source3/utils/net_rpc_rights.c

   1 /*
   2    Samba Unix/Linux SMB client library
   3    Distributed SMB/CIFS Server Management Utility
   4    Copyright (C) Gerald (Jerry) Carter          2004
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
  18
  19 #include "includes.h"
  20 #include "utils/net.h"
  21
  22 /********************************************************************
  23 ********************************************************************/
  24
  25 static NTSTATUS sid_to_name(struct rpc_pipe_client *pipe_hnd,
  26                                 TALLOC_CTX *mem_ctx,
  27                                 DOM_SID *sid,
  28                                 fstring name)
  29 {
  30         POLICY_HND pol;
  31         enum lsa_SidType *sid_types = NULL;
  32         NTSTATUS result;
  33         char **domains = NULL, **names = NULL;
  34
  35         result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, True,
  36                 SEC_RIGHTS_MAXIMUM_ALLOWED, &pol);
  37
  38         if ( !NT_STATUS_IS_OK(result) )
  39                 return result;
  40
  41         result = rpccli_lsa_lookup_sids(pipe_hnd, mem_ctx, &pol, 1, sid, &domains, &names, &sid_types);
  42
  43         if ( NT_STATUS_IS_OK(result) ) {
  44                 if ( *domains[0] )
  45                         fstr_sprintf( name, "%s\\%s", domains[0], names[0] );
  46                 else
  47                         fstrcpy( name, names[0] );
  48         }
  49
  50         rpccli_lsa_Close(pipe_hnd, mem_ctx, &pol);
  51         return result;
  52 }
  53
  54 /********************************************************************
  55 ********************************************************************/
  56
  57 static NTSTATUS name_to_sid(struct rpc_pipe_client *pipe_hnd,
  58                             TALLOC_CTX *mem_ctx,
  59                             DOM_SID *sid, const char *name)
  60 {
  61         POLICY_HND pol;
  62         enum lsa_SidType *sid_types;
  63         NTSTATUS result;
  64         DOM_SID *sids;
  65
  66         /* maybe its a raw SID */
  67         if ( strncmp(name, "S-", 2) == 0 && string_to_sid(sid, name) ) {
  68                 return NT_STATUS_OK;
  69         }
  70
  71         result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, True,
  72                 SEC_RIGHTS_MAXIMUM_ALLOWED, &pol);
  73
  74         if ( !NT_STATUS_IS_OK(result) )
  75                 return result;
  76
  77         result = rpccli_lsa_lookup_names(pipe_hnd, mem_ctx, &pol, 1, &name,
  78                                          NULL, 1, &sids, &sid_types);
  79
  80         if ( NT_STATUS_IS_OK(result) )
  81                 sid_copy( sid, &sids[0] );
  82
  83         rpccli_lsa_Close(pipe_hnd, mem_ctx, &pol);
  84         return result;
  85 }
  86
  87 /********************************************************************
  88 ********************************************************************/
  89
  90 static NTSTATUS enum_privileges(struct rpc_pipe_client *pipe_hnd,
  91                                 TALLOC_CTX *ctx,
  92                                 POLICY_HND *pol )
  93 {
  94         NTSTATUS result;
  95         uint32 enum_context = 0;
  96         uint32 pref_max_length=0x1000;
  97         int i;
  98         uint16 lang_id=0;
  99         uint16 lang_id_sys=0;
 100         uint16 lang_id_desc;
 101         struct lsa_StringLarge *description = NULL;
 102         struct lsa_PrivArray priv_array;
 103
 104         result = rpccli_lsa_EnumPrivs(pipe_hnd, ctx,
 105                                       pol,
 106                                       &enum_context,
 107                                       &priv_array,
 108                                       pref_max_length);
 109
 110         if ( !NT_STATUS_IS_OK(result) )
 111                 return result;
 112
 113         /* Print results */
 114
 115         for (i = 0; i < priv_array.count; i++) {
 116
 117                 struct lsa_String lsa_name;
 118
 119                 d_printf("%30s  ",
 120                         priv_array.privs[i].name.string ? priv_array.privs[i].name.string : "*unknown*" );
 121
 122                 /* try to get the description */
 123
 124                 init_lsa_String(&lsa_name, priv_array.privs[i].name.string);
 125
 126                 result = rpccli_lsa_LookupPrivDisplayName(pipe_hnd, ctx,
