source3/utils/net_rpc_rights.c

   1 /*
   2    Samba Unix/Linux SMB client library
   3    Distributed SMB/CIFS Server Management Utility
   4    Copyright (C) Gerald (Jerry) Carter          2004
   5    Copyright (C) Guenther Deschner              2008
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20 #include "includes.h"
  21 #include "utils/net.h"
  22 #include "../librpc/gen_ndr/ndr_lsa_c.h"
  23 #include "rpc_client/cli_lsarpc.h"
  24 #include "rpc_client/init_lsa.h"
  25 #include "../libcli/security/security.h"
  26
  27 /********************************************************************
  28 ********************************************************************/
  29
  30 static NTSTATUS sid_to_name(struct rpc_pipe_client *pipe_hnd,
  31                                 TALLOC_CTX *mem_ctx,
  32                                 struct dom_sid *sid,
  33                                 fstring name)
  34 {
  35         struct policy_handle pol;
  36         enum lsa_SidType *sid_types = NULL;
  37         NTSTATUS status, result;
  38         char **domains = NULL, **names = NULL;
  39         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
  40
  41         status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
  42                 SEC_FLAG_MAXIMUM_ALLOWED, &pol);
  43
  44         if ( !NT_STATUS_IS_OK(status) )
  45                 return status;
  46
  47         status = rpccli_lsa_lookup_sids(pipe_hnd, mem_ctx, &pol, 1, sid, &domains, &names, &sid_types);
  48
  49         if ( NT_STATUS_IS_OK(status) ) {
  50                 if ( *domains[0] )
  51                         fstr_sprintf( name, "%s\\%s", domains[0], names[0] );
  52                 else
  53                         fstrcpy( name, names[0] );
  54         }
  55
  56         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
  57         return status;
  58 }
  59
  60 /********************************************************************
  61 ********************************************************************/
  62
  63 static NTSTATUS name_to_sid(struct rpc_pipe_client *pipe_hnd,
  64                             TALLOC_CTX *mem_ctx,
  65                             struct dom_sid *sid, const char *name)
  66 {
  67         struct policy_handle pol;
  68         enum lsa_SidType *sid_types;
  69         NTSTATUS status, result;
  70         struct dom_sid *sids;
  71         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
  72
  73         /* maybe its a raw SID */
  74         if ( strncmp(name, "S-", 2) == 0 && string_to_sid(sid, name) ) {
  75                 return NT_STATUS_OK;
  76         }
  77
  78         status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
  79                 SEC_FLAG_MAXIMUM_ALLOWED, &pol);
  80
  81         if ( !NT_STATUS_IS_OK(status) )
  82                 return status;
  83
  84         status = rpccli_lsa_lookup_names(pipe_hnd, mem_ctx, &pol, 1, &name,
  85                                          NULL, 1, &sids, &sid_types);
  86
  87         if ( NT_STATUS_IS_OK(status) )
  88                 sid_copy( sid, &sids[0] );
  89
  90         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
  91         return status;
  92 }
  93
  94 /********************************************************************
  95 ********************************************************************/
  96
  97 static NTSTATUS enum_privileges(struct rpc_pipe_client *pipe_hnd,
  98                                 TALLOC_CTX *ctx,
  99                                 struct policy_handle *pol )
 100 {
 101         NTSTATUS status, result;
 102         uint32 enum_context = 0;
 103         uint32 pref_max_length=0x1000;
 104         int i;
 105         uint16 lang_id=0;
 106         uint16 lang_id_sys=0;
 107         uint16 lang_id_desc;
 108         struct lsa_StringLarge *description = NULL;
 109         struct lsa_PrivArray priv_array;
 110         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
 111
 112         status = dcerpc_lsa_EnumPrivs(b, ctx,
 113                                       pol,
 114                                       &enum_context,
 115                                       &priv_array,
 116                                       pref_max_length,
 117                                       &result);
 118
 119         if ( !NT_STATUS_IS_OK(status) )
 120                 return status;
 121         if (!NT_STATUS_IS_OK(result)) {
 122                 return result;
 123         }
 124
 125         /* Print results */
 126
 127         for (i = 0; i < priv_array.count; i++) {
 128
 129                 struct lsa_String lsa_name;
