT_MAXIMUM_ALLOWED 0x02000000
/* Generic access rights */
#define GENERIC_RIGHT_ALL_ACCESS 0x10000000
#define GENERIC_RIGHT_EXECUTE_ACCESS 0x20000000
#define GENERIC_RIGHT_WRITE_ACCESS 0x40000000
#define GENERIC_RIGHT_READ_ACCESS 0x80000000
/* Standard access rights. */
#define STD_RIGHT_DELETE_ACCESS 0x00010000
#define STD_RIGHT_READ_CONTROL_ACCESS 0x00020000
#define STD_RIGHT_WRITE_DAC_ACCESS 0x00040000
#define STD_RIGHT_WRITE_OWNER_ACCESS 0x00080000
#define STD_RIGHT_SYNCHRONIZE_ACCESS 0x00100000
#define STD_RIGHT_ALL_ACCESS 0x001F0000
/* Combinations of standard masks. */
#define STANDARD_RIGHTS_ALL_ACCESS STD_RIGHT_ALL_ACCESS /* 0x001f0000 */
#define STANDARD_RIGHTS_EXECUTE_ACCESS STD_RIGHT_READ_CONTROL_ACCESS /* 0x00020000 */
#define STANDARD_RIGHTS_READ_ACCESS STD_RIGHT_READ_CONTROL_ACCESS /* 0x00020000 */
#define STANDARD_RIGHTS_WRITE_ACCESS STD_RIGHT_READ_CONTROL_ACCESS /* 0x00020000 */
#define STANDARD_RIGHTS_REQUIRED_ACCESS \
(STD_RIGHT_DELETE_ACCESS | \
STD_RIGHT_READ_CONTROL_ACCESS | \
STD_RIGHT_WRITE_DAC_ACCESS | \
STD_RIGHT_WRITE_OWNER_ACCESS) /* 0x000f0000 */
/* File Object specific access rights */
#define SA_RIGHT_FILE_READ_DATA 0x00000001
#define SA_RIGHT_FILE_WRITE_DATA 0x00000002
#define SA_RIGHT_FILE_APPEND_DATA 0x00000004
#define SA_RIGHT_FILE_READ_EA 0x00000008
#define SA_RIGHT_FILE_WRITE_EA 0x00000010
#define SA_RIGHT_FILE_EXECUTE 0x00000020
#define SA_RIGHT_FILE_DELETE_CHILD 0x00000040
#define SA_RIGHT_FILE_READ_ATTRIBUTES 0x00000080
#define SA_RIGHT_FILE_WRITE_ATTRIBUTES 0x00000100
#define SA_RIGHT_FILE_ALL_ACCESS 0x000001FF
#define GENERIC_RIGHTS_FILE_ALL_ACCESS \
(STANDARD_RIGHTS_REQUIRED_ACCESS| \
STD_RIGHT_SYNCHRONIZE_ACCESS | \
SA_RIGHT_FILE_ALL_ACCESS)
#define GENERIC_RIGHTS_FILE_READ \
(STANDARD_RIGHTS_READ_ACCESS | \
STD_RIGHT_SYNCHRONIZE_ACCESS | \
SA_RIGHT_FILE_READ_DATA | \
SA_RIGHT_FILE_READ_ATTRIBUTES | \
SA_RIGHT_FILE_READ_EA)
#define GENERIC_RIGHTS_FILE_WRITE \
(STANDARD_RIGHTS_WRITE_ACCESS | \
STD_RIGHT_SYNCHRONIZE_ACCESS | \
SA_RIGHT_FILE_WRITE_DATA | \
SA_RIGHT_FILE_WRITE_ATTRIBUTES | \
SA_RIGHT_FILE_WRITE_EA | \
SA_RIGHT_FILE_APPEND_DATA)
#define GENERIC_RIGHTS_FILE_EXECUTE \
(STANDARD_RIGHTS_EXECUTE_ACCESS | \
SA_RIGHT_FILE_READ_ATTRIBUTES | \
SA_RIGHT_FILE_EXECUTE)
/* SAM Object specific access rights */
#define SA_RIGHT_SAM_UNKNOWN_1 0x00000001
#define SA_RIGHT_SAM_SHUTDOWN_SERVER 0x00000002
#define SA_RIGHT_SAM_UNKNOWN_4 0x00000004
#define SA_RIGHT_SAM_UNKNOWN_8 0x00000008
#define SA_RIGHT_SAM_ENUM_DOMAINS 0x00000010
#define SA_RIGHT_SAM_OPEN_DOMAIN 0x00000020
#define SA_RIGHT_SAM_ALL_ACCESS 0x0000003F
#define GENERIC_RIGHTS_SAM_ALL_ACCESS \
(STANDARD_RIGHTS_REQUIRED_ACCESS| \
SA_RIGHT_SAM_ALL_ACCESS)
#define GENERIC_RIGHTS_SAM_READ \
(STANDARD_RIGHTS_READ_ACCESS | \
SA_RIGHT_SAM_ENUM_DOMAINS)
#define GENERIC_RIGHTS_SAM_WRITE \
(STANDARD_RIGHTS_WRITE_ACCESS | \
SA_RIGHT_SAM_UNKNOWN_8 | \
SA_RIGHT_SAM_UNKNOWN_4 | \
SA_RIGHT_SAM_SHUTDOWN_SERVER)
#define GENERIC_RIGHTS_SAM_EXECUTE \
(STANDARD_RIGHTS_EXECUTE_ACCESS | \
SA_RIGHT_SAM_OPEN_DOMAIN | \
SA_RIGHT_SAM_UNKNOWN_1)
/* Domain Object specific access rights */
#define SA_RIGHT_DOMAIN_LOOKUP_INFO_1 0x00000001
#define SA_RIGHT_DOMAIN_SET_INFO_1 0x00000002
