sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-02 09:47:23 +03:00
Code

s3-samr: remove duplicate copies of Domain Object specific access rights.

Browse Source 
Guenther
This commit is contained in:
Günther Deschner 2008-10-23 19:39:14 +02:00
parent 04c2204e46
commit f126371f17
4 changed files with 24 additions and 59 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
source3/include/rpc_secdes.h
View File

@ -214,46 +214,6 @@ struct standard_mapping {
SA_RIGHT_FILE_WRITE_DATA | \
SA_RIGHT_FILE_READ_DATA)
/* Domain Object specific access rights */
#define SA_RIGHT_DOMAIN_LOOKUP_INFO_1 0x00000001
#define SA_RIGHT_DOMAIN_SET_INFO_1 0x00000002
#define SA_RIGHT_DOMAIN_LOOKUP_INFO_2 0x00000004
#define SA_RIGHT_DOMAIN_SET_INFO_2 0x00000008
#define SA_RIGHT_DOMAIN_CREATE_USER 0x00000010
#define SA_RIGHT_DOMAIN_CREATE_GROUP 0x00000020
#define SA_RIGHT_DOMAIN_CREATE_ALIAS 0x00000040
#define SA_RIGHT_DOMAIN_LOOKUP_ALIAS_BY_MEM 0x00000080
#define SA_RIGHT_DOMAIN_ENUM_ACCOUNTS 0x00000100
#define SA_RIGHT_DOMAIN_OPEN_ACCOUNT 0x00000200
#define SA_RIGHT_DOMAIN_SET_INFO_3 0x00000400
#define SA_RIGHT_DOMAIN_ALL_ACCESS 0x000007FF
#define GENERIC_RIGHTS_DOMAIN_ALL_ACCESS \
(STANDARD_RIGHTS_REQUIRED_ACCESS| \
SA_RIGHT_DOMAIN_ALL_ACCESS)
#define GENERIC_RIGHTS_DOMAIN_READ \
(STANDARD_RIGHTS_READ_ACCESS | \
SA_RIGHT_DOMAIN_LOOKUP_ALIAS_BY_MEM | \
SA_RIGHT_DOMAIN_LOOKUP_INFO_2)
#define GENERIC_RIGHTS_DOMAIN_WRITE \
(STANDARD_RIGHTS_WRITE_ACCESS | \
SA_RIGHT_DOMAIN_SET_INFO_3 | \
SA_RIGHT_DOMAIN_CREATE_ALIAS | \
SA_RIGHT_DOMAIN_CREATE_GROUP | \
SA_RIGHT_DOMAIN_CREATE_USER | \
SA_RIGHT_DOMAIN_SET_INFO_2 | \
SA_RIGHT_DOMAIN_SET_INFO_1)
#define GENERIC_RIGHTS_DOMAIN_EXECUTE \
(STANDARD_RIGHTS_EXECUTE_ACCESS | \
SA_RIGHT_DOMAIN_OPEN_ACCOUNT | \
SA_RIGHT_DOMAIN_ENUM_ACCOUNTS | \
SA_RIGHT_DOMAIN_LOOKUP_INFO_1)
/* Group Object specific access rights */
#define SA_RIGHT_GROUP_LOOKUP_INFO 0x00000001

