source3/utils/net_rpc_rights.c

   1 /*
   2    Samba Unix/Linux SMB client library
   3    Distributed SMB/CIFS Server Management Utility
   4    Copyright (C) Gerald (Jerry) Carter          2004
   5    Copyright (C) Guenther Deschner              2008
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20 #include "includes.h"
  21 #include "utils/net.h"
  22 #include "../librpc/gen_ndr/cli_lsa.h"
  23 #include "rpc_client/cli_lsarpc.h"
  24
  25 /********************************************************************
  26 ********************************************************************/
  27
  28 static NTSTATUS sid_to_name(struct rpc_pipe_client *pipe_hnd,
  29                                 TALLOC_CTX *mem_ctx,
  30                                 DOM_SID *sid,
  31                                 fstring name)
  32 {
  33         struct policy_handle pol;
  34         enum lsa_SidType *sid_types = NULL;
  35         NTSTATUS result;
  36         char **domains = NULL, **names = NULL;
  37
  38         result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
  39                 SEC_FLAG_MAXIMUM_ALLOWED, &pol);
  40
  41         if ( !NT_STATUS_IS_OK(result) )
  42                 return result;
  43
  44         result = rpccli_lsa_lookup_sids(pipe_hnd, mem_ctx, &pol, 1, sid, &domains, &names, &sid_types);
  45
  46         if ( NT_STATUS_IS_OK(result) ) {
  47                 if ( *domains[0] )
  48                         fstr_sprintf( name, "%s\\%s", domains[0], names[0] );
  49                 else
  50                         fstrcpy( name, names[0] );
  51         }
  52
  53         rpccli_lsa_Close(pipe_hnd, mem_ctx, &pol);
  54         return result;
  55 }
  56
  57 /********************************************************************
  58 ********************************************************************/
  59
  60 static NTSTATUS name_to_sid(struct rpc_pipe_client *pipe_hnd,
  61                             TALLOC_CTX *mem_ctx,
  62                             DOM_SID *sid, const char *name)
  63 {
  64         struct policy_handle pol;
  65         enum lsa_SidType *sid_types;
  66         NTSTATUS result;
  67         DOM_SID *sids;
  68
  69         /* maybe its a raw SID */
  70         if ( strncmp(name, "S-", 2) == 0 && string_to_sid(sid, name) ) {
  71                 return NT_STATUS_OK;
  72         }
  73
  74         result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
  75                 SEC_FLAG_MAXIMUM_ALLOWED, &pol);
  76
  77         if ( !NT_STATUS_IS_OK(result) )
  78                 return result;
  79
  80         result = rpccli_lsa_lookup_names(pipe_hnd, mem_ctx, &pol, 1, &name,
  81                                          NULL, 1, &sids, &sid_types);
  82
  83         if ( NT_STATUS_IS_OK(result) )
  84                 sid_copy( sid, &sids[0] );
  85
  86         rpccli_lsa_Close(pipe_hnd, mem_ctx, &pol);
  87         return result;
  88 }
  89
  90 /********************************************************************
  91 ********************************************************************/
  92
  93 static NTSTATUS enum_privileges(struct rpc_pipe_client *pipe_hnd,
  94                                 TALLOC_CTX *ctx,
  95                                 struct policy_handle *pol )
  96 {
  97         NTSTATUS result;
  98         uint32 enum_context = 0;
  99         uint32 pref_max_length=0x1000;
 100         int i;
 101         uint16 lang_id=0;
 102         uint16 lang_id_sys=0;
 103         uint16 lang_id_desc;
 104         struct lsa_StringLarge *description = NULL;
 105         struct lsa_PrivArray priv_array;
 106
 107         result = rpccli_lsa_EnumPrivs(pipe_hnd, ctx,
 108                                       pol,
 109                                       &enum_context,
 110                                       &priv_array,
 111                                       pref_max_length);
 112
 113         if ( !NT_STATUS_IS_OK(result) )
 114                 return result;
 115
 116         /* Print results */
 117
 118         for (i = 0; i < priv_array.count; i++) {
 119
 120                 struct lsa_String lsa_name;
 121
 122                 d_printf("%30s  ",
 123                         priv_array.privs[i].name.string ? priv_array.privs[i].name.string : "*unknown*" );
 124
 125                 /* try to get the description */
 126
 127                 init_lsa_String(&lsa_name, priv_array.privs[i].name.string);
 128
 129                 result = rpccli_lsa_LookupPrivDisplayName(pipe_hnd, ctx,
 130                                                           pol,
 131                                                           &lsa_name,
 132                                                           lang_id,
 133                                                           lang_id_sys,
 134                                                           &description,
 135                                                           &lang_id_desc);
 136