#define SA_RIGHT_DOMAIN_LOOKUP_INFO_2 0x00000004
#define SA_RIGHT_DOMAIN_SET_INFO_2 0x00000008
#define SA_RIGHT_DOMAIN_CREATE_USER 0x00000010
#define SA_RIGHT_DOMAIN_CREATE_GROUP 0x00000020
#define SA_RIGHT_DOMAIN_CREATE_ALIAS 0x00000040
#define SA_RIGHT_DOMAIN_LOOKUP_ALIAS_BY_MEM 0x00000080
#define SA_RIGHT_DOMAIN_ENUM_ACCOUNTS 0x00000100
#define SA_RIGHT_DOMAIN_OPEN_ACCOUNT 0x00000200
#define SA_RIGHT_DOMAIN_SET_INFO_3 0x00000400
#define SA_RIGHT_DOMAIN_ALL_ACCESS 0x000007FF
#define GENERIC_RIGHTS_DOMAIN_ALL_ACCESS \
(STANDARD_RIGHTS_REQUIRED_ACCESS| \
SA_RIGHT_DOMAIN_ALL_ACCESS)
#define GENERIC_RIGHTS_DOMAIN_READ \
(STANDARD_RIGHTS_READ_ACCESS | \
SA_RIGHT_DOMAIN_LOOKUP_ALIAS_BY_MEM | \
SA_RIGHT_DOMAIN_LOOKUP_INFO_2)
#define GENERIC_RIGHTS_DOMAIN_WRITE \
(STANDARD_RIGHTS_WRITE_ACCESS | \
SA_RIGHT_DOMAIN_SET_INFO_3 | \
SA_RIGHT_DOMAIN_CREATE_ALIAS | \
SA_RIGHT_DOMAIN_CREATE_GROUP | \
SA_RIGHT_DOMAIN_CREATE_USER | \
SA_RIGHT_DOMAIN_SET_INFO_2 | \
SA_RIGHT_DOMAIN_SET_INFO_1)
#define GENERIC_RIGHTS_DOMAIN_EXECUTE \
(STANDARD_RIGHTS_EXECUTE_ACCESS | \
SA_RIGHT_DOMAIN_OPEN_ACCOUNT | \
SA_RIGHT_DOMAIN_ENUM_ACCOUNTS | \
SA_RIGHT_DOMAIN_LOOKUP_INFO_1)
/* User Object specific access rights */
#define SA_RIGHT_USER_GET_NAME_ETC 0x00000001
#define SA_RIGHT_USER_GET_LOCALE 0x00000002
#define SA_RIGHT_USER_SET_LOC_COM 0x00000004
#define SA_RIGHT_USER_GET_LOGONINFO 0x00000008
#define SA_RIGHT_USER_ACCT_FLAGS_EXPIRY 0x00000010
#define SA_RIGHT_USER_SET_ATTRIBUTES 0x00000020
#define SA_RIGHT_USER_CHANGE_PASSWORD 0x00000040
#define SA_RIGHT_USER_SET_PASSWORD 0x00000080
#define SA_RIGHT_USER_GET_GROUPS 0x00000100
#define SA_RIGHT_USER_UNKNOWN_200 0x00000200
#define SA_RIGHT_USER_UNKNOWN_400 0x00000400
#define SA_RIGHT_USER_ALL_ACCESS 0x000007FF
#define GENERIC_RIGHTS_USER_ALL_ACCESS \
(STANDARD_RIGHTS_REQUIRED_ACCESS| \
SA_RIGHT_USER_ALL_ACCESS) /* 0x000f07ff */
#define GENERIC_RIGHTS_USER_READ \
(STANDARD_RIGHTS_READ_ACCESS | \
SA_RIGHT_USER_UNKNOWN_200 | \
SA_RIGHT_USER_GET_GROUPS | \
SA_RIGHT_USER_ACCT_FLAGS_EXPIRY | \
SA_RIGHT_USER_GET_LOGONINFO | \
SA_RIGHT_USER_GET_LOCALE) /* 0x0002031a */
#define GENERIC_RIGHTS_USER_WRITE \
(STANDARD_RIGHTS_WRITE_ACCESS | \
SA_RIGHT_USER_CHANGE_PASSWORD | \
SA_RIGHT_USER_SET_LOC_COM) /* 0x00020044 */
#define GENERIC_RIGHTS_USER_EXECUTE \
(STANDARD_RIGHTS_EXECUTE_ACCESS | \
SA_RIGHT_USER_CHANGE_PASSWORD | \
SA_RIGHT_USER_GET_NAME_ETC ) /* 0x00020041 */
/* Group Object specific access rights */
#define SA_RIGHT_GROUP_LOOKUP_INFO 0x00000001
#define SA_RIGHT_GROUP_SET_INFO 0x00000002
#define SA_RIGHT_GROUP_ADD_MEMBER 0x00000004
#define SA_RIGHT_GROUP_REMOVE_MEMBER 0x00000008
#define SA_RIGHT_GROUP_GET_MEMBERS 0x00000010
#define SA_RIGHT_GROUP_ALL_ACCESS 0x0000001F
#define GENERIC_RIGHTS_GROUP_ALL_ACCESS \
(STANDARD_RIGHTS_REQUIRED_ACCESS| \
SA_RIGHT_GROUP_ALL_ACCESS) /* 0x000f001f */
#define GENERIC_RIGHTS_GROUP_READ \
(STANDARD_RIGHTS_READ_ACCESS | \
SA_RIGHT_GROUP_GET_MEMBERS) /* 0x00020010 */
#define GENERIC_RIGHTS_GROUP_WRITE \
(STANDARD_RIGHTS_WRITE_ACCESS | \
SA_RIGHT_GROUP_REMOVE_MEMBER | \
SA_RIGHT_GROUP_ADD_MEMBER | \
SA_RIGHT_GROUP_SET_INFO ) /* 0x0002000e */
#define GENERIC_RIGHTS_GROUP_EXECUTE \
(STANDARD_RIGHTS_EXECUTE_ACCESS | \
