source/rpc_server/srv_samr_nt.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1997,
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
   6  *  Copyright (C) Paul Ashton                       1997,
   7  *  Copyright (C) Marc Jacobsen                     1999,
   8  *  Copyright (C) Jeremy Allison               2001-2002,
   9  *  Copyright (C) Jean François Micouleau      1998-2001,
  10  *  Copyright (C) Jim McDonough <jmcd@us.ibm.com>   2002.
  11  *  Copyright (C) Gerald (Jerry) Carter             2003.
  12  *
  13  *  This program is free software; you can redistribute it and/or modify
  14  *  it under the terms of the GNU General Public License as published by
  15  *  the Free Software Foundation; either version 2 of the License, or
  16  *  (at your option) any later version.
  17  *
  18  *  This program is distributed in the hope that it will be useful,
  19  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  *  GNU General Public License for more details.
  22  *
  23  *  You should have received a copy of the GNU General Public License
  24  *  along with this program; if not, write to the Free Software
  25  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  26  */
  27
  28 /*
  29  * This is the implementation of the SAMR code.
  30  */
  31
  32 #include "includes.h"
  33
  34 #undef DBGC_CLASS
  35 #define DBGC_CLASS DBGC_RPC_SRV
  36
  37 extern DOM_SID global_sid_Builtin;
  38
  39 extern rid_name domain_group_rids[];
  40 extern rid_name domain_alias_rids[];
  41 extern rid_name builtin_alias_rids[];
  42
  43
  44 typedef struct _disp_info {
  45         BOOL user_dbloaded;
  46         uint32 num_user_account;
  47         SAM_ACCOUNT *disp_user_info;
  48         BOOL group_dbloaded;
  49         uint32 num_group_account;
  50         DOMAIN_GRP *disp_group_info;
  51 } DISP_INFO;
  52
  53 struct samr_info {
  54         /* for use by the \PIPE\samr policy */
  55         DOM_SID sid;
  56         uint32 status; /* some sort of flag.  best to record it.  comes from opnum 0x39 */
  57         uint32 acc_granted;
  58         uint16 acb_mask;
  59         BOOL all_machines;
  60         DISP_INFO disp_info;
  61
  62         TALLOC_CTX *mem_ctx;
  63 };
  64
  65 struct generic_mapping sam_generic_mapping = {GENERIC_RIGHTS_SAM_READ, GENERIC_RIGHTS_SAM_WRITE, GENERIC_RIGHTS_SAM_EXECUTE, GENERIC_RIGHTS_SAM_ALL_ACCESS};
  66 struct generic_mapping dom_generic_mapping = {GENERIC_RIGHTS_DOMAIN_READ, GENERIC_RIGHTS_DOMAIN_WRITE, GENERIC_RIGHTS_DOMAIN_EXECUTE, GENERIC_RIGHTS_DOMAIN_ALL_ACCESS};
  67 struct generic_mapping usr_generic_mapping = {GENERIC_RIGHTS_USER_READ, GENERIC_RIGHTS_USER_WRITE, GENERIC_RIGHTS_USER_EXECUTE, GENERIC_RIGHTS_USER_ALL_ACCESS};
  68 struct generic_mapping grp_generic_mapping = {GENERIC_RIGHTS_GROUP_READ, GENERIC_RIGHTS_GROUP_WRITE, GENERIC_RIGHTS_GROUP_EXECUTE, GENERIC_RIGHTS_GROUP_ALL_ACCESS};
  69 struct generic_mapping ali_generic_mapping = {GENERIC_RIGHTS_ALIAS_READ, GENERIC_RIGHTS_ALIAS_WRITE, GENERIC_RIGHTS_ALIAS_EXECUTE, GENERIC_RIGHTS_ALIAS_ALL_ACCESS};
  70
  71 static NTSTATUS samr_make_dom_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size);
  72
  73 /*******************************************************************
  74  Checks if access to an object should be granted, and returns that
  75  level of access for further checks.
  76 ********************************************************************/
  77
  78 NTSTATUS access_check_samr_object(SEC_DESC *psd, NT_USER_TOKEN *nt_user_token, uint32 des_access,
  79                                   uint32 *acc_granted, const char *debug)
  80 {
  81         NTSTATUS status = NT_STATUS_ACCESS_DENIED;
  82
  83         if (!se_access_check(psd, nt_user_token, des_access, acc_granted, &status)) {
  84                 *acc_granted = des_access;
  85                 if (geteuid() == sec_initial_uid()) {
  86                         DEBUG(4,("%s: ACCESS should be DENIED  (requested: %#010x)\n",
  87                                 debug, des_access));
  88                         DEBUGADD(4,("but overritten by euid == sec_initial_uid()\n"));
  89                         status = NT_STATUS_OK;
  90                 }
  91                 else {
  92                         DEBUG(2,("%s: ACCESS DENIED  (requested: %#010x)\n",
  93                                 debug, des_access));
  94                 }
  95         }
  96         return status;
  97 }
  98
  99 /*******************************************************************
 100  Checks if access to a function can be granted
 101 ********************************************************************/
 102
 103 NTSTATUS access_check_samr_function(uint32 acc_granted, uint32 acc_required, const char *debug)
 104 {
 105         DEBUG(5,("%s: access check ((granted: %#010x;  required: %#010x)\n",
 106                         debug, acc_granted, acc_required));
 107         if ((acc_granted & acc_required) != acc_required) {
 108                 if (geteuid() == sec_initial_uid()) {
 109                         DEBUG(4,("%s: ACCESS should be DENIED (granted: %#010x;  required: %#010x)\n",
 110                                 debug, acc_granted, acc_required));
 111                         DEBUGADD(4,("but overwritten by euid == 0\n"));
 112                         return NT_STATUS_OK;
 113                 }
 114                 DEBUG(2,("%s: ACCESS DENIED (granted: %#010x;  required: %#010x)\n",
 115                         debug, acc_granted, acc_required));
 116                 return NT_STATUS_ACCESS_DENIED;
 117         }
 118         return NT_STATUS_OK;
 119 }
 120
 121
 122 /*******************************************************************
 123  Create a samr_info struct.
 124 ********************************************************************/
 125
 126 static struct samr_info *get_samr_info_by_sid(DOM_SID *psid)
 127 {
 128         struct samr_info *info;
 129         fstring sid_str;
 130         TALLOC_CTX *mem_ctx;
 131
 132         if (psid) {
 133                 sid_to_string(sid_str, psid);
 134         } else {
 135                 fstrcpy(sid_str,"(NULL)");
 136         }
 137
 138         mem_ctx = talloc_init("samr_info for domain sid %s", sid_str);
 139
 140         if ((info = (struct samr_info *)talloc(mem_ctx, sizeof(struct samr_info))) == NULL)
 141                 return NULL;
 142
 143         ZERO_STRUCTP(info);
 144         DEBUG(10,("get_samr_info_by_sid: created new info for sid %s\n", sid_str));
 145         if (psid) {
 146                 sid_copy( &info->sid, psid);
 147         } else {
 148                 DEBUG(10,("get_samr_info_by_sid: created new info for NULL sid.\n"));
 149         }
 150         info->mem_ctx = mem_ctx;
 151         return info;
 152 }
 153
 154 /*******************************************************************
 155  Function to free the per handle data.
 156  ********************************************************************/
 157
 158 static void free_samr_users(struct samr_info *info)
 159 {
 160         int i;
 161
 162         if (info->disp_info.user_dbloaded){
 163                 for (i=0; i<info->disp_info.num_user_account; i++) {
 164                         SAM_ACCOUNT *sam = &info->disp_info.disp_user_info[i];
 165                         /* Not really a free, actually a 'clear' */
 166                         pdb_free_sam(&sam);
 167                 }
 168         }
 169         info->disp_info.user_dbloaded=False;
 170         info->disp_info.num_user_account=0;