 137                 if (!NT_STATUS_IS_OK(result)) {
 138                         d_printf("??????\n");
 139                         continue;
 140                 }
 141
 142                 d_printf("%s\n", description->string);
 143         }
 144
 145         return NT_STATUS_OK;
 146 }
 147
 148 /********************************************************************
 149 ********************************************************************/
 150
 151 static NTSTATUS check_privilege_for_user(struct rpc_pipe_client *pipe_hnd,
 152                                         TALLOC_CTX *ctx,
 153                                         struct policy_handle *pol,
 154                                         DOM_SID *sid,
 155                                         const char *right)
 156 {
 157         NTSTATUS result;
 158         struct lsa_RightSet rights;
 159         int i;
 160
 161         result = rpccli_lsa_EnumAccountRights(pipe_hnd, ctx,
 162                                               pol,
 163                                               sid,
 164                                               &rights);
 165
 166         if (!NT_STATUS_IS_OK(result)) {
 167                 return result;
 168         }
 169
 170         if (rights.count == 0) {
 171                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 172         }
 173
 174         for (i = 0; i < rights.count; i++) {
 175                 if (StrCaseCmp(rights.names[i].string, right) == 0) {
 176                         return NT_STATUS_OK;
 177                 }
 178         }
 179
 180         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 181 }
 182
 183 /********************************************************************
 184 ********************************************************************/
 185
 186 static NTSTATUS enum_privileges_for_user(struct rpc_pipe_client *pipe_hnd,
 187                                         TALLOC_CTX *ctx,
 188                                         struct policy_handle *pol,
 189                                         DOM_SID *sid )
 190 {
 191         NTSTATUS result;
 192         struct lsa_RightSet rights;
 193         int i;
 194
 195         result = rpccli_lsa_EnumAccountRights(pipe_hnd, ctx,
 196                                               pol,
 197                                               sid,
 198                                               &rights);
 199
 200         if (!NT_STATUS_IS_OK(result))
 201                 return result;
 202
 203         if (rights.count == 0) {
 204                 d_printf(_("No privileges assigned\n"));
 205         }
 206
 207         for (i = 0; i < rights.count; i++) {
 208                 printf("%s\n", rights.names[i].string);
 209         }
 210
 211         return NT_STATUS_OK;
 212 }
 213
 214 /********************************************************************
 215 ********************************************************************/
 216
 217 static NTSTATUS enum_accounts_for_privilege(struct rpc_pipe_client *pipe_hnd,
 218                                                 TALLOC_CTX *ctx,
 219                                                 struct policy_handle *pol,
 220                                                 const char *privilege)
 221 {
 222         NTSTATUS result;
 223         uint32 enum_context=0;
 224         uint32 pref_max_length=0x1000;
 225         struct lsa_SidArray sid_array;
 226         int i;
 227         fstring name;
 228
 229         result = rpccli_lsa_EnumAccounts(pipe_hnd, ctx,
 230                                          pol,
 231                                          &enum_context,
 232                                          &sid_array,
 233                                          pref_max_length);
 234
 235         if (!NT_STATUS_IS_OK(result))
 236                 return result;
 237
 238         d_printf("%s:\n", privilege);
 239
 240         for ( i=0; i<sid_array.num_sids; i++ ) {
 241
 242                 result = check_privilege_for_user(pipe_hnd, ctx, pol,
 243                                                   sid_array.sids[i].sid,
 244                                                   privilege);
 245
 246                 if ( ! NT_STATUS_IS_OK(result)) {
 247                         if ( ! NT_STATUS_EQUAL(result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
 248                                 return result;
 249                         }
 250                         continue;
 251                 }
 252
 253                 /* try to convert the SID to a name.  Fall back to
 254                    printing the raw SID if necessary */
 255                 result = sid_to_name( pipe_hnd, ctx, sid_array.sids[i].sid, name );
 256                 if ( !NT_STATUS_IS_OK (result) )
 257                         sid_to_fstring(name, sid_array.sids[i].sid);
 258
 259                 d_printf("  %s\n", name);
 260         }
 261
 262         return NT_STATUS_OK;
 263 }
 264