SA_RIGHT_GROUP_LOOKUP_INFO) /* 0x00020001 */
/* Alias Object specific access rights */
#define SA_RIGHT_ALIAS_ADD_MEMBER 0x00000001
#define SA_RIGHT_ALIAS_REMOVE_MEMBER 0x00000002
#define SA_RIGHT_ALIAS_GET_MEMBERS 0x00000004
#define SA_RIGHT_ALIAS_LOOKUP_INFO 0x00000008
#define SA_RIGHT_ALIAS_SET_INFO 0x00000010
#define SA_RIGHT_ALIAS_ALL_ACCESS 0x0000001F
#define GENERIC_RIGHTS_ALIAS_ALL_ACCESS \
(STANDARD_RIGHTS_REQUIRED_ACCESS| \
SA_RIGHT_ALIAS_ALL_ACCESS) /* 0x000f001f */
#define GENERIC_RIGHTS_ALIAS_READ \
(STANDARD_RIGHTS_READ_ACCESS | \
SA_RIGHT_ALIAS_GET_MEMBERS ) /* 0x00020004 */
#define GENERIC_RIGHTS_ALIAS_WRITE \
(STANDARD_RIGHTS_WRITE_ACCESS | \
SA_RIGHT_ALIAS_REMOVE_MEMBER | \
SA_RIGHT_ALIAS_ADD_MEMBER | \
SA_RIGHT_ALIAS_SET_INFO ) /* 0x00020013 */
#define GENERIC_RIGHTS_ALIAS_EXECUTE \
(STANDARD_RIGHTS_EXECUTE_ACCESS | \
SA_RIGHT_ALIAS_LOOKUP_INFO ) /* 0x00020008 */
#endif /* _RPC_SECDES_H */

13
source/include/smb.h
View File

@@ -1099,23 +1099,14 @@ struct bitmap {
#define DESIRED_ACCESS_PIPE 0x2019f
/* Generic access masks & rights. */
#define SPECIFIC_RIGHTS_MASK 0x00FFFFL
#define STANDARD_RIGHTS_MASK 0xFF0000L
#define DELETE_ACCESS (1L<<16) /* 0x00010000 */
#define READ_CONTROL_ACCESS (1L<<17) /* 0x00020000 */
#define WRITE_DAC_ACCESS (1L<<18) /* 0x00040000 */
#define WRITE_OWNER_ACCESS (1L<<19) /* 0x00080000 */
#define SYNCHRONIZE_ACCESS (1L<<20) /* 0x00100000 */
/* Combinations of standard masks. */
#define STANDARD_RIGHTS_ALL_ACCESS (DELETE_ACCESS|READ_CONTROL_ACCESS|WRITE_DAC_ACCESS|WRITE_OWNER_ACCESS|SYNCHRONIZE_ACCESS) /* 0x001f0000 */
#define STANDARD_RIGHTS_EXECUTE_ACCESS (READ_CONTROL_ACCESS) /* 0x00020000 */
#define STANDARD_RIGHTS_READ_ACCESS (READ_CONTROL_ACCESS) /* 0x00200000 */
#define STANDARD_RIGHTS_REQUIRED_ACCESS (DELETE_ACCESS|READ_CONTROL_ACCESS|WRITE_DAC_ACCESS|WRITE_OWNER_ACCESS) /* 0x000f0000 */
#define STANDARD_RIGHTS_WRITE_ACCESS (READ_CONTROL_ACCESS) /* 0x00020000 */
#define SYSTEM_SECURITY_ACCESS (1L<<24) /* 0x01000000 */
#define MAXIMUM_ALLOWED_ACCESS (1L<<25) /* 0x02000000 */
#define SYSTEM_SECURITY_ACCESS (1L<<24) /* 0x01000000 */
#define MAXIMUM_ALLOWED_ACCESS (1L<<25) /* 0x02000000 */
#define GENERIC_ALL_ACCESS (1<<28) /* 0x10000000 */
#define GENERIC_EXECUTE_ACCESS (1<<29) /* 0x20000000 */
#define GENERIC_WRITE_ACCESS (1<<30) /* 0x40000000 */

4
source/lib/util_seaccess.c
View File

@@ -468,11 +468,11 @@ NTSTATUS samr_make_sam_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size)
sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
/*basic access for every one*/
init_sec_access(&mask, SAMR_EXECUTE | SAMR_READ);
init_sec_access(&mask, GENERIC_RIGHTS_SAM_EXECUTE | GENERIC_RIGHTS_SAM_READ);
init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
/*full access for builtin aliases Administrators and Account Operators*/
init_sec_access(&mask, SAMR_ALL_ACCESS);
init_sec_access(&mask, GENERIC_RIGHTS_SAM_ALL_ACCESS);
init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);

88
source/rpc_server/srv_samr_nt.c
View File

@@ -64,11 +64,11 @@ struct samr_info {
TALLOC_CTX *mem_ctx;
};
struct generic_mapping sam_generic_mapping = {SAMR_READ, SAMR_WRITE, SAMR_EXECUTE, SAMR_ALL_ACCESS};