 130
 131                 d_printf("%30s  ",
 132                         priv_array.privs[i].name.string ? priv_array.privs[i].name.string : "*unknown*" );
 133
 134                 /* try to get the description */
 135
 136                 init_lsa_String(&lsa_name, priv_array.privs[i].name.string);
 137
 138                 status = dcerpc_lsa_LookupPrivDisplayName(b, ctx,
 139                                                           pol,
 140                                                           &lsa_name,
 141                                                           lang_id,
 142                                                           lang_id_sys,
 143                                                           &description,
 144                                                           &lang_id_desc,
 145                                                           &result);
 146                 if (!NT_STATUS_IS_OK(status)) {
 147                         d_printf("??????\n");
 148                         continue;
 149                 }
 150                 if (!NT_STATUS_IS_OK(result)) {
 151                         d_printf("??????\n");
 152                         continue;
 153                 }
 154
 155                 d_printf("%s\n", description->string);
 156         }
 157
 158         return NT_STATUS_OK;
 159 }
 160
 161 /********************************************************************
 162 ********************************************************************/
 163
 164 static NTSTATUS check_privilege_for_user(struct rpc_pipe_client *pipe_hnd,
 165                                         TALLOC_CTX *ctx,
 166                                         struct policy_handle *pol,
 167                                         struct dom_sid *sid,
 168                                         const char *right)
 169 {
 170         NTSTATUS status, result;
 171         struct lsa_RightSet rights;
 172         int i;
 173         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
 174
 175         status = dcerpc_lsa_EnumAccountRights(b, ctx,
 176                                               pol,
 177                                               sid,
 178                                               &rights,
 179                                               &result);
 180         if (!NT_STATUS_IS_OK(status)) {
 181                 return status;
 182         }
 183         if (!NT_STATUS_IS_OK(result)) {
 184                 return result;
 185         }
 186
 187         if (rights.count == 0) {
 188                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 189         }
 190
 191         for (i = 0; i < rights.count; i++) {
 192                 if (StrCaseCmp(rights.names[i].string, right) == 0) {
 193                         return NT_STATUS_OK;
 194                 }
 195         }
 196
 197         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 198 }
 199
 200 /********************************************************************
 201 ********************************************************************/
 202
 203 static NTSTATUS enum_privileges_for_user(struct rpc_pipe_client *pipe_hnd,
 204                                         TALLOC_CTX *ctx,
 205                                         struct policy_handle *pol,
 206                                         struct dom_sid *sid )
 207 {
 208         NTSTATUS status, result;
 209         struct lsa_RightSet rights;
 210         int i;
 211         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
 212
 213         status = dcerpc_lsa_EnumAccountRights(b, ctx,
 214                                               pol,
 215                                               sid,
 216                                               &rights,
 217                                               &result);
 218         if (!NT_STATUS_IS_OK(status))
 219                 return status;
 220         if (!NT_STATUS_IS_OK(result))
 221                 return result;
 222
 223         if (rights.count == 0) {
 224                 d_printf(_("No privileges assigned\n"));
 225         }
 226
 227         for (i = 0; i < rights.count; i++) {
 228                 printf("%s\n", rights.names[i].string);
 229         }
 230
 231         return NT_STATUS_OK;
 232 }
 233
 234 /********************************************************************
 235 ********************************************************************/
 236
 237 static NTSTATUS enum_accounts_for_privilege(struct rpc_pipe_client *pipe_hnd,
 238                                                 TALLOC_CTX *ctx,