 171 }
 172
 173 /*******************************************************************
 174  Function to free the per handle data.
 175  ********************************************************************/
 176
 177 static void free_samr_db(struct samr_info *info)
 178 {
 179         /* Groups are talloced */
 180
 181         free_samr_users(info);
 182
 183         info->disp_info.group_dbloaded=False;
 184         info->disp_info.num_group_account=0;
 185 }
 186
 187 static void free_samr_info(void *ptr)
 188 {
 189         struct samr_info *info=(struct samr_info *) ptr;
 190
 191         free_samr_db(info);
 192         talloc_destroy(info->mem_ctx);
 193 }
 194
 195 /*******************************************************************
 196  Ensure password info is never given out. Paranioa... JRA.
 197  ********************************************************************/
 198
 199 static void samr_clear_sam_passwd(SAM_ACCOUNT *sam_pass)
 200 {
 201
 202         if (!sam_pass)
 203                 return;
 204
 205         /* These now zero out the old password */
 206
 207         pdb_set_lanman_passwd(sam_pass, NULL, PDB_DEFAULT);
 208         pdb_set_nt_passwd(sam_pass, NULL, PDB_DEFAULT);
 209 }
 210
 211
 212 static NTSTATUS load_sampwd_entries(struct samr_info *info, uint16 acb_mask, BOOL all_machines)
 213 {
 214         SAM_ACCOUNT *pwd = NULL;
 215         SAM_ACCOUNT *pwd_array = NULL;
 216         NTSTATUS nt_status = NT_STATUS_OK;
 217         TALLOC_CTX *mem_ctx = info->mem_ctx;
 218
 219         DEBUG(10,("load_sampwd_entries\n"));
 220
 221         /* if the snapshoot is already loaded, return */
 222         if ((info->disp_info.user_dbloaded==True)
 223             && (info->acb_mask == acb_mask)
 224             && (info->all_machines == all_machines)) {
 225                 DEBUG(10,("load_sampwd_entries: already in memory\n"));
 226                 return NT_STATUS_OK;
 227         }
 228
 229         free_samr_users(info);
 230
 231         if (!pdb_setsampwent(False)) {
 232                 DEBUG(0, ("load_sampwd_entries: Unable to open passdb.\n"));
 233                 return NT_STATUS_ACCESS_DENIED;
 234         }
 235
 236         for (; (NT_STATUS_IS_OK(nt_status = pdb_init_sam_talloc(mem_ctx, &pwd)))
 237                      && pdb_getsampwent(pwd) == True; pwd=NULL) {
 238
 239                 if (all_machines) {
 240                         if (!((pdb_get_acct_ctrl(pwd) & ACB_WSTRUST)
 241                               || (pdb_get_acct_ctrl(pwd) & ACB_SVRTRUST))) {
 242                                 DEBUG(5,("load_sampwd_entries: '%s' is not a machine account - ACB: %x - skipping\n", pdb_get_username(pwd), acb_mask));
 243                                 pdb_free_sam(&pwd);
 244                                 continue;
 245                         }
 246                 } else {
 247                         if (acb_mask != 0 && !(pdb_get_acct_ctrl(pwd) & acb_mask)) {
 248                                 pdb_free_sam(&pwd);
 249                                 DEBUG(5,(" acb_mask %x reject\n", acb_mask));
 250                                 continue;
 251                         }
 252                 }
 253
 254                 /* Realloc some memory for the array of ptr to the SAM_ACCOUNT structs */
 255                 if (info->disp_info.num_user_account % MAX_SAM_ENTRIES == 0) {
 256
 257                         DEBUG(10,("load_sampwd_entries: allocating more memory\n"));
 258                         pwd_array=(SAM_ACCOUNT *)talloc_realloc(mem_ctx, info->disp_info.disp_user_info,
 259                                           (info->disp_info.num_user_account+MAX_SAM_ENTRIES)*sizeof(SAM_ACCOUNT));
 260
 261                         if (pwd_array==NULL)
 262                                 return NT_STATUS_NO_MEMORY;
 263
 264                         info->disp_info.disp_user_info=pwd_array;
 265                 }
 266
 267                 /* Copy the SAM_ACCOUNT into the array */
 268                 info->disp_info.disp_user_info[info->disp_info.num_user_account]=*pwd;
 269
 270                 DEBUG(10,("load_sampwd_entries: entry: %d\n", info->disp_info.num_user_account));
 271
 272                 info->disp_info.num_user_account++;
 273         }
 274
 275         pdb_endsampwent();
 276
 277         /* the snapshoot is in memory, we're ready to enumerate fast */
 278
 279         info->acb_mask = acb_mask;
 280         info->all_machines = all_machines;
 281         info->disp_info.user_dbloaded=True;
 282
 283         DEBUG(10,("load_sampwd_entries: done\n"));
 284
 285         return nt_status;
 286 }
 287
 288 static NTSTATUS load_group_domain_entries(struct samr_info *info, DOM_SID *sid)
 289 {
 290         GROUP_MAP *map=NULL;
 291         DOMAIN_GRP *grp_array = NULL;
 292         uint32 group_entries = 0;
 293         uint32 i;
 294         TALLOC_CTX *mem_ctx = info->mem_ctx;
 295
 296         DEBUG(10,("load_group_domain_entries\n"));
 297
 298         /* if the snapshoot is already loaded, return */
 299         if (info->disp_info.group_dbloaded==True) {
 300                 DEBUG(10,("load_group_domain_entries: already in memory\n"));
 301                 return NT_STATUS_OK;
 302         }
 303
 304
 305         become_root();
 306
 307         if (!pdb_enum_group_mapping(SID_NAME_DOM_GRP, &map, (int *)&group_entries, ENUM_ONLY_MAPPED)) {
 308                 DEBUG(1, ("load_group_domain_entries: pdb_enum_group_mapping() failed!\n"));
 309                 return NT_STATUS_NO_MEMORY;
 310         }
 311
 312         unbecome_root();
 313
 314         info->disp_info.num_group_account=group_entries;
 315
 316         grp_array=(DOMAIN_GRP *)talloc(mem_ctx, info->disp_info.num_group_account*sizeof(DOMAIN_GRP));
 317         if (group_entries!=0 && grp_array==NULL) {
 318                 DEBUG(1, ("load_group_domain_entries: talloc() failed for grp_array!\n"));
 319                 SAFE_FREE(map);
 320                 return NT_STATUS_NO_MEMORY;
 321         }
 322
 323         info->disp_info.disp_group_info=grp_array;
 324
 325         for (i=0; i<group_entries; i++) {
 326                 fstrcpy(grp_array[i].name, map[i].nt_name);
 327                 fstrcpy(grp_array[i].comment, map[i].comment);
 328                 sid_split_rid(&map[i].sid, &grp_array[i].rid);
 329                 grp_array[i].attr=SID_NAME_DOM_GRP;
 330         }
 331
 332         SAFE_FREE(map);
 333
 334         /* the snapshoot is in memory, we're ready to enumerate fast */
 335
 336         info->disp_info.group_dbloaded=True;
 337
 338         DEBUG(10,("load_group_domain_entries: done\n"));
 339
 340         return NT_STATUS_OK;
 341 }
 342
 343
 344 /*******************************************************************
 345  _samr_close_hnd
 346  ********************************************************************/
 347
 348 NTSTATUS _samr_close_hnd(pipes_struct *p, SAMR_Q_CLOSE_HND *q_u, SAMR_R_CLOSE_HND *r_u)
 349 {
 350         r_u->status = NT_STATUS_OK;
 351
 352         /* close the policy handle */
 353         if (!close_policy_hnd(p, &q_u->pol))
 354                 return NT_STATUS_OBJECT_NAME_INVALID;
 355
 356         DEBUG(5,("samr_reply_close_hnd: %d\n", __LINE__));
 357
 358         return r_u->status;
 359 }
 360
 361 /*******************************************************************
 362  samr_reply_open_domain
 363  ********************************************************************/
 364
 365 NTSTATUS _samr_open_domain(pipes_struct *p, SAMR_Q_OPEN_DOMAIN *q_u, SAMR_R_OPEN_DOMAIN *r_u)
 366 {
 367         struct    samr_info *info;
 368         SEC_DESC *psd = NULL;
 369         uint32    acc_granted;
 370         uint32    des_access = q_u->flags;
 371         size_t    sd_size;
 372         NTSTATUS  status;
 373
 374         r_u->status = NT_STATUS_OK;
 375
 376         /* find the connection policy handle. */
 377         if (!find_policy_by_hnd(p, &q_u->pol, (void**)&info))
 378                 return NT_STATUS_INVALID_HANDLE;
 379
 380         if (!NT_STATUS_IS_OK(status = access_check_samr_function(info->acc_granted, SA_RIGHT_SAM_OPEN_DOMAIN,"_samr_open_domain"))) {
 381                 return status;
 382         }
 383
 384         /*check if access can be granted as requested by client. */
 385         samr_make_dom_obj_sd(p->mem_ctx, &psd, &sd_size);
 386         se_map_generic(&des_access,&dom_generic_mapping);
 387
 388         if (!NT_STATUS_IS_OK(status =
 389                              access_check_samr_object(psd, p->pipe_user.nt_user_token,
 390                                                       des_access, &acc_granted, "_samr_open_domain"))) {
 391                 return status;
 392         }
 393
 394         /* associate the domain SID with the (unique) handle. */
 395         if ((info = get_samr_info_by_sid(&q_u->dom_sid.sid))==NULL)