struct generic_mapping dom_generic_mapping = {DOMAIN_READ, DOMAIN_WRITE, DOMAIN_EXECUTE, DOMAIN_ALL_ACCESS};
struct generic_mapping usr_generic_mapping = {USER_READ, USER_WRITE, USER_EXECUTE, USER_ALL_ACCESS};
struct generic_mapping grp_generic_mapping = {GROUP_READ, GROUP_WRITE, GROUP_EXECUTE, GROUP_ALL_ACCESS};
struct generic_mapping ali_generic_mapping = {ALIAS_READ, ALIAS_WRITE, ALIAS_EXECUTE, ALIAS_ALL_ACCESS};
struct generic_mapping sam_generic_mapping = {GENERIC_RIGHTS_SAM_READ, GENERIC_RIGHTS_SAM_WRITE, GENERIC_RIGHTS_SAM_EXECUTE, GENERIC_RIGHTS_SAM_ALL_ACCESS};
struct generic_mapping dom_generic_mapping = {GENERIC_RIGHTS_DOMAIN_READ, GENERIC_RIGHTS_DOMAIN_WRITE, GENERIC_RIGHTS_DOMAIN_EXECUTE, GENERIC_RIGHTS_DOMAIN_ALL_ACCESS};
struct generic_mapping usr_generic_mapping = {GENERIC_RIGHTS_USER_READ, GENERIC_RIGHTS_USER_WRITE, GENERIC_RIGHTS_USER_EXECUTE, GENERIC_RIGHTS_USER_ALL_ACCESS};
struct generic_mapping grp_generic_mapping = {GENERIC_RIGHTS_GROUP_READ, GENERIC_RIGHTS_GROUP_WRITE, GENERIC_RIGHTS_GROUP_EXECUTE, GENERIC_RIGHTS_GROUP_ALL_ACCESS};
struct generic_mapping ali_generic_mapping = {GENERIC_RIGHTS_ALIAS_READ, GENERIC_RIGHTS_ALIAS_WRITE, GENERIC_RIGHTS_ALIAS_EXECUTE, GENERIC_RIGHTS_ALIAS_ALL_ACCESS};
static NTSTATUS samr_make_dom_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size);
@@ -375,7 +375,7 @@ NTSTATUS _samr_open_domain(pipes_struct *p, SAMR_Q_OPEN_DOMAIN *q_u, SAMR_R_OPEN
if (!find_policy_by_hnd(p, &q_u->pol, (void**)&info))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(status = access_check_samr_function(info->acc_granted, SAMR_ACCESS_OPEN_DOMAIN,"_samr_open_domain"))) {
if (!NT_STATUS_IS_OK(status = access_check_samr_function(info->acc_granted, SA_RIGHT_SAM_OPEN_DOMAIN,"_samr_open_domain"))) {
return status;
}
@@ -454,11 +454,11 @@ static NTSTATUS samr_make_dom_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd
sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
/*basic access for every one*/
init_sec_access(&mask, DOMAIN_EXECUTE | DOMAIN_READ);
init_sec_access(&mask, GENERIC_RIGHTS_DOMAIN_EXECUTE | GENERIC_RIGHTS_DOMAIN_READ);
init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
/*full access for builtin aliases Administrators and Account Operators*/
init_sec_access(&mask, DOMAIN_ALL_ACCESS);
init_sec_access(&mask, GENERIC_RIGHTS_DOMAIN_ALL_ACCESS);
init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
@@ -493,16 +493,16 @@ static NTSTATUS samr_make_usr_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd
sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
/*basic access for every one*/
init_sec_access(&mask, USER_EXECUTE | USER_READ);
init_sec_access(&mask, GENERIC_RIGHTS_USER_EXECUTE | GENERIC_RIGHTS_USER_READ);
init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
/*full access for builtin aliases Administrators and Account Operators*/
init_sec_access(&mask, USER_ALL_ACCESS);
init_sec_access(&mask, GENERIC_RIGHTS_USER_ALL_ACCESS);
init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
/*extended access for the user*/
init_sec_access(&mask,READ_CONTROL_ACCESS | USER_ACCESS_CHANGE_PASSWORD | USER_ACCESS_SET_LOC_COM);
init_sec_access(&mask,READ_CONTROL_ACCESS | SA_RIGHT_USER_CHANGE_PASSWORD | SA_RIGHT_USER_SET_LOC_COM);