 239                                                 struct policy_handle *pol,
 240                                                 const char *privilege)
 241 {
 242         NTSTATUS status, result;
 243         uint32 enum_context=0;
 244         uint32 pref_max_length=0x1000;
 245         struct lsa_SidArray sid_array;
 246         int i;
 247         fstring name;
 248         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
 249
 250         status = dcerpc_lsa_EnumAccounts(b, ctx,
 251                                          pol,
 252                                          &enum_context,
 253                                          &sid_array,
 254                                          pref_max_length,
 255                                          &result);
 256         if (!NT_STATUS_IS_OK(status))
 257                 return status;
 258         if (!NT_STATUS_IS_OK(result))
 259                 return result;
 260
 261         d_printf("%s:\n", privilege);
 262
 263         for ( i=0; i<sid_array.num_sids; i++ ) {
 264
 265                 status = check_privilege_for_user(pipe_hnd, ctx, pol,
 266                                                   sid_array.sids[i].sid,
 267                                                   privilege);
 268
 269                 if ( ! NT_STATUS_IS_OK(status)) {
 270                         if ( ! NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
 271                                 return status;
 272                         }
 273                         continue;
 274                 }
 275
 276                 /* try to convert the SID to a name.  Fall back to
 277                    printing the raw SID if necessary */
 278                 status = sid_to_name( pipe_hnd, ctx, sid_array.sids[i].sid, name );
 279                 if ( !NT_STATUS_IS_OK (status) )
 280                         sid_to_fstring(name, sid_array.sids[i].sid);
 281
 282                 d_printf("  %s\n", name);
 283         }
 284
 285         return NT_STATUS_OK;
 286 }
 287
 288 /********************************************************************
 289 ********************************************************************/
 290
 291 static NTSTATUS enum_privileges_for_accounts(struct rpc_pipe_client *pipe_hnd,
 292                                                 TALLOC_CTX *ctx,
 293                                                 struct policy_handle *pol)
 294 {
 295         NTSTATUS status, result;
 296         uint32 enum_context=0;
 297         uint32 pref_max_length=0x1000;
 298         struct lsa_SidArray sid_array;
 299         int i;
 300         fstring name;
 301         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
 302
 303         status = dcerpc_lsa_EnumAccounts(b, ctx,
 304                                          pol,
 305                                          &enum_context,
 306                                          &sid_array,
 307                                          pref_max_length,
 308                                          &result);
 309         if (!NT_STATUS_IS_OK(status))
 310                 return status;
 311         if (!NT_STATUS_IS_OK(result))
 312                 return result;
 313
 314         for ( i=0; i<sid_array.num_sids; i++ ) {
 315
 316                 /* try to convert the SID to a name.  Fall back to
 317                    printing the raw SID if necessary */
 318
 319                 status = sid_to_name(pipe_hnd, ctx, sid_array.sids[i].sid, name);
 320                 if ( !NT_STATUS_IS_OK (status) )
 321                         sid_to_fstring(name, sid_array.sids[i].sid);
 322
 323                 d_printf("%s\n", name);
 324
 325                 status = enum_privileges_for_user(pipe_hnd, ctx, pol,
 326                                                   sid_array.sids[i].sid);
 327                 if ( !NT_STATUS_IS_OK(status) )
 328                         return status;
 329
 330                 d_printf("\n");
 331         }
 332
 333         return NT_STATUS_OK;
 334 }
 335
 336 /********************************************************************
 337 ********************************************************************/
 338
 339 static NTSTATUS rpc_rights_list_internal(struct net_context *c,
 340                                         const struct dom_sid *domain_sid,
 341                                         const char *domain_name,
 342                                         struct cli_state *cli,
 343                                         struct rpc_pipe_client *pipe_hnd,
 344                                         TALLOC_CTX *mem_ctx,