 127                                                           pol,
 128                                                           &lsa_name,
 129                                                           lang_id,
 130                                                           lang_id_sys,
 131                                                           &description,
 132                                                           &lang_id_desc);
 133
 134                 if (!NT_STATUS_IS_OK(result)) {
 135                         d_printf("??????\n");
 136                         continue;
 137                 }
 138
 139                 d_printf("%s\n", description->string);
 140         }
 141
 142         return NT_STATUS_OK;
 143 }
 144
 145 /********************************************************************
 146 ********************************************************************/
 147
 148 static NTSTATUS check_privilege_for_user(struct rpc_pipe_client *pipe_hnd,
 149                                         TALLOC_CTX *ctx,
 150                                         POLICY_HND *pol,
 151                                         DOM_SID *sid,
 152                                         const char *right)
 153 {
 154         NTSTATUS result;
 155         struct lsa_RightSet rights;
 156         int i;
 157
 158         result = rpccli_lsa_EnumAccountRights(pipe_hnd, ctx,
 159                                               pol,
 160                                               sid,
 161                                               &rights);
 162
 163         if (!NT_STATUS_IS_OK(result)) {
 164                 return result;
 165         }
 166
 167         if (rights.count == 0) {
 168                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 169         }
 170
 171         for (i = 0; i < rights.count; i++) {
 172                 if (StrCaseCmp(rights.names[i].string, right) == 0) {
 173                         return NT_STATUS_OK;
 174                 }
 175         }
 176
 177         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 178 }
 179
 180 /********************************************************************
 181 ********************************************************************/
 182
 183 static NTSTATUS enum_privileges_for_user(struct rpc_pipe_client *pipe_hnd,
 184                                         TALLOC_CTX *ctx,
 185                                         POLICY_HND *pol,
 186                                         DOM_SID *sid )
 187 {
 188         NTSTATUS result;
 189         struct lsa_RightSet rights;
 190         int i;
 191
 192         result = rpccli_lsa_EnumAccountRights(pipe_hnd, ctx,
 193                                               pol,
 194                                               sid,
 195                                               &rights);
 196
 197         if (!NT_STATUS_IS_OK(result))
 198                 return result;
 199
 200         if (rights.count == 0) {
 201                 d_printf("No privileges assigned\n");
 202         }
 203
 204         for (i = 0; i < rights.count; i++) {
 205                 printf("%s\n", rights.names[i].string);
 206         }
 207
 208         return NT_STATUS_OK;
 209 }
 210
 211 /********************************************************************
 212 ********************************************************************/
 213
 214 static NTSTATUS enum_accounts_for_privilege(struct rpc_pipe_client *pipe_hnd,
 215                                                 TALLOC_CTX *ctx,
 216                                                 POLICY_HND *pol,
 217                                                 const char *privilege)
 218 {
 219         NTSTATUS result;
 220         uint32 enum_context=0;
 221         uint32 pref_max_length=0x1000;
 222         struct lsa_SidArray sid_array;
 223         int i;
 224         fstring name;
 225
 226         result = rpccli_lsa_EnumAccounts(pipe_hnd, ctx,
 227                                          pol,
 228                                          &enum_context,
 229                                          &sid_array,
 230                                          pref_max_length);
 231
 232         if (!NT_STATUS_IS_OK(result))
 233                 return result;
 234
 235         d_printf("%s:\n", privilege);
 236
 237         for ( i=0; i<sid_array.num_sids; i++ ) {