 396                 return NT_STATUS_NO_MEMORY;
 397         info->acc_granted = acc_granted;
 398
 399         /* get a (unique) handle.  open a policy on it. */
 400         if (!create_policy_hnd(p, &r_u->domain_pol, free_samr_info, (void *)info))
 401                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 402
 403         DEBUG(5,("samr_open_domain: %d\n", __LINE__));
 404
 405         return r_u->status;
 406 }
 407
 408 /*******************************************************************
 409  _samr_get_usrdom_pwinfo
 410  ********************************************************************/
 411
 412 NTSTATUS _samr_get_usrdom_pwinfo(pipes_struct *p, SAMR_Q_GET_USRDOM_PWINFO *q_u, SAMR_R_GET_USRDOM_PWINFO *r_u)
 413 {
 414         struct samr_info *info = NULL;
 415
 416         r_u->status = NT_STATUS_OK;
 417
 418         /* find the policy handle.  open a policy on it. */
 419         if (!find_policy_by_hnd(p, &q_u->user_pol, (void **)&info))
 420                 return NT_STATUS_INVALID_HANDLE;
 421
 422         if (!sid_check_is_in_our_domain(&info->sid))
 423                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
 424
 425         init_samr_r_get_usrdom_pwinfo(r_u, NT_STATUS_OK);
 426
 427         DEBUG(5,("_samr_get_usrdom_pwinfo: %d\n", __LINE__));
 428
 429         /*
 430          * NT sometimes return NT_STATUS_ACCESS_DENIED
 431          * I don't know yet why.
 432          */
 433
 434         return r_u->status;
 435 }
 436
 437 /*******************************************************************
 438  samr_make_dom_obj_sd
 439  ********************************************************************/
 440
 441 static NTSTATUS samr_make_dom_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size)
 442 {
 443         extern DOM_SID global_sid_World;
 444         DOM_SID adm_sid;
 445         DOM_SID act_sid;
 446
 447         SEC_ACE ace[3];
 448         SEC_ACCESS mask;
 449
 450         SEC_ACL *psa = NULL;
 451
 452         sid_copy(&adm_sid, &global_sid_Builtin);
 453         sid_append_rid(&adm_sid, BUILTIN_ALIAS_RID_ADMINS);
 454
 455         sid_copy(&act_sid, &global_sid_Builtin);
 456         sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
 457
 458         /*basic access for every one*/
 459         init_sec_access(&mask, GENERIC_RIGHTS_DOMAIN_EXECUTE | GENERIC_RIGHTS_DOMAIN_READ);
 460         init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 461
 462         /*full access for builtin aliases Administrators and Account Operators*/
 463         init_sec_access(&mask, GENERIC_RIGHTS_DOMAIN_ALL_ACCESS);
 464         init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 465         init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 466
 467         if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
 468                 return NT_STATUS_NO_MEMORY;
 469
 470         if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, psa, sd_size)) == NULL)
 471                 return NT_STATUS_NO_MEMORY;
 472
 473         return NT_STATUS_OK;
 474 }
 475
 476 /*******************************************************************
 477  samr_make_usr_obj_sd
 478  ********************************************************************/
 479
 480 static NTSTATUS samr_make_usr_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size, DOM_SID *usr_sid)
 481 {
 482         extern DOM_SID global_sid_World;
 483         DOM_SID adm_sid;
 484         DOM_SID act_sid;
 485
 486         SEC_ACE ace[4];
 487         SEC_ACCESS mask;
 488
 489         SEC_ACL *psa = NULL;
 490
 491         sid_copy(&adm_sid, &global_sid_Builtin);
 492         sid_append_rid(&adm_sid, BUILTIN_ALIAS_RID_ADMINS);
 493
 494         sid_copy(&act_sid, &global_sid_Builtin);
 495         sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
 496
 497         /*basic access for every one*/
 498         init_sec_access(&mask, GENERIC_RIGHTS_USER_EXECUTE | GENERIC_RIGHTS_USER_READ);
 499         init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 500
 501         /*full access for builtin aliases Administrators and Account Operators*/
 502         init_sec_access(&mask, GENERIC_RIGHTS_USER_ALL_ACCESS);
 503         init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 504         init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 505
 506         /*extended access for the user*/
 507         init_sec_access(&mask,READ_CONTROL_ACCESS | SA_RIGHT_USER_CHANGE_PASSWORD | SA_RIGHT_USER_SET_LOC_COM);
 508         init_sec_ace(&ace[3], usr_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 509
 510         if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 4, ace)) == NULL)
 511                 return NT_STATUS_NO_MEMORY;
 512
 513         if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, psa, sd_size)) == NULL)
 514                 return NT_STATUS_NO_MEMORY;
 515
 516         return NT_STATUS_OK;
 517 }
 518
 519 /*******************************************************************
 520  samr_make_grp_obj_sd
 521  ********************************************************************/
 522
 523 static NTSTATUS samr_make_grp_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size)
 524 {
 525         extern DOM_SID global_sid_World;
 526         DOM_SID adm_sid;
 527         DOM_SID act_sid;
 528
 529         SEC_ACE ace[3];
 530         SEC_ACCESS mask;
 531
 532         SEC_ACL *psa = NULL;
 533
 534         sid_copy(&adm_sid, &global_sid_Builtin);
 535         sid_append_rid(&adm_sid, BUILTIN_ALIAS_RID_ADMINS);
 536
 537         sid_copy(&act_sid, &global_sid_Builtin);
 538         sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
 539
 540         /*basic access for every one*/
 541         init_sec_access(&mask, GENERIC_RIGHTS_GROUP_EXECUTE | GENERIC_RIGHTS_GROUP_READ);
 542         init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 543
 544         /*full access for builtin aliases Administrators and Account Operators*/
 545         init_sec_access(&mask, GENERIC_RIGHTS_GROUP_ALL_ACCESS);
 546         init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 547         init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 548
 549         if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
 550                 return NT_STATUS_NO_MEMORY;
 551
 552         if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, psa, sd_size)) == NULL)
 553                 return NT_STATUS_NO_MEMORY;
 554
 555         return NT_STATUS_OK;
 556 }
 557
 558 /*******************************************************************
 559  samr_make_ali_obj_sd
 560  ********************************************************************/
 561
 562 static NTSTATUS samr_make_ali_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size)
 563 {
 564         extern DOM_SID global_sid_World;
 565         DOM_SID adm_sid;
 566         DOM_SID act_sid;
 567
 568         SEC_ACE ace[3];
 569         SEC_ACCESS mask;
 570
 571         SEC_ACL *psa = NULL;
 572
 573         sid_copy(&adm_sid, &global_sid_Builtin);
 574         sid_append_rid(&adm_sid, BUILTIN_ALIAS_RID_ADMINS);
 575
 576         sid_copy(&act_sid, &global_sid_Builtin);
 577         sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
 578
 579         /*basic access for every one*/
 580         init_sec_access(&mask, GENERIC_RIGHTS_ALIAS_EXECUTE | GENERIC_RIGHTS_ALIAS_READ);
 581         init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 582
 583         /*full access for builtin aliases Administrators and Account Operators*/
 584         init_sec_access(&mask, GENERIC_RIGHTS_ALIAS_ALL_ACCESS);
 585         init_sec_ace(&ace[1], &adm_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 586         init_sec_ace(&ace[2], &act_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 587
 588         if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
 589                 return NT_STATUS_NO_MEMORY;
 590
 591         if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, psa, sd_size)) == NULL)
 592                 return NT_STATUS_NO_MEMORY;
 593
 594         return NT_STATUS_OK;
 595 }
 596
 597 static BOOL get_lsa_policy_samr_sid(pipes_struct *p, POLICY_HND *pol, DOM_SID *sid, uint32 *acc_granted)
 598 {
 599         struct samr_info *info = NULL;
 600
 601         /* find the policy handle.  open a policy on it. */
 602         if (!find_policy_by_hnd(p, pol, (void **)&info))
 603                 return False;
 604
 605         if (!info)
 606                 return False;
 607
 608         *sid = info->sid;
 609         *acc_granted = info->acc_granted;
 610         return True;
 611 }
 612
 613 /*******************************************************************
 614  _samr_set_sec_obj
 615  ********************************************************************/
 616