 265 /********************************************************************
 266 ********************************************************************/
 267
 268 static NTSTATUS enum_privileges_for_accounts(struct rpc_pipe_client *pipe_hnd,
 269                                                 TALLOC_CTX *ctx,
 270                                                 struct policy_handle *pol)
 271 {
 272         NTSTATUS result;
 273         uint32 enum_context=0;
 274         uint32 pref_max_length=0x1000;
 275         struct lsa_SidArray sid_array;
 276         int i;
 277         fstring name;
 278
 279         result = rpccli_lsa_EnumAccounts(pipe_hnd, ctx,
 280                                          pol,
 281                                          &enum_context,
 282                                          &sid_array,
 283                                          pref_max_length);
 284
 285         if (!NT_STATUS_IS_OK(result))
 286                 return result;
 287
 288         for ( i=0; i<sid_array.num_sids; i++ ) {
 289
 290                 /* try to convert the SID to a name.  Fall back to
 291                    printing the raw SID if necessary */
 292
 293                 result = sid_to_name(pipe_hnd, ctx, sid_array.sids[i].sid, name);
 294                 if ( !NT_STATUS_IS_OK (result) )
 295                         sid_to_fstring(name, sid_array.sids[i].sid);
 296
 297                 d_printf("%s\n", name);
 298
 299                 result = enum_privileges_for_user(pipe_hnd, ctx, pol,
 300                                                   sid_array.sids[i].sid);
 301                 if ( !NT_STATUS_IS_OK(result) )
 302                         return result;
 303
 304                 d_printf("\n");
 305         }
 306
 307         return NT_STATUS_OK;
 308 }
 309
 310 /********************************************************************
 311 ********************************************************************/
 312
 313 static NTSTATUS rpc_rights_list_internal(struct net_context *c,
 314                                         const DOM_SID *domain_sid,
 315                                         const char *domain_name,
 316                                         struct cli_state *cli,
 317                                         struct rpc_pipe_client *pipe_hnd,
 318                                         TALLOC_CTX *mem_ctx,
 319                                         int argc,
 320                                         const char **argv )
 321 {
 322         struct policy_handle pol;
 323         NTSTATUS result;
 324         DOM_SID sid;
 325         fstring privname;
 326         struct lsa_String lsa_name;
 327         struct lsa_StringLarge *description = NULL;
 328         uint16 lang_id = 0;
 329         uint16 lang_id_sys = 0;
 330         uint16 lang_id_desc;
 331
 332         result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
 333                 SEC_FLAG_MAXIMUM_ALLOWED, &pol);
 334
 335         if ( !NT_STATUS_IS_OK(result) )
 336                 return result;
 337
 338         /* backwards compatibility; just list available privileges if no arguement */
 339
 340         if (argc == 0) {
 341                 result = enum_privileges(pipe_hnd, mem_ctx, &pol );
 342                 goto done;
 343         }
 344
 345         if (strequal(argv[0], "privileges")) {
 346                 int i = 1;
 347
 348                 if (argv[1] == NULL) {
 349                         result = enum_privileges(pipe_hnd, mem_ctx, &pol );
 350                         goto done;
 351                 }
 352
 353                 while ( argv[i] != NULL ) {
 354                         fstrcpy(privname, argv[i]);
 355                         init_lsa_String(&lsa_name, argv[i]);
 356                         i++;
 357
 358                         /* verify that this is a valid privilege for error reporting */
 359                         result = rpccli_lsa_LookupPrivDisplayName(pipe_hnd, mem_ctx,
 360                                                                   &pol,
 361                                                                   &lsa_name,
 362                                                                   lang_id,
 363                                                                   lang_id_sys,
 364                                                                   &description,
 365                                                                   &lang_id_desc);
 366
 367                         if ( !NT_STATUS_IS_OK(result) ) {
 368                                 if ( NT_STATUS_EQUAL( result, NT_STATUS_NO_SUCH_PRIVILEGE ) )
 369                                         d_fprintf(stderr, _("No such privilege "
 370                                                   "exists: %s.\n"), privname);
 371                                 else
 372                                         d_fprintf(stderr, _("Error resolving "
 373                                                   "privilege display name "