 345                                         int argc,
 346                                         const char **argv )
 347 {
 348         struct policy_handle pol;
 349         NTSTATUS status, result;
 350         struct dom_sid sid;
 351         fstring privname;
 352         struct lsa_String lsa_name;
 353         struct lsa_StringLarge *description = NULL;
 354         uint16 lang_id = 0;
 355         uint16 lang_id_sys = 0;
 356         uint16 lang_id_desc;
 357         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
 358
 359         status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
 360                 SEC_FLAG_MAXIMUM_ALLOWED, &pol);
 361
 362         if ( !NT_STATUS_IS_OK(status) )
 363                 return status;
 364
 365         /* backwards compatibility; just list available privileges if no arguement */
 366
 367         if (argc == 0) {
 368                 status = enum_privileges(pipe_hnd, mem_ctx, &pol );
 369                 goto done;
 370         }
 371
 372         if (strequal(argv[0], "privileges")) {
 373                 int i = 1;
 374
 375                 if (argv[1] == NULL) {
 376                         status = enum_privileges(pipe_hnd, mem_ctx, &pol );
 377                         goto done;
 378                 }
 379
 380                 while ( argv[i] != NULL ) {
 381                         fstrcpy(privname, argv[i]);
 382                         init_lsa_String(&lsa_name, argv[i]);
 383                         i++;
 384
 385                         /* verify that this is a valid privilege for error reporting */
 386                         status = dcerpc_lsa_LookupPrivDisplayName(b, mem_ctx,
 387                                                                   &pol,
 388                                                                   &lsa_name,
 389                                                                   lang_id,
 390                                                                   lang_id_sys,
 391                                                                   &description,
 392                                                                   &lang_id_desc,
 393                                                                   &result);
 394                         if (!NT_STATUS_IS_OK(status)) {
 395                                 continue;
 396                         }
 397                         status = result;
 398                         if ( !NT_STATUS_IS_OK(result) ) {
 399                                 if ( NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_PRIVILEGE))
 400                                         d_fprintf(stderr, _("No such privilege "
 401                                                   "exists: %s.\n"), privname);
 402                                 else
 403                                         d_fprintf(stderr, _("Error resolving "
 404                                                   "privilege display name "
 405                                                   "[%s].\n"),
 406                                                   nt_errstr(result));
 407                                 continue;
 408                         }
 409
 410                         status = enum_accounts_for_privilege(pipe_hnd, mem_ctx, &pol, privname);
 411                         if (!NT_STATUS_IS_OK(status)) {
 412                                 d_fprintf(stderr, _("Error enumerating "
 413                                           "accounts for privilege %s [%s].\n"),
 414                                           privname, nt_errstr(status));
 415                                 continue;
 416                         }
 417                 }
 418                 goto done;
 419         }
 420
 421         /* special case to enumerate all privileged SIDs with associated rights */
 422
 423         if (strequal( argv[0], "accounts")) {
 424                 int i = 1;
 425
 426                 if (argv[1] == NULL) {
 427                         status = enum_privileges_for_accounts(pipe_hnd, mem_ctx, &pol);
 428                         goto done;
 429                 }
 430
 431                 while (argv[i] != NULL) {
 432                         status = name_to_sid(pipe_hnd, mem_ctx, &sid, argv[i]);
 433                         if (!NT_STATUS_IS_OK(status)) {
 434                                 goto done;
 435                         }
 436                         status = enum_privileges_for_user(pipe_hnd, mem_ctx, &pol, &sid);
 437                         if (!NT_STATUS_IS_OK(status)) {
 438                                 goto done;