init_sec_ace(&ace[3], usr_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 4, ace)) == NULL)
@@ -536,11 +536,11 @@ static NTSTATUS samr_make_grp_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd
sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
/*basic access for every one*/
init_sec_access(&mask, GROUP_EXECUTE | GROUP_READ);
init_sec_access(&mask, GENERIC_RIGHTS_GROUP_EXECUTE | GENERIC_RIGHTS_GROUP_READ);
init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
/*full access for builtin aliases Administrators and Account Operators*/
init_sec_access(&mask, GROUP_ALL_ACCESS);
init_sec_access(&mask, GENERIC_RIGHTS_GROUP_ALL_ACCESS);
init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
@@ -575,11 +575,11 @@ static NTSTATUS samr_make_ali_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd
sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
/*basic access for every one*/
init_sec_access(&mask, ALIAS_EXECUTE | ALIAS_READ);
init_sec_access(&mask, GENERIC_RIGHTS_ALIAS_EXECUTE | GENERIC_RIGHTS_ALIAS_READ);
init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
/*full access for builtin aliases Administrators and Account Operators*/
init_sec_access(&mask, ALIAS_ALL_ACCESS);
init_sec_access(&mask, GENERIC_RIGHTS_ALIAS_ALL_ACCESS);
init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
@@ -765,7 +765,7 @@ NTSTATUS _samr_enum_dom_users(pipes_struct *p, SAMR_Q_ENUM_DOM_USERS *q_u,
domain_sid = info->sid;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted,
DOMAIN_ACCESS_ENUM_ACCOUNTS,
SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
"_samr_enum_dom_users"))) {
return r_u->status;
}
@@ -1058,7 +1058,7 @@ NTSTATUS _samr_enum_dom_groups(pipes_struct *p, SAMR_Q_ENUM_DOM_GROUPS *q_u, SAM
if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, DOMAIN_ACCESS_ENUM_ACCOUNTS, "_samr_enum_dom_groups"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_ENUM_ACCOUNTS, "_samr_enum_dom_groups"))) {
return r_u->status;
}
@@ -1097,7 +1097,7 @@ NTSTATUS _samr_enum_dom_aliases(pipes_struct *p, SAMR_Q_ENUM_DOM_ALIASES *q_u, S
if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, DOMAIN_ACCESS_ENUM_ACCOUNTS, "_samr_enum_dom_aliases"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_ENUM_ACCOUNTS, "_samr_enum_dom_aliases"))) {
return r_u->status;
}
@@ -1320,7 +1320,7 @@ NTSTATUS _samr_query_aliasinfo(pipes_struct *p, SAMR_Q_QUERY_ALIASINFO *q_u, SAM
/* find the policy handle. open a policy on it. */
if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, ALIAS_ACCESS_LOOKUP_INFO, "_samr_query_aliasinfo"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_LOOKUP_INFO, "_samr_query_aliasinfo"))) {
return r_u->status;
}
@@ -1667,7 +1667,7 @@ NTSTATUS _api_samr_open_user(pipes_struct *p, SAMR_Q_OPEN_USER *q_u, SAMR_R_OPEN
if (!get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(nt_status = access_check_samr_function(acc_granted, DOMAIN_ACCESS_OPEN_ACCOUNT, "_samr_open_user"))) {
if (!NT_STATUS_IS_OK(nt_status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_open_user"))) {
return nt_status;
}
@@ -2008,7 +2008,7 @@ NTSTATUS _samr_query_usergroups(pipes_struct *p, SAMR_Q_QUERY_USERGROUPS *q_u, S