 374                                                   "[%s].\n"),
 375                                                   nt_errstr(result));
 376                                 continue;
 377                         }
 378
 379                         result = enum_accounts_for_privilege(pipe_hnd, mem_ctx, &pol, privname);
 380                         if (!NT_STATUS_IS_OK(result)) {
 381                                 d_fprintf(stderr, _("Error enumerating "
 382                                           "accounts for privilege %s [%s].\n"),
 383                                           privname, nt_errstr(result));
 384                                 continue;
 385                         }
 386                 }
 387                 goto done;
 388         }
 389
 390         /* special case to enumerate all privileged SIDs with associated rights */
 391
 392         if (strequal( argv[0], "accounts")) {
 393                 int i = 1;
 394
 395                 if (argv[1] == NULL) {
 396                         result = enum_privileges_for_accounts(pipe_hnd, mem_ctx, &pol);
 397                         goto done;
 398                 }
 399
 400                 while (argv[i] != NULL) {
 401                         result = name_to_sid(pipe_hnd, mem_ctx, &sid, argv[i]);
 402                         if (!NT_STATUS_IS_OK(result)) {
 403                                 goto done;
 404                         }
 405                         result = enum_privileges_for_user(pipe_hnd, mem_ctx, &pol, &sid);
 406                         if (!NT_STATUS_IS_OK(result)) {
 407                                 goto done;
 408                         }
 409                         i++;
 410                 }
 411                 goto done;
 412         }
 413
 414         /* backward comaptibility: if no keyword provided, treat the key
 415            as an account name */
 416         if (argc > 1) {
 417                 d_printf("%s net rpc rights list [[accounts|privileges] "
 418                          "[name|SID]]\n", _("Usage:"));
 419                 result = NT_STATUS_OK;
 420                 goto done;
 421         }
 422
 423         result = name_to_sid(pipe_hnd, mem_ctx, &sid, argv[0]);
 424         if (!NT_STATUS_IS_OK(result)) {
 425                 goto done;
 426         }
 427         result = enum_privileges_for_user(pipe_hnd, mem_ctx, &pol, &sid );
 428
 429 done:
 430         rpccli_lsa_Close(pipe_hnd, mem_ctx, &pol);
 431
 432         return result;
 433 }
 434
 435 /********************************************************************
 436 ********************************************************************/
 437
 438 static NTSTATUS rpc_rights_grant_internal(struct net_context *c,
 439                                         const DOM_SID *domain_sid,
 440                                         const char *domain_name,
 441                                         struct cli_state *cli,
 442                                         struct rpc_pipe_client *pipe_hnd,
 443                                         TALLOC_CTX *mem_ctx,
 444                                         int argc,
 445                                         const char **argv )
 446 {
 447         struct policy_handle dom_pol;
 448         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 449         struct lsa_RightSet rights;
 450         int i;
 451
 452         DOM_SID sid;
 453
 454         if (argc < 2 ) {
 455                 d_printf("%s\n%s",
 456                          _("Usage:"),
 457                          _(" net rpc rights grant <name|SID> <rights...>\n"));
 458                 return NT_STATUS_OK;
 459         }
 460
 461         result = name_to_sid(pipe_hnd, mem_ctx, &sid, argv[0]);
 462         if (NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED))
 463                 result = NT_STATUS_NO_SUCH_USER;
 464
 465         if (!NT_STATUS_IS_OK(result))
 466                 goto done;
 467
 468         result = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, true,
 469                                      SEC_FLAG_MAXIMUM_ALLOWED,
 470                                      &dom_pol);
 471
 472         if (!NT_STATUS_IS_OK(result))
 473                 return result;
 474
 475         rights.count = argc-1;
 476         rights.names = TALLOC_ARRAY(mem_ctx, struct lsa_StringLarge,
 477                                     rights.count);
 478         if (!rights.names) {
 479                 return NT_STATUS_NO_MEMORY;
 480         }
 481
 482         for (i=0; i<argc-1; i++) {
 483                 init_lsa_StringLarge(&rights.names[i], argv[i+1]);
 484         }
 485
 486         result = rpccli_lsa_AddAccountRights(pipe_hnd, mem_ctx,
 487                                              &dom_pol,
 488                                              &sid,
 489                                              &rights);
 490
 491         if (!NT_STATUS_IS_OK(result))
 492                 goto done;
 493
 494         d_printf(_("Successfully granted rights.\n"));