 439                         }
 440                         i++;
 441                 }
 442                 goto done;
 443         }
 444
 445         /* backward comaptibility: if no keyword provided, treat the key
 446            as an account name */
 447         if (argc > 1) {
 448                 d_printf("%s net rpc rights list [[accounts|privileges] "
 449                          "[name|SID]]\n", _("Usage:"));
 450                 status = NT_STATUS_OK;
 451                 goto done;
 452         }
 453
 454         status = name_to_sid(pipe_hnd, mem_ctx, &sid, argv[0]);
 455         if (!NT_STATUS_IS_OK(status)) {
 456                 goto done;
 457         }
 458         status = enum_privileges_for_user(pipe_hnd, mem_ctx, &pol, &sid );
 459
 460 done:
 461         dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
 462
 463         return status;
 464 }
 465
 466 /********************************************************************
 467 ********************************************************************/
 468
 469 static NTSTATUS rpc_rights_grant_internal(struct net_context *c,
 470                                         const struct dom_sid *domain_sid,
 471                                         const char *domain_name,
 472                                         struct cli_state *cli,
 473                                         struct rpc_pipe_client *pipe_hnd,
 474                                         TALLOC_CTX *mem_ctx,
 475                                         int argc,
 476                                         const char **argv )
 477 {
 478         struct policy_handle dom_pol;
 479         NTSTATUS status, result;
 480         struct lsa_RightSet rights;
 481         int i;
 482         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
 483
 484         struct dom_sid sid;
 485
 486         if (argc < 2 ) {
 487                 d_printf("%s\n%s",
 488                          _("Usage:"),
 489                          _(" net rpc rights grant <name|SID> <rights...>\n"));
 490                 return NT_STATUS_OK;
 491         }
 492
 493         status = name_to_sid(pipe_hnd, mem_ctx, &sid, argv[0]);
 494         if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED))
 495                 status = NT_STATUS_NO_SUCH_USER;
 496
 497         if (!NT_STATUS_IS_OK(status))
 498                 goto done;
 499
 500         status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, true,
 501                                      SEC_FLAG_MAXIMUM_ALLOWED,
 502                                      &dom_pol);
 503
 504         if (!NT_STATUS_IS_OK(status))
 505                 return status;
 506
 507         rights.count = argc-1;
 508         rights.names = TALLOC_ARRAY(mem_ctx, struct lsa_StringLarge,
 509                                     rights.count);
 510         if (!rights.names) {
 511                 return NT_STATUS_NO_MEMORY;
 512         }
 513
 514         for (i=0; i<argc-1; i++) {
 515                 init_lsa_StringLarge(&rights.names[i], argv[i+1]);
 516         }
 517
 518         status = dcerpc_lsa_AddAccountRights(b, mem_ctx,
 519                                              &dom_pol,
 520                                              &sid,
 521                                              &rights,
 522                                              &result);
 523         if (!NT_STATUS_IS_OK(status))
 524                 goto done;
 525         if (!NT_STATUS_IS_OK(result)) {
 526                 status = result;
 527                 goto done;
 528         }
 529
 530         d_printf(_("Successfully granted rights.\n"));
 531
 532  done:
 533         if ( !NT_STATUS_IS_OK(status) ) {
 534                 d_fprintf(stderr, _("Failed to grant privileges for %s (%s)\n"),
 535                         argv[0], nt_errstr(status));
 536         }
 537
 538         dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
 539
 540         return status;
 541 }
 542
 543 /********************************************************************
 544 ********************************************************************/
 545
 546 static NTSTATUS rpc_rights_revoke_internal(struct net_context *c,
 547                                         const struct dom_sid *domain_sid,
 548                                         const char *domain_name,
 549                                         struct cli_state *cli,
 550                                         struct rpc_pipe_client *pipe_hnd,
 551                                         TALLOC_CTX *mem_ctx,
 552                                         int argc,