 617 NTSTATUS _samr_set_sec_obj(pipes_struct *p, SAMR_Q_SET_SEC_OBJ *q_u, SAMR_R_SET_SEC_OBJ *r_u)
 618 {
 619         DEBUG(0,("_samr_set_sec_obj: Not yet implemented!\n"));
 620         return NT_STATUS_NOT_IMPLEMENTED;
 621 }
 622
 623
 624 /*******************************************************************
 625  _samr_query_sec_obj
 626  ********************************************************************/
 627
 628 NTSTATUS _samr_query_sec_obj(pipes_struct *p, SAMR_Q_QUERY_SEC_OBJ *q_u, SAMR_R_QUERY_SEC_OBJ *r_u)
 629 {
 630         DOM_SID pol_sid;
 631         fstring str_sid;
 632         SEC_DESC * psd = NULL;
 633         size_t sd_size;
 634         uint32 acc_granted;
 635
 636         r_u->status = NT_STATUS_OK;
 637
 638         /* Get the SID. */
 639         if (!get_lsa_policy_samr_sid(p, &q_u->user_pol, &pol_sid, &acc_granted))
 640                 return NT_STATUS_INVALID_HANDLE;
 641
 642
 643
 644         DEBUG(10,("_samr_query_sec_obj: querying security on SID: %s\n", sid_to_string(str_sid, &pol_sid)));
 645
 646         /* Check what typ of SID is beeing queried (e.g Domain SID, User SID, Group SID) */
 647
 648         /* To query the security of the SAM it self an invalid SID with S-0-0 is passed to this function */
 649         if (pol_sid.sid_rev_num == 0)
 650         {
 651                 DEBUG(5,("_samr_query_sec_obj: querying security on SAM\n"));
 652                 r_u->status = samr_make_sam_obj_sd(p->mem_ctx, &psd, &sd_size);
 653         }
 654         else if (sid_equal(&pol_sid,get_global_sam_sid()))  /* check if it is our domain SID */
 655
 656         {
 657                 DEBUG(5,("_samr_query_sec_obj: querying security on Domain with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
 658                 r_u->status = samr_make_dom_obj_sd(p->mem_ctx, &psd, &sd_size);
 659         }
 660         else if (sid_equal(&pol_sid,&global_sid_Builtin)) /* check if it is the Builtin  Domain */
 661         {
 662                 /* TODO: Builtin probably needs a different SD with restricted write access*/
 663                 DEBUG(5,("_samr_query_sec_obj: querying security on Builtin Domain with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
 664                 r_u->status = samr_make_dom_obj_sd(p->mem_ctx, &psd, &sd_size);
 665         }
 666         else if (sid_check_is_in_our_domain(&pol_sid) ||
 667                  sid_check_is_in_builtin(&pol_sid))
 668         {
 669                 /* TODO: different SDs have to be generated for aliases groups and users.
 670                          Currently all three get a default user SD  */
 671                 DEBUG(10,("_samr_query_sec_obj: querying security on Object with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
 672                 r_u->status = samr_make_usr_obj_sd(p->mem_ctx, &psd,&sd_size, &pol_sid);
 673         }
 674         else return NT_STATUS_OBJECT_TYPE_MISMATCH;
 675
 676         if ((r_u->buf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
 677                 return NT_STATUS_NO_MEMORY;
 678
 679         if (NT_STATUS_IS_OK(r_u->status))
 680                 r_u->ptr = 1;
 681
 682         return r_u->status;
 683 }
 684
 685 /*******************************************************************
 686 makes a SAM_ENTRY / UNISTR2* structure from a user list.
 687 ********************************************************************/
 688
 689 static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp, UNISTR2 **uni_name_pp,
 690                                          uint32 num_entries, uint32 start_idx, SAM_ACCOUNT *disp_user_info,
 691                                          DOM_SID *domain_sid)
 692 {
 693         uint32 i;
 694         SAM_ENTRY *sam;
 695         UNISTR2 *uni_name;
 696         SAM_ACCOUNT *pwd = NULL;
 697         UNISTR2 uni_temp_name;
 698         const char *temp_name;
 699         const DOM_SID *user_sid;
 700         uint32 user_rid;
 701         fstring user_sid_string;
 702         fstring domain_sid_string;
 703
 704         *sam_pp = NULL;
 705         *uni_name_pp = NULL;
 706
 707         if (num_entries == 0)
 708                 return NT_STATUS_OK;
 709
 710         sam = (SAM_ENTRY *)talloc_zero(ctx, sizeof(SAM_ENTRY)*num_entries);
 711
 712         uni_name = (UNISTR2 *)talloc_zero(ctx, sizeof(UNISTR2)*num_entries);
 713
 714         if (sam == NULL || uni_name == NULL) {
 715                 DEBUG(0, ("make_user_sam_entry_list: talloc_zero failed!\n"));
 716                 return NT_STATUS_NO_MEMORY;
 717         }
 718
 719         for (i = 0; i < num_entries; i++) {
 720                 pwd = &disp_user_info[i+start_idx];
 721                 temp_name = pdb_get_username(pwd);
 722                 init_unistr2(&uni_temp_name, temp_name, UNI_STR_TERMINATE);
 723                 user_sid = pdb_get_user_sid(pwd);
 724
 725                 if (!sid_peek_check_rid(domain_sid, user_sid, &user_rid)) {
 726                         DEBUG(0, ("make_user_sam_entry_list: User %s has SID %s, which conflicts with "
 727                                   "the domain sid %s.  Failing operation.\n",
 728                                   temp_name,
 729                                   sid_to_string(user_sid_string, user_sid),
 730                                   sid_to_string(domain_sid_string, domain_sid)));
 731                         return NT_STATUS_UNSUCCESSFUL;
 732                 }
 733
 734                 init_sam_entry(&sam[i], &uni_temp_name, user_rid);
 735                 copy_unistr2(&uni_name[i], &uni_temp_name);
 736         }
 737
 738         *sam_pp = sam;
 739         *uni_name_pp = uni_name;
 740         return NT_STATUS_OK;
 741 }
 742
 743 /*******************************************************************
 744  samr_reply_enum_dom_users
 745  ********************************************************************/
 746
 747 NTSTATUS _samr_enum_dom_users(pipes_struct *p, SAMR_Q_ENUM_DOM_USERS *q_u,
 748                               SAMR_R_ENUM_DOM_USERS *r_u)
 749 {
 750         struct samr_info *info = NULL;
 751         uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
 752         int num_account;
 753         uint32 enum_context=q_u->start_idx;
 754         uint32 max_size=q_u->max_size;
 755         uint32 temp_size;
 756         enum remote_arch_types ra_type = get_remote_arch();
 757         int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
 758         uint32 max_entries = max_sam_entries;
 759         DOM_SID domain_sid;
 760
 761         r_u->status = NT_STATUS_OK;
 762
 763         /* find the policy handle.  open a policy on it. */
 764         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
 765                 return NT_STATUS_INVALID_HANDLE;
 766
 767         domain_sid = info->sid;
 768
 769         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted,
 770                                         SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
 771                                         "_samr_enum_dom_users"))) {
 772                 return r_u->status;
 773         }
 774
 775         DEBUG(5,("_samr_enum_dom_users: %d\n", __LINE__));
 776
 777         become_root();
 778         r_u->status=load_sampwd_entries(info, q_u->acb_mask, False);
 779         unbecome_root();
 780
 781         if (!NT_STATUS_IS_OK(r_u->status))
 782                 return r_u->status;
 783
 784         num_account = info->disp_info.num_user_account;
 785
 786         if (enum_context > num_account) {
 787                 DEBUG(5, ("_samr_enum_dom_users: enumeration handle over total entries\n"));
 788                 return NT_STATUS_OK;
 789         }
 790
 791         /* verify we won't overflow */
 792         if (max_entries > num_account-enum_context) {
 793                 max_entries = num_account-enum_context;
 794                 DEBUG(5, ("_samr_enum_dom_users: only %d entries to return\n", max_entries));
 795         }
 796
 797         /* calculate the size and limit on the number of entries we will return */
 798         temp_size=max_entries*struct_size;
 799
 800         if (temp_size>max_size) {
 801                 max_entries=MIN((max_size/struct_size),max_entries);;
 802                 DEBUG(5, ("_samr_enum_dom_users: buffer size limits to only %d entries\n", max_entries));
 803         }
 804
 805         /*
 806          * Note from JRA. total_entries is not being used here. Currently if there is a
 807          * large user base then it looks like NT will enumerate until get_sampwd_entries
 808          * returns False due to num_entries being zero. This will cause an access denied
 809          * return. I don't think this is right and needs further investigation. Note that
 810          * this is also the same in the TNG code (I don't think that has been tested with
 811          * a very large user list as MAX_SAM_ENTRIES is set to 600).