if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, USER_ACCESS_GET_GROUPS, "_samr_query_usergroups"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_USER_GET_GROUPS, "_samr_query_usergroups"))) {
return r_u->status;
}
@@ -2194,7 +2194,7 @@ NTSTATUS _api_samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_
if (!get_lsa_policy_samr_sid(p, &dom_pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(nt_status = access_check_samr_function(acc_granted, DOMAIN_ACCESS_CREATE_USER, "_samr_create_user"))) {
if (!NT_STATUS_IS_OK(nt_status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_CREATE_USER, "_samr_create_user"))) {
return nt_status;
}
@@ -2496,7 +2496,7 @@ NTSTATUS _samr_lookup_domain(pipes_struct *p, SAMR_Q_LOOKUP_DOMAIN *q_u, SAMR_R_
if (!find_policy_by_hnd(p, &q_u->connect_pol, (void**)&info))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted, SAMR_ACCESS_OPEN_DOMAIN, "_samr_lookup_domain"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted, SA_RIGHT_SAM_OPEN_DOMAIN, "_samr_lookup_domain"))) {
return r_u->status;
}
@@ -2569,7 +2569,7 @@ NTSTATUS _samr_enum_domains(pipes_struct *p, SAMR_Q_ENUM_DOMAINS *q_u, SAMR_R_EN
if (!find_policy_by_hnd(p, &q_u->pol, (void**)&info))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted, SAMR_ACCESS_ENUM_DOMAINS, "_samr_enum_domains"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted, SA_RIGHT_SAM_ENUM_DOMAINS, "_samr_enum_domains"))) {
return r_u->status;
}
@@ -2617,7 +2617,7 @@ NTSTATUS _api_samr_open_alias(pipes_struct *p, SAMR_Q_OPEN_ALIAS *q_u, SAMR_R_OP
if (!get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(status = access_check_samr_function(acc_granted, DOMAIN_ACCESS_OPEN_ACCOUNT, "_samr_open_alias"))) {
if (!NT_STATUS_IS_OK(status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_open_alias"))) {
return status;
}
@@ -2929,7 +2929,7 @@ NTSTATUS _samr_set_userinfo(pipes_struct *p, SAMR_Q_SET_USERINFO *q_u, SAMR_R_SE
if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
acc_required = USER_ACCESS_SET_LOC_COM | USER_ACCESS_SET_ATTRIBUTES; /* This is probably wrong */
acc_required = SA_RIGHT_USER_SET_LOC_COM | SA_RIGHT_USER_SET_ATTRIBUTES; /* This is probably wrong */
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, acc_required, "_samr_set_userinfo"))) {
return r_u->status;
}
@@ -3014,7 +3014,7 @@ NTSTATUS _samr_set_userinfo2(pipes_struct *p, SAMR_Q_SET_USERINFO2 *q_u, SAMR_R_
if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
acc_required = USER_ACCESS_SET_LOC_COM | USER_ACCESS_SET_ATTRIBUTES; /* This is probably wrong */
acc_required = SA_RIGHT_USER_SET_LOC_COM | SA_RIGHT_USER_SET_ATTRIBUTES; /* This is probably wrong */
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, acc_required, "_samr_set_userinfo2"))) {
return r_u->status;
}
@@ -3089,8 +3089,8 @@ NTSTATUS _samr_query_useraliases(pipes_struct *p, SAMR_Q_QUERY_USERALIASES *q_u,
if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
return NT_STATUS_INVALID_HANDLE;
ntstatus1 = access_check_samr_function(info->acc_granted, DOMAIN_ACCESS_LOOKUP_ALIAS_BY_MEM, "_samr_query_useraliases");
ntstatus2 = access_check_samr_function(info->acc_granted, DOMAIN_ACCESS_OPEN_ACCOUNT, "_samr_query_useraliases");
ntstatus1 = access_check_samr_function(info->acc_granted, SA_RIGHT_DOMAIN_LOOKUP_ALIAS_BY_MEM, "_samr_query_useraliases");