 238
 239                 result = check_privilege_for_user(pipe_hnd, ctx, pol,
 240                                                   sid_array.sids[i].sid,
 241                                                   privilege);
 242
 243                 if ( ! NT_STATUS_IS_OK(result)) {
 244                         if ( ! NT_STATUS_EQUAL(result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
 245                                 return result;
 246                         }
 247                         continue;
 248                 }
 249
 250                 /* try to convert the SID to a name.  Fall back to
 251                    printing the raw SID if necessary */
 252                 result = sid_to_name( pipe_hnd, ctx, sid_array.sids[i].sid, name );
 253                 if ( !NT_STATUS_IS_OK (result) )
 254                         sid_to_fstring(name, sid_array.sids[i].sid);
 255
 256                 d_printf("  %s\n", name);
 257         }
 258
 259         return NT_STATUS_OK;
 260 }
 261
 262 /********************************************************************
 263 ********************************************************************/
 264
 265 static NTSTATUS enum_privileges_for_accounts(struct rpc_pipe_client *pipe_hnd,
 266                                                 TALLOC_CTX *ctx,
 267                                                 POLICY_HND *pol)
 268 {
 269         NTSTATUS result;
 270         uint32 enum_context=0;
 271         uint32 pref_max_length=0x1000;
 272         struct lsa_SidArray sid_array;
 273         int i;
 274         fstring name;
 275
 276         result = rpccli_lsa_EnumAccounts(pipe_hnd, ctx,
 277                                          pol,
 278                                          &enum_context,
 279                                          &sid_array,
 280                                          pref_max_length);
 281
 282         if (!NT_STATUS_IS_OK(result))
 283                 return result;
 284
 285         for ( i=0; i<sid_array.num_sids; i++ ) {
 286
 287                 /* try to convert the SID to a name.  Fall back to
 288                    printing the raw SID if necessary */
 289
 290                 result = sid_to_name(pipe_hnd, ctx, sid_array.sids[i].sid, name);
 291                 if ( !NT_STATUS_IS_OK (result) )
 292                         sid_to_fstring(name, sid_array.sids[i].sid);
 293
 294                 d_printf("%s\n", name);
 295
 296                 result = enum_privileges_for_user(pipe_hnd, ctx, pol,
 297                                                   sid_array.sids[i].sid);
 298                 if ( !NT_STATUS_IS_OK(result) )
 299                         return result;
 300
 301                 d_printf("\n");
 302         }
 303
 304         return NT_STATUS_OK;
 305 }
 306
 307 /********************************************************************
 308 ********************************************************************/
 309
 310 static NTSTATUS rpc_rights_list_internal(const DOM_SID *domain_sid,
 311                                         const char *domain_name,
 312                                         struct cli_state *cli,
 313                                         struct rpc_pipe_client *pipe_hnd,
 314                                         TALLOC_CTX *mem_ctx,
 315                                         int argc,
 316                                         const char **argv )
 317 {
 318         POLICY_HND pol;
 319         NTSTATUS result;
 320         DOM_SID sid;
 321         fstring privname;
 322         struct lsa_String lsa_name;
 323         struct lsa_StringLarge *description = NULL;
 324         uint16 lang_id = 0;
 325         uint16 lang_id_sys = 0;
 326         uint16 lang_id_desc;
 327
 328
 329         result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, True,
 330                 SEC_RIGHTS_MAXIMUM_ALLOWED, &pol);
 331
 332         if ( !NT_STATUS_IS_OK(result) )
 333                 return result;
 334
 335         /* backwards compatibility; just list available privileges if no arguement */
 336
 337         if (argc == 0) {
 338                 result = enum_privileges(pipe_hnd, mem_ctx, &pol );
 339                 goto done;
 340         }
 341
 342         if (strequal(argv[0], "privileges")) {
 343                 int i = 1;
 344
 345                 if (argv[1] == NULL) {