 812          *
 813          * I also think that one of the 'num_entries' return parameters is probably
 814          * the "max entries" parameter - but in the TNG code they're all currently set to the same
 815          * value (again I think this is wrong).
 816          */
 817
 818         r_u->status = make_user_sam_entry_list(p->mem_ctx, &r_u->sam, &r_u->uni_acct_name,
 819                                                max_entries, enum_context,
 820                                                info->disp_info.disp_user_info,
 821                                                &domain_sid);
 822
 823         if (!NT_STATUS_IS_OK(r_u->status))
 824                 return r_u->status;
 825
 826         if (enum_context+max_entries < num_account)
 827                 r_u->status = STATUS_MORE_ENTRIES;
 828
 829         DEBUG(5, ("_samr_enum_dom_users: %d\n", __LINE__));
 830
 831         init_samr_r_enum_dom_users(r_u, q_u->start_idx + max_entries, max_entries);
 832
 833         DEBUG(5,("_samr_enum_dom_users: %d\n", __LINE__));
 834
 835         return r_u->status;
 836 }
 837
 838 /*******************************************************************
 839 makes a SAM_ENTRY / UNISTR2* structure from a group list.
 840 ********************************************************************/
 841
 842 static void make_group_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp, UNISTR2 **uni_name_pp,
 843                 uint32 num_sam_entries, DOMAIN_GRP *grp)
 844 {
 845         uint32 i;
 846         SAM_ENTRY *sam;
 847         UNISTR2 *uni_name;
 848
 849         *sam_pp = NULL;
 850         *uni_name_pp = NULL;
 851
 852         if (num_sam_entries == 0)
 853                 return;
 854
 855         sam = (SAM_ENTRY *)talloc_zero(ctx, sizeof(SAM_ENTRY)*num_sam_entries);
 856
 857         uni_name = (UNISTR2 *)talloc_zero(ctx, sizeof(UNISTR2)*num_sam_entries);
 858
 859         if (sam == NULL || uni_name == NULL) {
 860                 DEBUG(0, ("NULL pointers in SAMR_R_QUERY_DISPINFO\n"));
 861                 return;
 862         }
 863
 864         for (i = 0; i < num_sam_entries; i++) {
 865                 /*
 866                  * JRA. I think this should include the null. TNG does not.
 867                  */
 868                 init_unistr2(&uni_name[i], grp[i].name, UNI_STR_TERMINATE);
 869                 init_sam_entry(&sam[i], &uni_name[i], grp[i].rid);
 870         }
 871
 872         *sam_pp = sam;
 873         *uni_name_pp = uni_name;
 874 }
 875
 876 /*******************************************************************
 877  Get the group entries - similar to get_sampwd_entries().
 878  ********************************************************************/
 879
 880 static NTSTATUS get_group_alias_entries(TALLOC_CTX *ctx, DOMAIN_GRP **d_grp, DOM_SID *sid, uint32 start_idx,
 881                                     uint32 *p_num_entries, uint32 max_entries)
 882 {
 883         fstring sid_str;
 884         uint32 num_entries = 0;
 885         int i;
 886         GROUP_MAP smap;
 887         GROUP_MAP *map = NULL;
 888
 889         sid_to_string(sid_str, sid);
 890         DEBUG(5, ("get_group_alias_entries: enumerating aliases on SID: %s\n", sid_str));
 891
 892         *p_num_entries = 0;
 893
 894         /* well-known aliases */
 895         if (sid_equal(sid, &global_sid_Builtin) && !lp_hide_local_users()) {
 896
 897                 pdb_enum_group_mapping(SID_NAME_WKN_GRP, &map, (int *)&num_entries, ENUM_ONLY_MAPPED);
 898
 899                 if (num_entries != 0) {
 900                         *d_grp=(DOMAIN_GRP *)talloc_zero(ctx, num_entries*sizeof(DOMAIN_GRP));
 901                         if (*d_grp==NULL)
 902                                 return NT_STATUS_NO_MEMORY;
 903
 904                         for(i=0; i<num_entries && i<max_entries; i++) {
 905                                 fstrcpy((*d_grp)[i].name, map[i+start_idx].nt_name);
 906                                 sid_split_rid(&map[i+start_idx].sid, &(*d_grp)[i].rid);
 907
 908                         }
 909                 }
 910                 SAFE_FREE(map);
 911
 912         } else if (sid_equal(sid, get_global_sam_sid()) && !lp_hide_local_users()) {
 913                 struct sys_grent *glist;
 914                 struct sys_grent *grp;
 915                 gid_t winbind_gid_low, winbind_gid_high;
 916                 BOOL winbind_groups_exist = lp_idmap_gid(&winbind_gid_low, &winbind_gid_high);
 917
 918                 /* local aliases */
 919                 /* we return the UNIX groups here.  This seems to be the right */
 920                 /* thing to do, since NT member servers return their local     */
 921                 /* groups in the same situation.                               */
 922
 923                 /* use getgrent_list() to retrieve the list of groups to avoid
 924                  * problems with getgrent possible infinite loop by internal
 925                  * libc grent structures overwrites by called functions */
 926                 grp = glist = getgrent_list();
 927                 if (grp == NULL)
 928                         return NT_STATUS_NO_MEMORY;
 929
 930                 for (; (num_entries < max_entries) && (grp != NULL); grp = grp->next) {
 931                         uint32 trid;
 932
 933                         if(!pdb_getgrgid(&smap, grp->gr_gid))
 934                                 continue;
 935
 936                         if (smap.sid_name_use!=SID_NAME_ALIAS) {
 937                                 continue;
 938                         }
 939
 940                         sid_split_rid(&smap.sid, &trid);
 941
 942                         if (!sid_equal(sid, &smap.sid))
 943                                 continue;
 944
 945                         /* Don't return winbind groups as they are not local! */
 946                         if (winbind_groups_exist && (grp->gr_gid >= winbind_gid_low)&&(grp->gr_gid <= winbind_gid_high)) {
 947                                 DEBUG(10,("get_group_alias_entries: not returing %s, not local.\n", smap.nt_name ));
 948                                 continue;
 949                         }
 950
 951                         /* Don't return user private groups... */
 952
 953                         if (Get_Pwnam(smap.nt_name) != 0) {
 954                                 DEBUG(10,("get_group_alias_entries: not returing %s, clashes with user.\n", smap.nt_name ));
 955                                 continue;
 956                         }
 957
 958                         for( i = 0; i < num_entries; i++)
 959                                 if ( (*d_grp)[i].rid == trid )
 960                                         break;
 961
 962                         if ( i < num_entries ) {
 963                                 continue; /* rid was there, dup! */
 964                         }
 965
 966                         /* JRA - added this for large group db enumeration... */
 967
 968                         if (start_idx > 0) {
 969                                 /* skip the requested number of entries.
