r5056: * correct STANDARD_RIGHTS_WRITE_ACCESS bitmask define

* make sure to apply the rights_mask and not just the saved
  bits from the mask in access_check_samr_object()
* allow root to grant/revoke privileges (in addition to Domain
  Admins) as suggested by Volker.

Tested machine joins from XP, 2K, and NT4 with and without
pre-existing machine trust accounts.  Also tested basic file
operations using cmd.exe and explorer.exe after changing the
STANDARD_RIGHTS_WRITE_ACCESS bitmask.
(This used to be commit c0e7f7ff60a4110809b8f500fdc68a1bf963da36)

diff --git a/source3/include/rpc_lsa.h b/source3/include/rpc_lsa.h
index a2bc72d2b2e16fe0da5ea352bd26ac174a75eca5..c0425271b3230d8ceef6db291f69b6683abfc41b 100644 (file)
--- a/source3/include/rpc_lsa.h
+++ b/source3/include/rpc_lsa.h
@@ -207,7 +207,7 @@ typedef struct lsa_r_open_pol2_info
                             POLICY_VIEW_AUDIT_INFORMATION    |\
                             POLICY_GET_PRIVATE_INFORMATION)
 
-#define POLICY_WRITE      ( STANDARD_RIGHTS_WRITE_ACCESS     |\
+#define POLICY_WRITE      ( STD_RIGHT_READ_CONTROL_ACCESS     |\
                             POLICY_TRUST_ADMIN               |\
                             POLICY_CREATE_ACCOUNT            |\
                             POLICY_CREATE_SECRET             |\

diff --git a/source3/include/rpc_secdes.h b/source3/include/rpc_secdes.h
index 1279007220cff85b8aeefddfa5d466fda9bbe72d..3e4c47dce9a06622a8b3dfc37f93d01a126b48a9 100644 (file)
--- a/source3/include/rpc_secdes.h
+++ b/source3/include/rpc_secdes.h
@@ -251,7 +251,10 @@ typedef struct standard_mapping {
 #define STANDARD_RIGHTS_ALL_ACCESS     STD_RIGHT_ALL_ACCESS /* 0x001f0000 */
 #define STANDARD_RIGHTS_EXECUTE_ACCESS STD_RIGHT_READ_CONTROL_ACCESS /* 0x00020000 */
 #define STANDARD_RIGHTS_READ_ACCESS    STD_RIGHT_READ_CONTROL_ACCESS /* 0x00020000 */
-#define STANDARD_RIGHTS_WRITE_ACCESS   STD_RIGHT_READ_CONTROL_ACCESS /* 0x00020000 */
+#define STANDARD_RIGHTS_WRITE_ACCESS \
+               (STD_RIGHT_WRITE_OWNER_ACCESS   | \
+                STD_RIGHT_WRITE_DAC_ACCESS     | \
+                STD_RIGHT_DELETE_ACCESS)       /* 0x000d0000 */
 #define STANDARD_RIGHTS_REQUIRED_ACCESS \
                (STD_RIGHT_DELETE_ACCESS        | \
                STD_RIGHT_READ_CONTROL_ACCESS   | \

diff --git a/source3/include/smb.h b/source3/include/smb.h
index 913061014dbca17325af0aeb2aa73804a5e07dc7..c89469537854808b46a2ee1973a0a78d50ab2e97 100644 (file)
--- a/source3/include/smb.h
+++ b/source3/include/smb.h
@@ -1069,7 +1069,7 @@ struct bitmap {
 #define FILE_GENERIC_READ (STANDARD_RIGHTS_READ_ACCESS|FILE_READ_DATA|FILE_READ_ATTRIBUTES|\
                                                        FILE_READ_EA|SYNCHRONIZE_ACCESS)
 