5
source3/librpc/gen_ndr/samr.h
View File

@ -18,6 +18,11 @@
#define GENERIC_RIGHTS_USER_READ ( (STANDARD_RIGHTS_READ_ACCESS|SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP|SAMR_USER_ACCESS_GET_GROUPS|SAMR_USER_ACCESS_GET_ATTRIBUTES|SAMR_USER_ACCESS_GET_LOGONINFO|SAMR_USER_ACCESS_GET_LOCALE) )
#define GENERIC_RIGHTS_USER_WRITE ( (STANDARD_RIGHTS_WRITE_ACCESS|SAMR_USER_ACCESS_CHANGE_PASSWORD|SAMR_USER_ACCESS_SET_LOC_COM|SAMR_USER_ACCESS_SET_ATTRIBUTES|SAMR_USER_ACCESS_SET_PASSWORD|SAMR_USER_ACCESS_CHANGE_GROUP_MEMBERSHIP) )
#define GENERIC_RIGHTS_USER_EXECUTE ( (STANDARD_RIGHTS_EXECUTE_ACCESS|SAMR_USER_ACCESS_CHANGE_PASSWORD|SAMR_USER_ACCESS_GET_NAME_ETC) )
#define SAMR_DOMAIN_ACCESS_ALL_ACCESS ( 0x000007FF )
#define GENERIC_RIGHTS_DOMAIN_ALL_ACCESS ( (STANDARD_RIGHTS_REQUIRED_ACCESS|SAMR_DOMAIN_ACCESS_ALL_ACCESS) )
#define GENERIC_RIGHTS_DOMAIN_READ ( (STANDARD_RIGHTS_READ_ACCESS|SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS|SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2) )
#define GENERIC_RIGHTS_DOMAIN_WRITE ( (STANDARD_RIGHTS_WRITE_ACCESS|SAMR_DOMAIN_ACCESS_SET_INFO_3|SAMR_DOMAIN_ACCESS_CREATE_ALIAS|SAMR_DOMAIN_ACCESS_CREATE_GROUP|SAMR_DOMAIN_ACCESS_CREATE_USER|SAMR_DOMAIN_ACCESS_SET_INFO_2|SAMR_DOMAIN_ACCESS_SET_INFO_1) )
#define GENERIC_RIGHTS_DOMAIN_EXECUTE ( (STANDARD_RIGHTS_EXECUTE_ACCESS|SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT|SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS|SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1) )
#define MAX_SAM_ENTRIES_W2K ( 0x400 )
#define MAX_SAM_ENTRIES_W95 ( 50 )
#define SAMR_ENUM_USERS_MULTIPLIER ( 54 )