 970                                         not very efficient, but hey...
 971                                 */
 972                                 start_idx--;
 973                                 continue;
 974                         }
 975
 976                         *d_grp=talloc_realloc(ctx,*d_grp, (num_entries+1)*sizeof(DOMAIN_GRP));
 977                         if (*d_grp==NULL) {
 978                                 grent_free(glist);
 979                                 return NT_STATUS_NO_MEMORY;
 980                         }
 981
 982                         fstrcpy((*d_grp)[num_entries].name, smap.nt_name);
 983                         (*d_grp)[num_entries].rid = trid;
 984                         num_entries++;
 985                         DEBUG(10,("get_group_alias_entries: added entry %d, rid:%d\n", num_entries, trid));
 986                 }
 987
 988                 grent_free(glist);
 989         }
 990
 991         *p_num_entries = num_entries;
 992
 993         DEBUG(10,("get_group_alias_entries: returning %d entries\n", *p_num_entries));
 994
 995         if (num_entries >= max_entries)
 996                 return STATUS_MORE_ENTRIES;
 997         return NT_STATUS_OK;
 998 }
 999
1000 /*******************************************************************
1001  Get the group entries - similar to get_sampwd_entries().
1002  ********************************************************************/
1003
1004 static NTSTATUS get_group_domain_entries(TALLOC_CTX *ctx, DOMAIN_GRP **d_grp, DOM_SID *sid, uint32 start_idx,
1005                                      uint32 *p_num_entries, uint32 max_entries)
1006 {
1007         GROUP_MAP *map=NULL;
1008         int i;
1009         uint32 group_entries = 0;
1010         uint32 num_entries = 0;
1011
1012         *p_num_entries = 0;
1013
1014         /* access checks for the users were performed higher up.  become/unbecome_root()
1015            needed for some passdb backends to enumerate groups */
1016
1017         become_root();
1018         pdb_enum_group_mapping(SID_NAME_DOM_GRP, &map, (int *)&group_entries, ENUM_ONLY_MAPPED);
1019         unbecome_root();
1020
1021         num_entries=group_entries-start_idx;
1022
1023         /* limit the number of entries */
1024         if (num_entries>max_entries) {
1025                 DEBUG(5,("Limiting to %d entries\n", max_entries));
1026                 num_entries=max_entries;
1027         }
1028
1029         *d_grp=(DOMAIN_GRP *)talloc_zero(ctx, num_entries*sizeof(DOMAIN_GRP));
1030         if (num_entries!=0 && *d_grp==NULL){
1031                 SAFE_FREE(map);
1032                 return NT_STATUS_NO_MEMORY;
1033         }
1034
1035         for (i=0; i<num_entries; i++) {
1036                 fstrcpy((*d_grp)[i].name, map[i+start_idx].nt_name);
1037                 fstrcpy((*d_grp)[i].comment, map[i+start_idx].comment);
1038                 sid_split_rid(&map[i+start_idx].sid, &(*d_grp)[i].rid);
1039                 (*d_grp)[i].attr=SID_NAME_DOM_GRP;
1040         }
1041
1042         SAFE_FREE(map);
1043
1044         *p_num_entries = num_entries;
1045
1046         return NT_STATUS_OK;
1047 }
1048
1049 /*******************************************************************
1050  samr_reply_enum_dom_groups
1051  ********************************************************************/
1052
1053 NTSTATUS _samr_enum_dom_groups(pipes_struct *p, SAMR_Q_ENUM_DOM_GROUPS *q_u, SAMR_R_ENUM_DOM_GROUPS *r_u)
1054 {
1055         DOMAIN_GRP *grp=NULL;
1056         uint32 num_entries;
1057         DOM_SID sid;
1058         uint32 acc_granted;
1059
1060         r_u->status = NT_STATUS_OK;
1061
1062         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
1063                 return NT_STATUS_INVALID_HANDLE;
1064
1065         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_ENUM_ACCOUNTS, "_samr_enum_dom_groups"))) {
1066                 return r_u->status;
1067         }
1068
1069         DEBUG(5,("samr_reply_enum_dom_groups: %d\n", __LINE__));
1070
1071         /* the domain group array is being allocated in the function below */
1072         if (!NT_STATUS_IS_OK(r_u->status = get_group_domain_entries(p->mem_ctx, &grp, &sid, q_u->start_idx, &num_entries, MAX_SAM_ENTRIES))) {
1073                 return r_u->status;
1074         }
1075
1076         make_group_sam_entry_list(p->mem_ctx, &r_u->sam, &r_u->uni_grp_name, num_entries, grp);
1077
1078         init_samr_r_enum_dom_groups(r_u, q_u->start_idx, num_entries);
1079
1080         DEBUG(5,("samr_enum_dom_groups: %d\n", __LINE__));
1081
1082         return r_u->status;
1083 }
1084
1085
1086 /*******************************************************************
1087  samr_reply_enum_dom_aliases
1088  ********************************************************************/
1089
1090 NTSTATUS _samr_enum_dom_aliases(pipes_struct *p, SAMR_Q_ENUM_DOM_ALIASES *q_u, SAMR_R_ENUM_DOM_ALIASES *r_u)
1091 {
1092         DOMAIN_GRP *grp=NULL;
1093         uint32 num_entries = 0;
1094         fstring sid_str;
1095         DOM_SID sid;
1096         NTSTATUS status;
1097         uint32  acc_granted;
1098
1099         r_u->status = NT_STATUS_OK;
1100
1101         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
1102                 return NT_STATUS_INVALID_HANDLE;
1103
1104         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_ENUM_ACCOUNTS, "_samr_enum_dom_aliases"))) {
1105                 return r_u->status;
1106         }
1107
1108         sid_to_string(sid_str, &sid);
1109         DEBUG(5,("samr_reply_enum_dom_aliases: sid %s\n", sid_str));
1110
1111         status = get_group_alias_entries(p->mem_ctx, &grp, &sid, q_u->start_idx,
1112                                          &num_entries, MAX_SAM_ENTRIES);
1113         if (NT_STATUS_IS_ERR(status)) return status;
1114
1115         make_group_sam_entry_list(p->mem_ctx, &r_u->sam, &r_u->uni_grp_name, num_entries, grp);
1116
1117         /*safe_free(grp);*/
1118
1119         init_samr_r_enum_dom_aliases(r_u, q_u->start_idx + num_entries, num_entries);
1120
1121         DEBUG(5,("samr_enum_dom_aliases: %d\n", __LINE__));
1122
1123         return r_u->status;
1124 }
1125
1126 /*******************************************************************
1127  samr_reply_query_dispinfo
1128  ********************************************************************/
1129
1130 NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u,
1131                               SAMR_R_QUERY_DISPINFO *r_u)
1132 {
1133         struct samr_info *info = NULL;
1134         uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
1135
1136         uint32 max_entries=q_u->max_entries;
1137         uint32 enum_context=q_u->start_idx;
1138         uint32 max_size=q_u->max_size;
1139
1140         SAM_DISPINFO_CTR *ctr;
1141         uint32 temp_size=0, total_data_size=0;
1142         NTSTATUS disp_ret;
1143         uint32 num_account = 0;
1144         enum remote_arch_types ra_type = get_remote_arch();
1145         int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
1146         DOM_SID domain_sid;
1147
1148         DEBUG(5, ("samr_reply_query_dispinfo: %d\n", __LINE__));
1149         r_u->status = NT_STATUS_OK;
1150
1151         /* find the policy handle.  open a policy on it. */
1152         if (!find_policy_by_hnd(p, &q_u->domain_pol, (void **)&info))
1153                 return NT_STATUS_INVALID_HANDLE;
1154
1155         domain_sid = info->sid;
1156
1157         /*
1158          * calculate how many entries we will return.