-#define FILE_GENERIC_WRITE (STANDARD_RIGHTS_WRITE_ACCESS|FILE_WRITE_DATA|FILE_WRITE_ATTRIBUTES|\
+#define FILE_GENERIC_WRITE (STD_RIGHT_READ_CONTROL_ACCESS|FILE_WRITE_DATA|FILE_WRITE_ATTRIBUTES|\
                                                        FILE_WRITE_EA|FILE_APPEND_DATA|SYNCHRONIZE_ACCESS)
 
 #define FILE_GENERIC_EXECUTE (STANDARD_RIGHTS_EXECUTE_ACCESS|\

diff --git a/source3/rpc_server/srv_lsa_nt.c b/source3/rpc_server/srv_lsa_nt.c
index 13053d9877b67652705f2ff92f69ccd5b68be290..da00d2d6c4386172a129b4003c2eb215de6540ce 100644 (file)
--- a/source3/rpc_server/srv_lsa_nt.c
+++ b/source3/rpc_server/srv_lsa_nt.c
@@ -1134,16 +1134,21 @@ NTSTATUS _lsa_addprivs(pipes_struct *p, LSA_Q_ADDPRIVS *q_u, LSA_R_ADDPRIVS *r_u
        struct lsa_info *info = NULL;
        SE_PRIV mask;
        PRIVILEGE_SET *set = NULL;
+       struct current_user user;
 
        /* find the connection policy handle. */
        if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
                return NT_STATUS_INVALID_HANDLE;
                
-       /* check to see if the pipe_user is a Domain Admin since 
+       /* check to see if the pipe_user is root or a Domain Admin since 
           account_pol.tdb was already opened as root, this is all we have */
-          
-       if ( !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
+
+       get_current_user( &user, p );
+       if ( user.uid != sec_initial_uid() 
+               && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
+       {
                return NT_STATUS_ACCESS_DENIED;
+       }
 
        set = &q_u->set;
 
@@ -1170,16 +1175,21 @@ NTSTATUS _lsa_removeprivs(pipes_struct *p, LSA_Q_REMOVEPRIVS *q_u, LSA_R_REMOVEP
        struct lsa_info *info = NULL;
        SE_PRIV mask;
        PRIVILEGE_SET *set = NULL;
+       struct current_user user;
 
        /* find the connection policy handle. */
        if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
                return NT_STATUS_INVALID_HANDLE;
 
-       /* check to see if the pipe_user is a Domain Admin since 
+       /* check to see if the pipe_user is root or a Domain Admin since 
           account_pol.tdb was already opened as root, this is all we have */
-          
-       if ( !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
+
+       get_current_user( &user, p );
+       if ( user.uid != sec_initial_uid()
+               && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) ) 
+       {
                return NT_STATUS_ACCESS_DENIED;
+       }
 
        set = &q_u->set;
 

diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c
index 43abfdaafa19a6ae5ec2bf8d76e89e2dba9fa727..4d8e2b51cc5ce0bf76cc44a1fce514fd1eed821d 100644 (file)
--- a/source3/rpc_server/srv_samr_nt.c
+++ b/source3/rpc_server/srv_samr_nt.c
@@ -270,8 +270,8 @@ static NTSTATUS access_check_samr_object( SEC_DESC *psd, NT_USER_TOKEN *token,
                saved_mask = (des_access & rights_mask);
                des_access &= ~saved_mask;
                
-               DEBUG(4,("access_check_samr_object: user rights saved access mask [0x%x]\n",
-                       saved_mask));
+               DEBUG(4,("access_check_samr_object: user rights access mask [0x%x]\n",
+                       rights_mask));
        }
                
        
@@ -296,9 +296,9 @@ static NTSTATUS access_check_samr_object( SEC_DESC *psd, NT_USER_TOKEN *token,
        
 done:
        /* add in any bits saved during the privilege check (only 
-          matters is syayus is ok) */
+          matters is status is ok) */
        
-       *acc_granted |= saved_mask;
+       *acc_granted |= rights_mask;
 
        DEBUG(4,("%s: access %s (requested: 0x%08x, granted: 0x%08x)\n", 
                debug, NT_STATUS_IS_OK(status) ? "GRANTED" : "DENIED",