 553                                         const char **argv )
 554 {
 555         struct policy_handle dom_pol;
 556         NTSTATUS status, result;
 557         struct lsa_RightSet rights;
 558         struct dom_sid sid;
 559         int i;
 560         struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
 561
 562         if (argc < 2 ) {
 563                 d_printf("%s\n%s",
 564                          _("Usage:"),
 565                          _(" net rpc rights revoke <name|SID> <rights...>\n"));
 566                 return NT_STATUS_OK;
 567         }
 568
 569         status = name_to_sid(pipe_hnd, mem_ctx, &sid, argv[0]);
 570         if (!NT_STATUS_IS_OK(status))
 571                 return status;
 572
 573         status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, true,
 574                                      SEC_FLAG_MAXIMUM_ALLOWED,
 575                                      &dom_pol);
 576
 577         if (!NT_STATUS_IS_OK(status))
 578                 return status;
 579
 580         rights.count = argc-1;
 581         rights.names = TALLOC_ARRAY(mem_ctx, struct lsa_StringLarge,
 582                                     rights.count);
 583         if (!rights.names) {
 584                 return NT_STATUS_NO_MEMORY;
 585         }
 586
 587         for (i=0; i<argc-1; i++) {
 588                 init_lsa_StringLarge(&rights.names[i], argv[i+1]);
 589         }
 590
 591         status = dcerpc_lsa_RemoveAccountRights(b, mem_ctx,
 592                                                 &dom_pol,
 593                                                 &sid,
 594                                                 false,
 595                                                 &rights,
 596                                                 &result);
 597         if (!NT_STATUS_IS_OK(status))
 598                 goto done;
 599         if (!NT_STATUS_IS_OK(result)) {
 600                 status = result;
 601                 goto done;
 602         }
 603
 604         d_printf(_("Successfully revoked rights.\n"));
 605
 606 done:
 607         if ( !NT_STATUS_IS_OK(status) ) {
 608                 d_fprintf(stderr,_("Failed to revoke privileges for %s (%s)\n"),
 609                         argv[0], nt_errstr(status));
 610         }
 611
 612         dcerpc_lsa_Close(b, mem_ctx, &dom_pol, &result);
 613
 614         return status;
 615 }
 616
 617
 618 /********************************************************************
 619 ********************************************************************/
 620
 621 static int rpc_rights_list(struct net_context *c, int argc, const char **argv )
 622 {
 623         if (c->display_usage) {
 624                 d_printf("%s\n%s",
 625                          _("Usage:"),
 626                          _("net rpc rights list [{accounts|privileges} "
 627                            "[name|SID]]\n"
 628                            "    View available/assigned privileges\n"));
 629                 return 0;
 630         }
 631
 632         return run_rpc_command(c, NULL, &ndr_table_lsarpc.syntax_id, 0,
 633                 rpc_rights_list_internal, argc, argv );
 634 }
 635
 636 /********************************************************************
 637 ********************************************************************/
 638
 639 static int rpc_rights_grant(struct net_context *c, int argc, const char **argv )
 640 {
 641         if (c->display_usage) {
 642                 d_printf("%s\n%s",
 643                          _("Usage:"),
 644                          _("net rpc rights grant <name|SID> <right>\n"
 645                            "    Assign privilege[s]\n"));
 646                 d_printf(_("For example:\n"
 647                            "    net rpc rights grant 'VALE\\biddle' "
 648                            "SePrintOperatorPrivilege SeDiskOperatorPrivilege\n"
 649                            "    would grant the printer admin and disk manager "
 650                            "rights to the user 'VALE\\biddle'\n"));
 651                 return 0;
 652         }
 653
 654         return run_rpc_command(c, NULL, &ndr_table_lsarpc.syntax_id, 0,
 655                 rpc_rights_grant_internal, argc, argv );
 656 }
 657
 658 /********************************************************************
 659 ********************************************************************/
 660
 661 static int rpc_rights_revoke(struct net_context *c, int argc, const char **argv)
 662 {
 663         if (c->display_usage) {
 664                 d_printf("%s\n%s",
 665                          _("Usage:"),