1159          * based on
1160          * - the number of entries the client asked
1161          * - our limit on that
1162          * - the starting point (enumeration context)
1163          * - the buffer size the client will accept
1164          */
1165
1166         /*
1167          * We are a lot more like W2K. Instead of reading the SAM
1168          * each time to find the records we need to send back,
1169          * we read it once and link that copy to the sam handle.
1170          * For large user list (over the MAX_SAM_ENTRIES)
1171          * it's a definitive win.
1172          * second point to notice: between enumerations
1173          * our sam is now the same as it's a snapshoot.
1174          * third point: got rid of the static SAM_USER_21 struct
1175          * no more intermediate.
1176          * con: it uses much more memory, as a full copy is stored
1177          * in memory.
1178          *
1179          * If you want to change it, think twice and think
1180          * of the second point , that's really important.
1181          *
1182          * JFM, 12/20/2001
1183          */
1184
1185         /* Get what we need from the password database */
1186         switch (q_u->switch_level) {
1187                 case 0x1:
1188                         /* When playing with usrmgr, this is necessary
1189                            if you want immediate refresh after editing
1190                            a user. I would like to do this after the
1191                            setuserinfo2, but we do not have access to
1192                            the domain handle in that call, only to the
1193                            user handle. Where else does this hurt?
1194                            -- Volker
1195                         */
1196 #if 0
1197                         /* We cannot do this here - it kills performace. JRA. */
1198                         free_samr_users(info);
1199 #endif
1200                 case 0x2:
1201                 case 0x4:
1202                         become_root();
1203                         /* Level 2 is for all machines, otherwise only 'normal' users */
1204                         r_u->status=load_sampwd_entries(info, ACB_NORMAL, q_u->switch_level==2);
1205                         unbecome_root();
1206                         if (!NT_STATUS_IS_OK(r_u->status)) {
1207                                 DEBUG(5, ("_samr_query_dispinfo: load_sampwd_entries failed\n"));
1208                                 return r_u->status;
1209                         }
1210                         num_account = info->disp_info.num_user_account;
1211                         break;
1212                 case 0x3:
1213                 case 0x5:
1214                         r_u->status = load_group_domain_entries(info, &info->sid);
1215                         if (!NT_STATUS_IS_OK(r_u->status))
1216                                 return r_u->status;
1217                         num_account = info->disp_info.num_group_account;
1218                         break;
1219                 default:
1220                         DEBUG(0,("_samr_query_dispinfo: Unknown info level (%u)\n", (unsigned int)q_u->switch_level ));
1221                         return NT_STATUS_INVALID_INFO_CLASS;
1222         }
1223
1224         /* first limit the number of entries we will return */
1225         if(max_entries > max_sam_entries) {
1226                 DEBUG(5, ("samr_reply_query_dispinfo: client requested %d entries, limiting to %d\n", max_entries, max_sam_entries));
1227                 max_entries = max_sam_entries;
1228         }
1229
1230         if (enum_context > num_account) {
1231                 DEBUG(5, ("samr_reply_query_dispinfo: enumeration handle over total entries\n"));
1232                 return NT_STATUS_NO_MORE_ENTRIES;
1233         }
1234
1235         /* verify we won't overflow */
1236         if (max_entries > num_account-enum_context) {
1237                 max_entries = num_account-enum_context;
1238                 DEBUG(5, ("samr_reply_query_dispinfo: only %d entries to return\n", max_entries));
1239         }
1240
1241         /* calculate the size and limit on the number of entries we will return */
1242         temp_size=max_entries*struct_size;
1243
1244         if (temp_size>max_size) {
1245                 max_entries=MIN((max_size/struct_size),max_entries);;
1246                 DEBUG(5, ("samr_reply_query_dispinfo: buffer size limits to only %d entries\n", max_entries));
1247         }
1248
1249         if (!(ctr = (SAM_DISPINFO_CTR *)talloc_zero(p->mem_ctx,sizeof(SAM_DISPINFO_CTR))))
1250                 return NT_STATUS_NO_MEMORY;
1251
1252         ZERO_STRUCTP(ctr);
1253
1254         /* Now create reply structure */
1255         switch (q_u->switch_level) {
1256         case 0x1:
1257                 if (max_entries) {
1258                         if (!(ctr->sam.info1 = (SAM_DISPINFO_1 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_1))))
1259                                 return NT_STATUS_NO_MEMORY;
1260                 }
1261                 disp_ret = init_sam_dispinfo_1(p->mem_ctx, ctr->sam.info1, max_entries, enum_context,
1262                                                info->disp_info.disp_user_info, &domain_sid);
1263                 if (!NT_STATUS_IS_OK(disp_ret))
1264                         return disp_ret;
1265                 break;
1266         case 0x2:
1267                 if (max_entries) {
1268                         if (!(ctr->sam.info2 = (SAM_DISPINFO_2 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_2))))
1269                                 return NT_STATUS_NO_MEMORY;
1270                 }
1271                 disp_ret = init_sam_dispinfo_2(p->mem_ctx, ctr->sam.info2, max_entries, enum_context,
1272                                                info->disp_info.disp_user_info, &domain_sid);
1273                 if (!NT_STATUS_IS_OK(disp_ret))
1274                         return disp_ret;
1275                 break;
1276         case 0x3:
1277                 if (max_entries) {
1278                         if (!(ctr->sam.info3 = (SAM_DISPINFO_3 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_3))))
1279                                 return NT_STATUS_NO_MEMORY;
1280                 }
1281                 disp_ret = init_sam_dispinfo_3(p->mem_ctx, ctr->sam.info3, max_entries, enum_context, info->disp_info.disp_group_info);
1282                 if (!NT_STATUS_IS_OK(disp_ret))
1283                         return disp_ret;
1284                 break;
1285         case 0x4:
1286                 if (max_entries) {
1287                         if (!(ctr->sam.info4 = (SAM_DISPINFO_4 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_4))))
1288                                 return NT_STATUS_NO_MEMORY;
1289                 }
1290                 disp_ret = init_sam_dispinfo_4(p->mem_ctx, ctr->sam.info4, max_entries, enum_context, info->disp_info.disp_user_info);
1291                 if (!NT_STATUS_IS_OK(disp_ret))
1292                         return disp_ret;
1293                 break;
1294         case 0x5:
1295                 if (max_entries) {
1296                         if (!(ctr->sam.info5 = (SAM_DISPINFO_5 *)talloc_zero(p->mem_ctx,max_entries*sizeof(SAM_DISPINFO_5))))
1297                                 return NT_STATUS_NO_MEMORY;
1298                 }
1299                 disp_ret = init_sam_dispinfo_5(p->mem_ctx, ctr->sam.info5, max_entries, enum_context, info->disp_info.disp_group_info);
1300                 if (!NT_STATUS_IS_OK(disp_ret))
1301                         return disp_ret;
1302                 break;
1303
1304         default:
1305                 ctr->sam.info = NULL;
1306                 return NT_STATUS_INVALID_INFO_CLASS;
1307         }
1308
1309         /* calculate the total size */
1310         total_data_size=num_account*struct_size;
1311
1312         if (enum_context+max_entries < num_account)
1313                 r_u->status = STATUS_MORE_ENTRIES;
1314
1315         DEBUG(5, ("_samr_query_dispinfo: %d\n", __LINE__));
1316
1317         init_samr_r_query_dispinfo(r_u, max_entries, total_data_size, temp_size, q_u->switch_level, ctr, r_u->status);