ntstatus2 = access_check_samr_function(info->acc_granted, SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_query_useraliases");
if (!NT_STATUS_IS_OK(ntstatus1) || !NT_STATUS_IS_OK(ntstatus2)) {
if (!(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus2)) &&
@@ -3169,7 +3169,7 @@ NTSTATUS _samr_query_aliasmem(pipes_struct *p, SAMR_Q_QUERY_ALIASMEM *q_u, SAMR_
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status =
access_check_samr_function(acc_granted, ALIAS_ACCESS_GET_MEMBERS, "_samr_query_aliasmem"))) {
access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_GET_MEMBERS, "_samr_query_aliasmem"))) {
return r_u->status;
}
@@ -3270,7 +3270,7 @@ NTSTATUS _samr_query_groupmem(pipes_struct *p, SAMR_Q_QUERY_GROUPMEM *q_u, SAMR_
if (!get_lsa_policy_samr_sid(p, &q_u->group_pol, &group_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, GROUP_ACCESS_GET_MEMBERS, "_samr_query_groupmem"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_GET_MEMBERS, "_samr_query_groupmem"))) {
return r_u->status;
}
@@ -3362,7 +3362,7 @@ NTSTATUS _samr_add_aliasmem(pipes_struct *p, SAMR_Q_ADD_ALIASMEM *q_u, SAMR_R_AD
if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, ALIAS_ACCESS_ADD_MEMBER, "_samr_add_aliasmem"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_ADD_MEMBER, "_samr_add_aliasmem"))) {
return r_u->status;
}
@@ -3455,7 +3455,7 @@ NTSTATUS _samr_del_aliasmem(pipes_struct *p, SAMR_Q_DEL_ALIASMEM *q_u, SAMR_R_DE
if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, ALIAS_ACCESS_REMOVE_MEMBER, "_samr_del_aliasmem"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_REMOVE_MEMBER, "_samr_del_aliasmem"))) {
return r_u->status;
}
@@ -3526,7 +3526,7 @@ NTSTATUS _samr_add_groupmem(pipes_struct *p, SAMR_Q_ADD_GROUPMEM *q_u, SAMR_R_AD
if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, GROUP_ACCESS_ADD_MEMBER, "_samr_add_groupmem"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_ADD_MEMBER, "_samr_add_groupmem"))) {
return r_u->status;
}
@@ -3623,7 +3623,7 @@ NTSTATUS _samr_del_groupmem(pipes_struct *p, SAMR_Q_DEL_GROUPMEM *q_u, SAMR_R_DE
if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, GROUP_ACCESS_REMOVE_MEMBER, "_samr_del_groupmem"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_REMOVE_MEMBER, "_samr_del_groupmem"))) {
return r_u->status;
}
@@ -3703,7 +3703,7 @@ NTSTATUS _samr_delete_dom_user(pipes_struct *p, SAMR_Q_DELETE_DOM_USER *q_u, SAM
if (!get_lsa_policy_samr_sid(p, &q_u->user_pol, &user_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, DELETE_ACCESS, "_samr_delete_dom_user"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS, "_samr_delete_dom_user"))) {
return r_u->status;
}
@@ -3762,7 +3762,7 @@ NTSTATUS _samr_delete_dom_group(pipes_struct *p, SAMR_Q_DELETE_DOM_GROUP *q_u, S
if (!get_lsa_policy_samr_sid(p, &q_u->group_pol, &group_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, DELETE_ACCESS, "_samr_delete_dom_group"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS, "_samr_delete_dom_group"))) {
return r_u->status;
}
@@ -3824,7 +3824,7 @@ NTSTATUS _samr_delete_dom_alias(pipes_struct *p, SAMR_Q_DELETE_DOM_ALIAS *q_u, S