 666                          _("net rpc rights revoke <name|SID> <right>\n"
 667                            "    Revoke privilege[s]\n"));
 668                 d_printf(_("For example:\n"
 669                            "    net rpc rights revoke 'VALE\\biddle' "
 670                            "SePrintOperatorPrivilege SeDiskOperatorPrivilege\n"
 671                            "    would revoke the printer admin and disk manager"
 672                            " rights from the user 'VALE\\biddle'\n"));
 673                 return 0;
 674         }
 675
 676         return run_rpc_command(c, NULL, &ndr_table_lsarpc.syntax_id, 0,
 677                 rpc_rights_revoke_internal, argc, argv );
 678 }
 679
 680 /********************************************************************
 681 ********************************************************************/
 682
 683 int net_rpc_rights(struct net_context *c, int argc, const char **argv)
 684 {
 685         struct functable func[] = {
 686                 {
 687                         "list",
 688                         rpc_rights_list,
 689                         NET_TRANSPORT_RPC,
 690                         N_("View available/assigned privileges"),
 691                         N_("net rpc rights list\n"
 692                            "    View available/assigned privileges")
 693                 },
 694                 {
 695                         "grant",
 696                         rpc_rights_grant,
 697                         NET_TRANSPORT_RPC,
 698                         N_("Assign privilege[s]"),
 699                         N_("net rpc rights grant\n"
 700                            "    Assign privilege[s]")
 701                 },
 702                 {
 703                         "revoke",
 704                         rpc_rights_revoke,
 705                         NET_TRANSPORT_RPC,
 706                         N_("Revoke privilege[s]"),
 707                         N_("net rpc rights revoke\n"
 708                            "    Revoke privilege[s]")
 709                 },
 710                 {NULL, NULL, 0, NULL, NULL}
 711         };
 712
 713         return net_run_function(c, argc, argv, "net rpc rights", func);
 714 }
 715
 716 static NTSTATUS rpc_sh_rights_list(struct net_context *c,
 717                                    TALLOC_CTX *mem_ctx, struct rpc_sh_ctx *ctx,
 718                                    struct rpc_pipe_client *pipe_hnd,
 719                                    int argc, const char **argv)
 720 {
 721         return rpc_rights_list_internal(c, ctx->domain_sid, ctx->domain_name,
 722                                         ctx->cli, pipe_hnd, mem_ctx,
 723                                         argc, argv);
 724 }
 725
 726 static NTSTATUS rpc_sh_rights_grant(struct net_context *c,
 727                                     TALLOC_CTX *mem_ctx,
 728                                     struct rpc_sh_ctx *ctx,
 729                                     struct rpc_pipe_client *pipe_hnd,
 730                                     int argc, const char **argv)
 731 {
 732         return rpc_rights_grant_internal(c, ctx->domain_sid, ctx->domain_name,
 733                                          ctx->cli, pipe_hnd, mem_ctx,
 734                                          argc, argv);
 735 }
 736
 737 static NTSTATUS rpc_sh_rights_revoke(struct net_context *c,
 738                                      TALLOC_CTX *mem_ctx,
 739                                      struct rpc_sh_ctx *ctx,
 740                                      struct rpc_pipe_client *pipe_hnd,
 741                                      int argc, const char **argv)
 742 {
 743         return rpc_rights_revoke_internal(c, ctx->domain_sid, ctx->domain_name,
 744                                           ctx->cli, pipe_hnd, mem_ctx,
 745                                           argc, argv);
 746 }
 747
 748 struct rpc_sh_cmd *net_rpc_rights_cmds(struct net_context *c, TALLOC_CTX *mem_ctx,
 749                                        struct rpc_sh_ctx *ctx)
 750 {
 751         static struct rpc_sh_cmd cmds[] = {
 752
 753         { "list", NULL, &ndr_table_lsarpc.syntax_id, rpc_sh_rights_list,
 754           N_("View available or assigned privileges") },
 755
 756         { "grant", NULL, &ndr_table_lsarpc.syntax_id, rpc_sh_rights_grant,
 757           N_("Assign privilege[s]") },
 758
 759         { "revoke", NULL, &ndr_table_lsarpc.syntax_id, rpc_sh_rights_revoke,
 760           N_("Revoke privilege[s]") },
 761
 762         { NULL, NULL, 0, NULL, NULL }
 763         };
 764
 765         return cmds;
 766 }
 767