 346                         result = enum_privileges(pipe_hnd, mem_ctx, &pol );
 347                         goto done;
 348                 }
 349
 350                 while ( argv[i] != NULL ) {
 351                         fstrcpy(privname, argv[i]);
 352                         init_lsa_String(&lsa_name, argv[i]);
 353                         i++;
 354
 355                         /* verify that this is a valid privilege for error reporting */
 356                         result = rpccli_lsa_LookupPrivDisplayName(pipe_hnd, mem_ctx,
 357                                                                   &pol,
 358                                                                   &lsa_name,
 359                                                                   lang_id,
 360                                                                   lang_id_sys,
 361                                                                   &description,
 362                                                                   &lang_id_desc);
 363
 364                         if ( !NT_STATUS_IS_OK(result) ) {
 365                                 if ( NT_STATUS_EQUAL( result, NT_STATUS_NO_SUCH_PRIVILEGE ) )
 366                                         d_fprintf(stderr, "No such privilege exists: %s.\n", privname);
 367                                 else
 368                                         d_fprintf(stderr, "Error resolving privilege display name [%s].\n", nt_errstr(result));
 369                                 continue;
 370                         }
 371
 372                         result = enum_accounts_for_privilege(pipe_hnd, mem_ctx, &pol, privname);
 373                         if (!NT_STATUS_IS_OK(result)) {
 374                                 d_fprintf(stderr, "Error enumerating accounts for privilege %s [%s].\n",
 375                                         privname, nt_errstr(result));
 376                                 continue;
 377                         }
 378                 }
 379                 goto done;
 380         }
 381
 382         /* special case to enumerate all privileged SIDs with associated rights */
 383
 384         if (strequal( argv[0], "accounts")) {
 385                 int i = 1;
 386
 387                 if (argv[1] == NULL) {
 388                         result = enum_privileges_for_accounts(pipe_hnd, mem_ctx, &pol);
 389                         goto done;
 390                 }
 391
 392                 while (argv[i] != NULL) {
 393                         result = name_to_sid(pipe_hnd, mem_ctx, &sid, argv[i]);
 394                         if (!NT_STATUS_IS_OK(result)) {
 395                                 goto done;
 396                         }
 397                         result = enum_privileges_for_user(pipe_hnd, mem_ctx, &pol, &sid);
 398                         if (!NT_STATUS_IS_OK(result)) {
 399                                 goto done;
 400                         }
 401                         i++;
 402                 }
 403                 goto done;
 404         }
 405
 406         /* backward comaptibility: if no keyword provided, treat the key
 407            as an account name */
 408         if (argc > 1) {
 409                 d_printf("Usage: net rpc rights list [[accounts|privileges] [name|SID]]\n");
 410                 result = NT_STATUS_OK;
 411                 goto done;
 412         }
 413
 414         result = name_to_sid(pipe_hnd, mem_ctx, &sid, argv[0]);
 415         if (!NT_STATUS_IS_OK(result)) {
 416                 goto done;
 417         }
 418         result = enum_privileges_for_user(pipe_hnd, mem_ctx, &pol, &sid );
 419
 420 done:
 421         rpccli_lsa_Close(pipe_hnd, mem_ctx, &pol);
 422
 423         return result;
 424 }
 425
 426 /********************************************************************
 427 ********************************************************************/
 428
 429 static NTSTATUS rpc_rights_grant_internal(const DOM_SID *domain_sid,
 430                                         const char *domain_name,
 431                                         struct cli_state *cli,
 432                                         struct rpc_pipe_client *pipe_hnd,
 433                                         TALLOC_CTX *mem_ctx,
 434                                         int argc,
 435                                         const char **argv )