if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, DELETE_ACCESS, "_samr_delete_dom_alias"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS, "_samr_delete_dom_alias"))) {
return r_u->status;
}
@@ -3887,7 +3887,7 @@ NTSTATUS _samr_create_dom_group(pipes_struct *p, SAMR_Q_CREATE_DOM_GROUP *q_u, S
if (!get_lsa_policy_samr_sid(p, &q_u->pol, &dom_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, DOMAIN_ACCESS_CREATE_GROUP, "_samr_create_dom_group"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_CREATE_GROUP, "_samr_create_dom_group"))) {
return r_u->status;
}
@@ -3952,7 +3952,7 @@ NTSTATUS _samr_create_dom_alias(pipes_struct *p, SAMR_Q_CREATE_DOM_ALIAS *q_u, S
if (!get_lsa_policy_samr_sid(p, &q_u->dom_pol, &dom_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, DOMAIN_ACCESS_CREATE_ALIAS, "_samr_create_alias"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_CREATE_ALIAS, "_samr_create_alias"))) {
return r_u->status;
}
@@ -4014,7 +4014,7 @@ NTSTATUS _samr_query_groupinfo(pipes_struct *p, SAMR_Q_QUERY_GROUPINFO *q_u, SAM
if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, GROUP_ACCESS_LOOKUP_INFO, "_samr_query_groupinfo"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_LOOKUP_INFO, "_samr_query_groupinfo"))) {
return r_u->status;
}
@@ -4066,7 +4066,7 @@ NTSTATUS _samr_set_groupinfo(pipes_struct *p, SAMR_Q_SET_GROUPINFO *q_u, SAMR_R_
if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, GROUP_ACCESS_SET_INFO, "_samr_set_groupinfo"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_SET_INFO, "_samr_set_groupinfo"))) {
return r_u->status;
}
@@ -4113,7 +4113,7 @@ NTSTATUS _samr_set_aliasinfo(pipes_struct *p, SAMR_Q_SET_ALIASINFO *q_u, SAMR_R_
if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &group_sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, ALIAS_ACCESS_SET_INFO, "_samr_set_aliasinfo"))) {
if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_SET_INFO, "_samr_set_aliasinfo"))) {
return r_u->status;
}
@@ -4182,7 +4182,7 @@ NTSTATUS _samr_open_group(pipes_struct *p, SAMR_Q_OPEN_GROUP *q_u, SAMR_R_OPEN_G
if (!get_lsa_policy_samr_sid(p, &q_u->domain_pol, &sid, &acc_granted))
return NT_STATUS_INVALID_HANDLE;
if (!NT_STATUS_IS_OK(status = access_check_samr_function(acc_granted, DOMAIN_ACCESS_OPEN_ACCOUNT, "_samr_open_group"))) {
if (!NT_STATUS_IS_OK(status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_open_group"))) {
return status;
}

4
source/utils/net_rpc.c
View File

@@ -2014,7 +2014,7 @@ static int rpc_trustdom_list(int argc, const char **argv)
};
/* SamrConnect */
nt_status = cli_samr_connect(cli, mem_ctx, SAMR_ACCESS_OPEN_DOMAIN,
nt_status = cli_samr_connect(cli, mem_ctx, SA_RIGHT_SAM_OPEN_DOMAIN,
&connect_hnd);
if (!NT_STATUS_IS_OK(nt_status)) {
DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
@@ -2025,7 +2025,7 @@ static int rpc_trustdom_list(int argc, const char **argv)
/* SamrOpenDomain - we have to open domain policy handle in order to be
able to enumerate accounts*/
nt_status = cli_samr_open_domain(cli, mem_ctx, &connect_hnd,
DOMAIN_ACCESS_ENUM_ACCOUNTS,
SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
&queried_dom_sid, &domain_hnd);
if (!NT_STATUS_IS_OK(nt_status)) {
DEBUG(0, ("Couldn't open domain object. Error was %s\n",