36
source3/rpc_server/srv_samr_nt.c
View File

@ -990,7 +990,7 @@ NTSTATUS _samr_EnumDomainUsers(pipes_struct *p,
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(info->acc_granted,
SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
"_samr_EnumDomainUsers");
if (!NT_STATUS_IS_OK(status)) {
return status;
@ -1129,7 +1129,7 @@ NTSTATUS _samr_EnumDomainGroups(pipes_struct *p,
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(info->acc_granted,
SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
"_samr_EnumDomainGroups");
if (!NT_STATUS_IS_OK(status)) {
return status;
@ -1209,7 +1209,7 @@ NTSTATUS _samr_EnumDomainAliases(pipes_struct *p,
sid_string_dbg(&info->sid)));
status = access_check_samr_function(info->acc_granted,
SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
"_samr_EnumDomainAliases");
if (!NT_STATUS_IS_OK(status)) {
return status;
@ -1482,7 +1482,7 @@ NTSTATUS _samr_QueryDisplayInfo(pipes_struct *p,
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(info->acc_granted,
SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
"_samr_QueryDisplayInfo");
if (!NT_STATUS_IS_OK(status)) {
return status;
@ -2062,8 +2062,8 @@ NTSTATUS _samr_LookupRids(pipes_struct *p,
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(acc_granted,
SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
"_samr__LookupRids");
SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
"_samr_LookupRids");
if (!NT_STATUS_IS_OK(status)) {
return status;
}
@ -2146,7 +2146,7 @@ NTSTATUS _samr_OpenUser(pipes_struct *p,
return NT_STATUS_INVALID_HANDLE;
nt_status = access_check_samr_function(acc_granted,
SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
"_samr_OpenUser" );
if ( !NT_STATUS_IS_OK(nt_status) )
@ -2641,7 +2641,7 @@ NTSTATUS _samr_QueryUserInfo(pipes_struct *p,
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(info->acc_granted,
SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
"_samr_QueryUserInfo");
if (!NT_STATUS_IS_OK(status)) {
return status;
@ -3147,7 +3147,7 @@ NTSTATUS _samr_CreateUser2(pipes_struct *p,
return NT_STATUS_INVALID_HANDLE;
nt_status = access_check_samr_function(acc_granted,
SA_RIGHT_DOMAIN_CREATE_USER,
SAMR_DOMAIN_ACCESS_CREATE_USER,
"_samr_CreateUser2");
if (!NT_STATUS_IS_OK(nt_status)) {
return nt_status;
@ -3582,7 +3582,7 @@ NTSTATUS _samr_OpenAlias(pipes_struct *p,
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(acc_granted,
SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
"_samr_OpenAlias");
if ( !NT_STATUS_IS_OK(status) )
@ -4342,10 +4342,10 @@ NTSTATUS _samr_GetAliasMembership(pipes_struct *p,
return NT_STATUS_INVALID_HANDLE;
ntstatus1 = access_check_samr_function(info->acc_granted,
SA_RIGHT_DOMAIN_LOOKUP_ALIAS_BY_MEM,
SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
"_samr_GetAliasMembership");
ntstatus2 = access_check_samr_function(info->acc_granted,
SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
"_samr_GetAliasMembership");
if (!NT_STATUS_IS_OK(ntstatus1) || !NT_STATUS_IS_OK(ntstatus2)) {
@ -4985,7 +4985,7 @@ NTSTATUS _samr_CreateDomainGroup(pipes_struct *p,
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(acc_granted,
SA_RIGHT_DOMAIN_CREATE_GROUP,
SAMR_DOMAIN_ACCESS_CREATE_GROUP,
"_samr_CreateDomainGroup");
if (!NT_STATUS_IS_OK(status)) {
return status;
@ -5067,7 +5067,7 @@ NTSTATUS _samr_CreateDomAlias(pipes_struct *p,
return NT_STATUS_INVALID_HANDLE;
result = access_check_samr_function(acc_granted,
SA_RIGHT_DOMAIN_CREATE_ALIAS,
SAMR_DOMAIN_ACCESS_CREATE_ALIAS,
"_samr_CreateDomAlias");
if (!NT_STATUS_IS_OK(result)) {
return result;
@ -5474,7 +5474,7 @@ NTSTATUS _samr_OpenGroup(pipes_struct *p,
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(acc_granted,
SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
"_samr_OpenGroup");
if ( !NT_STATUS_IS_OK(status) )
@ -5628,11 +5628,11 @@ NTSTATUS _samr_SetDomainInfo(pipes_struct *p,
* levels here, but we're really just looking for
* GENERIC_RIGHTS_DOMAIN_WRITE access. Unfortunately
* this maps to different specific bits. So
* assume if we have SA_RIGHT_DOMAIN_SET_INFO_1
* assume if we have SAMR_DOMAIN_ACCESS_SET_INFO_1
* set we are ok. */
result = access_check_samr_function(info->acc_granted,
SA_RIGHT_DOMAIN_SET_INFO_1,
SAMR_DOMAIN_ACCESS_SET_INFO_1,
"_samr_SetDomainInfo");
if (!NT_STATUS_IS_OK(result))
@ -5705,7 +5705,7 @@ NTSTATUS _samr_GetDisplayEnumerationIndex(pipes_struct *p,
}
status = access_check_samr_function(info->acc_granted,
SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
"_samr_GetDisplayEnumerationIndex");
if (!NT_STATUS_IS_OK(status)) {
return status;

2
source3/utils/net_rpc.c
View File

@ -6127,7 +6127,7 @@ static int rpc_trustdom_list(struct net_context *c, int argc, const char **argv)
able to enumerate accounts*/
nt_status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
&connect_hnd,
SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
queried_dom_sid,
&domain_hnd);
if (!NT_STATUS_IS_OK(nt_status)) {