 495
 496  done:
 497         if ( !NT_STATUS_IS_OK(result) ) {
 498                 d_fprintf(stderr, _("Failed to grant privileges for %s (%s)\n"),
 499                         argv[0], nt_errstr(result));
 500         }
 501
 502         rpccli_lsa_Close(pipe_hnd, mem_ctx, &dom_pol);
 503
 504         return result;
 505 }
 506
 507 /********************************************************************
 508 ********************************************************************/
 509
 510 static NTSTATUS rpc_rights_revoke_internal(struct net_context *c,
 511                                         const DOM_SID *domain_sid,
 512                                         const char *domain_name,
 513                                         struct cli_state *cli,
 514                                         struct rpc_pipe_client *pipe_hnd,
 515                                         TALLOC_CTX *mem_ctx,
 516                                         int argc,
 517                                         const char **argv )
 518 {
 519         struct policy_handle dom_pol;
 520         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 521         struct lsa_RightSet rights;
 522         DOM_SID sid;
 523         int i;
 524
 525         if (argc < 2 ) {
 526                 d_printf("%s\n%s",
 527                          _("Usage:"),
 528                          _(" net rpc rights revoke <name|SID> <rights...>\n"));
 529                 return NT_STATUS_OK;
 530         }
 531
 532         result = name_to_sid(pipe_hnd, mem_ctx, &sid, argv[0]);
 533         if (!NT_STATUS_IS_OK(result))
 534                 return result;
 535
 536         result = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, true,
 537                                      SEC_FLAG_MAXIMUM_ALLOWED,
 538                                      &dom_pol);
 539
 540         if (!NT_STATUS_IS_OK(result))
 541                 return result;
 542
 543         rights.count = argc-1;
 544         rights.names = TALLOC_ARRAY(mem_ctx, struct lsa_StringLarge,
 545                                     rights.count);
 546         if (!rights.names) {
 547                 return NT_STATUS_NO_MEMORY;
 548         }
 549
 550         for (i=0; i<argc-1; i++) {
 551                 init_lsa_StringLarge(&rights.names[i], argv[i+1]);
 552         }
 553
 554         result = rpccli_lsa_RemoveAccountRights(pipe_hnd, mem_ctx,
 555                                                 &dom_pol,
 556                                                 &sid,
 557                                                 false,
 558                                                 &rights);
 559
 560         if (!NT_STATUS_IS_OK(result))
 561                 goto done;
 562
 563         d_printf(_("Successfully revoked rights.\n"));
 564
 565 done:
 566         if ( !NT_STATUS_IS_OK(result) ) {
 567                 d_fprintf(stderr,_("Failed to revoke privileges for %s (%s)\n"),
 568                         argv[0], nt_errstr(result));
 569         }
 570
 571         rpccli_lsa_Close(pipe_hnd, mem_ctx, &dom_pol);
 572
 573         return result;
 574 }
 575
 576
 577 /********************************************************************
 578 ********************************************************************/
 579
 580 static int rpc_rights_list(struct net_context *c, int argc, const char **argv )
 581 {
 582         if (c->display_usage) {
 583                 d_printf("%s\n%s",
 584                          _("Usage:"),
 585                          _("net rpc rights list [{accounts|privileges} "
 586                            "[name|SID]]\n"
 587                            "    View available/assigned privileges\n"));
 588                 return 0;
 589         }
 590
 591         return run_rpc_command(c, NULL, &ndr_table_lsarpc.syntax_id, 0,
 592                 rpc_rights_list_internal, argc, argv );
 593 }
 594
 595 /********************************************************************
 596 ********************************************************************/
 597
 598 static int rpc_rights_grant(struct net_context *c, int argc, const char **argv )
 599 {
 600         if (c->display_usage) {
 601                 d_printf("%s\n%s",
 602                          _("Usage:"),
 603                          _("net rpc rights grant <name|SID> <right>\n"
 604                            "    Assign privilege[s]\n"));
 605                 d_printf(_("For example:\n"
 606                            "    net rpc rights grant 'VALE\\biddle' "
 607                            "SePrintOperatorPrivilege SeDiskOperatorPrivilege\n"
 608                            "    would grant the printer admin and disk manager "
 609                            "rights to the user 'VALE\\biddle'\n"));
 610                 return 0;
 611         }
 612
 613         return run_rpc_command(c, NULL, &ndr_table_lsarpc.syntax_id, 0,
 614                 rpc_rights_grant_internal, argc, argv );
 615 }