 436 {
 437         POLICY_HND dom_pol;
 438         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 439         struct lsa_RightSet rights;
 440         int i;
 441
 442         DOM_SID sid;
 443
 444         if (argc < 2 ) {
 445                 d_printf("Usage: net rpc rights grant <name|SID> <rights...>\n");
 446                 return NT_STATUS_OK;
 447         }
 448
 449         result = name_to_sid(pipe_hnd, mem_ctx, &sid, argv[0]);
 450         if (!NT_STATUS_IS_OK(result))
 451                 return result;
 452
 453         result = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, True,
 454                                      SEC_RIGHTS_MAXIMUM_ALLOWED,
 455                                      &dom_pol);
 456
 457         if (!NT_STATUS_IS_OK(result))
 458                 return result;
 459
 460         rights.count = argc-1;
 461         rights.names = TALLOC_ARRAY(mem_ctx, struct lsa_StringLarge,
 462                                     rights.count);
 463         if (!rights.names) {
 464                 return NT_STATUS_NO_MEMORY;
 465         }
 466
 467         for (i=0; i<argc-1; i++) {
 468                 init_lsa_StringLarge(&rights.names[i], argv[i+1]);
 469         }
 470
 471         result = rpccli_lsa_AddAccountRights(pipe_hnd, mem_ctx,
 472                                              &dom_pol,
 473                                              &sid,
 474                                              &rights);
 475
 476         if (!NT_STATUS_IS_OK(result))
 477                 goto done;
 478
 479         d_printf("Successfully granted rights.\n");
 480
 481  done:
 482         if ( !NT_STATUS_IS_OK(result) ) {
 483                 d_fprintf(stderr, "Failed to grant privileges for %s (%s)\n",
 484                         argv[0], nt_errstr(result));
 485         }
 486
 487         rpccli_lsa_Close(pipe_hnd, mem_ctx, &dom_pol);
 488
 489         return result;
 490 }
 491
 492 /********************************************************************
 493 ********************************************************************/
 494
 495 static NTSTATUS rpc_rights_revoke_internal(const DOM_SID *domain_sid,
 496                                         const char *domain_name,
 497                                         struct cli_state *cli,
 498                                         struct rpc_pipe_client *pipe_hnd,
 499                                         TALLOC_CTX *mem_ctx,
 500                                         int argc,
 501                                         const char **argv )
 502 {
 503         POLICY_HND dom_pol;
 504         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 505
 506         DOM_SID sid;
 507
 508         if (argc < 2 ) {
 509                 d_printf("Usage: net rpc rights revoke <name|SID> <rights...>\n");
 510                 return NT_STATUS_OK;
 511         }
 512
 513         result = name_to_sid(pipe_hnd, mem_ctx, &sid, argv[0]);
 514         if (!NT_STATUS_IS_OK(result))
 515                 return result;
 516
 517         result = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, True,
 518                                      SEC_RIGHTS_MAXIMUM_ALLOWED,
 519                                      &dom_pol);
 520
 521         if (!NT_STATUS_IS_OK(result))
 522                 return result;
 523
 524         result = rpccli_lsa_remove_account_rights(pipe_hnd, mem_ctx, &dom_pol, sid,
 525                                                False, argc-1, argv+1);
 526
 527         if (!NT_STATUS_IS_OK(result))
 528                 goto done;
 529
 530         d_printf("Successfully revoked rights.\n");
 531
 532 done:
 533         if ( !NT_STATUS_IS_OK(result) ) {
 534                 d_fprintf(stderr, "Failed to revoke privileges for %s (%s)\n",
 535                         argv[0], nt_errstr(result));
 536         }
 537
 538         rpccli_lsa_Close(pipe_hnd, mem_ctx, &dom_pol);
 539
 540         return result;
 541 }
 542
 543
 544 /********************************************************************
 545 ********************************************************************/
 546
 547 static int rpc_rights_list( int argc, const char **argv )
 548 {
 549         return run_rpc_command( NULL, PI_LSARPC, 0,
 550                 rpc_rights_list_internal, argc, argv );
 551 }
 552
 553 /********************************************************************
 554 ********************************************************************/
 555
 556 static int rpc_rights_grant( int argc, const char **argv )
 557 {
 558         return run_rpc_command( NULL, PI_LSARPC, 0,
 559                 rpc_rights_grant_internal, argc, argv );
 560 }
 561
 562 /********************************************************************
 563 ********************************************************************/
 564
 565 static int rpc_rights_revoke( int argc, const char **argv )
 566 {
 567         return run_rpc_command( NULL, PI_LSARPC, 0,
 568                 rpc_rights_revoke_internal, argc, argv );
 569 }
 570
 571 /********************************************************************
 572 ********************************************************************/
 573
 574 static int net_help_rights( int argc, const char **argv )
 575 {
 576         d_printf("net rpc rights list [{accounts|privileges} [name|SID]]   View available or assigned privileges\n");
 577         d_printf("net rpc rights grant <name|SID> <right>                  Assign privilege[s]\n");
 578         d_printf("net rpc rights revoke <name|SID> <right>                 Revoke privilege[s]\n");
 579
 580         d_printf("\nBoth 'grant' and 'revoke' require a SID and a list of privilege names.\n");
 581         d_printf("For example\n");
 582         d_printf("\n  net rpc rights grant 'VALE\\biddle' SePrintOperatorPrivilege SeDiskOperatorPrivilege\n");
 583         d_printf("\nwould grant the printer admin and disk manager rights to the user 'VALE\\biddle'\n\n");
 584
 585
 586         return -1;
 587 }
 588
 589 /********************************************************************
 590 ********************************************************************/
 591
 592 int net_rpc_rights(int argc, const char **argv)
 593 {
 594         struct functable func[] = {
 595                 {"list", rpc_rights_list},
 596                 {"grant", rpc_rights_grant},
 597                 {"revoke", rpc_rights_revoke},
 598                 {NULL, NULL}
 599         };
 600
 601         if ( argc )
 602                 return net_run_function( argc, argv, func, net_help_rights );
 603
 604         return net_help_rights( argc, argv );
 605 }
 606
 607 static NTSTATUS rpc_sh_rights_list(TALLOC_CTX *mem_ctx, struct rpc_sh_ctx *ctx,
 608                                    struct rpc_pipe_client *pipe_hnd,
 609                                    int argc, const char **argv)
 610 {
 611         return rpc_rights_list_internal(ctx->domain_sid, ctx->domain_name,
 612                                         ctx->cli, pipe_hnd, mem_ctx,
 613                                         argc, argv);
 614 }
 615
 616 static NTSTATUS rpc_sh_rights_grant(TALLOC_CTX *mem_ctx,
 617                                     struct rpc_sh_ctx *ctx,
 618                                     struct rpc_pipe_client *pipe_hnd,
 619                                     int argc, const char **argv)
 620 {
 621         return rpc_rights_grant_internal(ctx->domain_sid, ctx->domain_name,
 622                                          ctx->cli, pipe_hnd, mem_ctx,
 623                                          argc, argv);
 624 }
 625
 626 static NTSTATUS rpc_sh_rights_revoke(TALLOC_CTX *mem_ctx,
 627                                      struct rpc_sh_ctx *ctx,
 628                                      struct rpc_pipe_client *pipe_hnd,
 629                                      int argc, const char **argv)
 630 {
 631         return rpc_rights_revoke_internal(ctx->domain_sid, ctx->domain_name,
 632                                           ctx->cli, pipe_hnd, mem_ctx,
 633                                           argc, argv);
 634 }
 635
 636 struct rpc_sh_cmd *net_rpc_rights_cmds(TALLOC_CTX *mem_ctx,
 637                                        struct rpc_sh_ctx *ctx)
 638 {
 639         static struct rpc_sh_cmd cmds[] = {
 640
 641         { "list", NULL, PI_LSARPC, rpc_sh_rights_list,
 642           "View available or assigned privileges" },
 643
 644         { "grant", NULL, PI_LSARPC, rpc_sh_rights_grant,
 645           "Assign privilege[s]" },
 646
 647         { "revoke", NULL, PI_LSARPC, rpc_sh_rights_revoke,
 648           "Revoke privilege[s]" },
 649
 650         { NULL, NULL, 0, NULL, NULL }
 651         };
 652
 653         return cmds;
 654 }
 655