 616
 617 /********************************************************************
 618 ********************************************************************/
 619
 620 static int rpc_rights_revoke(struct net_context *c, int argc, const char **argv)
 621 {
 622         if (c->display_usage) {
 623                 d_printf("%s\n%s",
 624                          _("Usage:"),
 625                          _("net rpc rights revoke <name|SID> <right>\n"
 626                            "    Revoke privilege[s]\n"));
 627                 d_printf(_("For example:\n"
 628                            "    net rpc rights revoke 'VALE\\biddle' "
 629                            "SePrintOperatorPrivilege SeDiskOperatorPrivilege\n"
 630                            "    would revoke the printer admin and disk manager"
 631                            " rights from the user 'VALE\\biddle'\n"));
 632                 return 0;
 633         }
 634
 635         return run_rpc_command(c, NULL, &ndr_table_lsarpc.syntax_id, 0,
 636                 rpc_rights_revoke_internal, argc, argv );
 637 }
 638
 639 /********************************************************************
 640 ********************************************************************/
 641
 642 int net_rpc_rights(struct net_context *c, int argc, const char **argv)
 643 {
 644         struct functable func[] = {
 645                 {
 646                         "list",
 647                         rpc_rights_list,
 648                         NET_TRANSPORT_RPC,
 649                         N_("View available/assigned privileges"),
 650                         N_("net rpc rights list\n"
 651                            "    View available/assigned privileges")
 652                 },
 653                 {
 654                         "grant",
 655                         rpc_rights_grant,
 656                         NET_TRANSPORT_RPC,
 657                         N_("Assign privilege[s]"),
 658                         N_("net rpc rights grant\n"
 659                            "    Assign privilege[s]")
 660                 },
 661                 {
 662                         "revoke",
 663                         rpc_rights_revoke,
 664                         NET_TRANSPORT_RPC,
 665                         N_("Revoke privilege[s]"),
 666                         N_("net rpc rights revoke\n"
 667                            "    Revoke privilege[s]")
 668                 },
 669                 {NULL, NULL, 0, NULL, NULL}
 670         };
 671
 672         return net_run_function(c, argc, argv, "net rpc rights", func);
 673 }
 674
 675 static NTSTATUS rpc_sh_rights_list(struct net_context *c,
 676                                    TALLOC_CTX *mem_ctx, struct rpc_sh_ctx *ctx,
 677                                    struct rpc_pipe_client *pipe_hnd,
 678                                    int argc, const char **argv)
 679 {
 680         return rpc_rights_list_internal(c, ctx->domain_sid, ctx->domain_name,
 681                                         ctx->cli, pipe_hnd, mem_ctx,
 682                                         argc, argv);
 683 }
 684
 685 static NTSTATUS rpc_sh_rights_grant(struct net_context *c,
 686                                     TALLOC_CTX *mem_ctx,
 687                                     struct rpc_sh_ctx *ctx,
 688                                     struct rpc_pipe_client *pipe_hnd,
 689                                     int argc, const char **argv)
 690 {
 691         return rpc_rights_grant_internal(c, ctx->domain_sid, ctx->domain_name,
 692                                          ctx->cli, pipe_hnd, mem_ctx,
 693                                          argc, argv);
 694 }
 695
 696 static NTSTATUS rpc_sh_rights_revoke(struct net_context *c,
 697                                      TALLOC_CTX *mem_ctx,
 698                                      struct rpc_sh_ctx *ctx,
 699                                      struct rpc_pipe_client *pipe_hnd,
 700                                      int argc, const char **argv)
 701 {
 702         return rpc_rights_revoke_internal(c, ctx->domain_sid, ctx->domain_name,
 703                                           ctx->cli, pipe_hnd, mem_ctx,
 704                                           argc, argv);
 705 }
 706
 707 struct rpc_sh_cmd *net_rpc_rights_cmds(struct net_context *c, TALLOC_CTX *mem_ctx,
 708                                        struct rpc_sh_ctx *ctx)
 709 {
 710         static struct rpc_sh_cmd cmds[] = {
 711
 712         { "list", NULL, &ndr_table_lsarpc.syntax_id, rpc_sh_rights_list,
 713           N_("View available or assigned privileges") },
 714
 715         { "grant", NULL, &ndr_table_lsarpc.syntax_id, rpc_sh_rights_grant,
 716           N_("Assign privilege[s]") },
 717
 718         { "revoke", NULL, &ndr_table_lsarpc.syntax_id, rpc_sh_rights_revoke,
 719           N_("Revoke privilege[s]") },
 720
 721         { NULL, NULL, 0, NULL, NULL }
 722         };
 723
 724         return cmds;
 725 }
 726