1318
1319         return r_u->status;
1320
1321 }
1322
1323 /*******************************************************************
1324  samr_reply_query_aliasinfo
1325  ********************************************************************/
1326
1327 NTSTATUS _samr_query_aliasinfo(pipes_struct *p, SAMR_Q_QUERY_ALIASINFO *q_u, SAMR_R_QUERY_ALIASINFO *r_u)
1328 {
1329         DOM_SID   sid;
1330         GROUP_MAP map;
1331         uint32    acc_granted;
1332
1333         r_u->status = NT_STATUS_OK;
1334
1335         DEBUG(5,("_samr_query_aliasinfo: %d\n", __LINE__));
1336
1337         /* find the policy handle.  open a policy on it. */
1338         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
1339                 return NT_STATUS_INVALID_HANDLE;
1340         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_LOOKUP_INFO, "_samr_query_aliasinfo"))) {
1341                 return r_u->status;
1342         }
1343
1344         if (!sid_check_is_in_our_domain(&sid) &&
1345             !sid_check_is_in_builtin(&sid))
1346                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1347
1348         if (!pdb_getgrsid(&map, sid))
1349                 return NT_STATUS_NO_SUCH_ALIAS;
1350
1351         switch (q_u->switch_level) {
1352         case 1:
1353                 r_u->ptr = 1;
1354                 r_u->ctr.switch_value1 = 1;
1355                 init_samr_alias_info1(&r_u->ctr.alias.info1, map.nt_name, 1, map.comment);
1356                 break;
1357         case 3:
1358                 r_u->ptr = 1;
1359                 r_u->ctr.switch_value1 = 3;
1360                 init_samr_alias_info3(&r_u->ctr.alias.info3, map.comment);
1361                 break;
1362         default:
1363                 return NT_STATUS_INVALID_INFO_CLASS;
1364         }
1365
1366         DEBUG(5,("_samr_query_aliasinfo: %d\n", __LINE__));
1367
1368         return r_u->status;
1369 }
1370
1371 #if 0
1372 /*******************************************************************
1373  samr_reply_lookup_ids
1374  ********************************************************************/
1375
1376  uint32 _samr_lookup_ids(pipes_struct *p, SAMR_Q_LOOKUP_IDS *q_u, SAMR_R_LOOKUP_IDS *r_u)
1377 {
1378     uint32 rid[MAX_SAM_ENTRIES];
1379     int num_rids = q_u->num_sids1;
1380
1381     r_u->status = NT_STATUS_OK;
1382
1383     DEBUG(5,("_samr_lookup_ids: %d\n", __LINE__));
1384
1385     if (num_rids > MAX_SAM_ENTRIES) {
1386         num_rids = MAX_SAM_ENTRIES;
1387         DEBUG(5,("_samr_lookup_ids: truncating entries to %d\n", num_rids));
1388     }
1389
1390 #if 0
1391     int i;
1392     SMB_ASSERT_ARRAY(q_u->uni_user_name, num_rids);
1393
1394     for (i = 0; i < num_rids && status == 0; i++)
1395     {
1396         struct sam_passwd *sam_pass;
1397         fstring user_name;
1398
1399
1400         fstrcpy(user_name, unistrn2(q_u->uni_user_name[i].buffer,
1401                                     q_u->uni_user_name[i].uni_str_len));
1402
1403         /* find the user account */
1404         become_root();
1405         sam_pass = get_smb21pwd_entry(user_name, 0);
1406         unbecome_root();
1407
1408         if (sam_pass == NULL)
1409         {
1410             status = 0xC0000000 | NT_STATUS_NO_SUCH_USER;
1411             rid[i] = 0;
1412         }
1413         else
1414         {
1415             rid[i] = sam_pass->user_rid;
1416         }
1417     }
1418 #endif
1419
1420     num_rids = 1;
1421     rid[0] = BUILTIN_ALIAS_RID_USERS;
1422
1423     init_samr_r_lookup_ids(&r_u, num_rids, rid, NT_STATUS_OK);
1424
1425     DEBUG(5,("_samr_lookup_ids: %d\n", __LINE__));
1426
1427     return r_u->status;
1428 }
1429 #endif
1430
1431 /*******************************************************************
1432  _samr_lookup_names
1433  ********************************************************************/
1434
1435 NTSTATUS _samr_lookup_names(pipes_struct *p, SAMR_Q_LOOKUP_NAMES *q_u, SAMR_R_LOOKUP_NAMES *r_u)
1436 {
1437         uint32 rid[MAX_SAM_ENTRIES];
1438         uint32 local_rid;
1439         enum SID_NAME_USE type[MAX_SAM_ENTRIES];
1440         enum SID_NAME_USE local_type;
1441         int i;
1442         int num_rids = q_u->num_names2;
1443         DOM_SID pol_sid;
1444         fstring sid_str;
1445         uint32  acc_granted;
1446
1447         r_u->status = NT_STATUS_OK;
1448
1449         DEBUG(5,("_samr_lookup_names: %d\n", __LINE__));
1450
1451         ZERO_ARRAY(rid);
1452         ZERO_ARRAY(type);
1453
1454         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &pol_sid, &acc_granted)) {
1455                 init_samr_r_lookup_names(p->mem_ctx, r_u, 0, NULL, NULL, NT_STATUS_OBJECT_TYPE_MISMATCH);
1456                 return r_u->status;
1457         }
1458
1459         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, 0, "_samr_lookup_names"))) { /* Don't know the acc_bits yet */
1460                 return r_u->status;
1461         }
1462
1463         if (num_rids > MAX_SAM_ENTRIES) {
1464                 num_rids = MAX_SAM_ENTRIES;
1465                 DEBUG(5,("_samr_lookup_names: truncating entries to %d\n", num_rids));
1466         }
1467
1468         DEBUG(5,("_samr_lookup_names: looking name on SID %s\n", sid_to_string(sid_str, &pol_sid)));
1469
1470         become_root(); /* local_lookup_name can require root privs */
1471
1472         for (i = 0; i < num_rids; i++) {
1473                 fstring name;
1474                 DOM_SID sid;
1475                 int ret;
1476
1477                 r_u->status = NT_STATUS_NONE_MAPPED;
1478
1479                 rid [i] = 0xffffffff;
1480                 type[i] = SID_NAME_UNKNOWN;
1481
1482                 ret = rpcstr_pull(name, q_u->uni_name[i].buffer, sizeof(name), q_u->uni_name[i].uni_str_len*2, 0);
1483
1484                 /*
1485                  * we are only looking for a name
1486                  * the SID we get back can be outside
1487                  * the scope of the pol_sid
1488                  *
1489                  * in clear: it prevents to reply to domain\group: yes
1490                  * when only builtin\group exists.
1491                  *
1492                  * a cleaner code is to add the sid of the domain we're looking in
1493                  * to the local_lookup_name function.
1494                  */
1495
1496                 if ((ret > 0) && local_lookup_name(name, &sid, &local_type)) {
1497                         sid_split_rid(&sid, &local_rid);
1498
1499                         if (sid_equal(&sid, &pol_sid)) {
1500                                 rid[i]=local_rid;
1501                                 type[i]=local_type;
1502                                 r_u->status = NT_STATUS_OK;
1503                         }
1504                 }
1505         }
1506
1507         unbecome_root();
1508
1509         init_samr_r_lookup_names(p->mem_ctx, r_u, num_rids, rid, (uint32 *)type, r_u->status);
1510
1511         DEBUG(5,("_samr_lookup_names: %d\n", __LINE__));
1512
1513         return r_u->status;
1514 }
1515
1516 /*******************************************************************
1517  _samr_chgpasswd_user
1518  ********************************************************************/
1519
1520 NTSTATUS _samr_chgpasswd_user(pipes_struct *p, SAMR_Q_CHGPASSWD_USER *q_u, SAMR_R_CHGPASSWD_USER *r_u)
1521 {
1522         fstring user_name;
1523         fstring wks;
1524
1525         DEBUG(5,("_samr_chgpasswd_user: %d\n", __LINE__));
1526
1527         r_u->status = NT_STATUS_OK;
1528
1529         rpcstr_pull(user_name, q_u->uni_user_name.buffer, sizeof(user_name), q_u->uni_user_name.uni_str_len*2, 0);
1530         rpcstr_pull(wks, q_u->uni_dest_host.buffer, sizeof(wks), q_u->uni_dest_host.uni_str_len*2,0);
1531
1532         DEBUG(5,("samr_chgpasswd_user: user: %s wks: %s\n", user_name, wks));
1533
1534         /*
1535          * Pass the user through the NT -> unix user mapping
1536          * function.
1537          */
1538
1539         (void)map_username(user_name);
1540
1541         /*
1542          * UNIX username case mangling not required, pass_oem_change
1543          * is case insensitive.
1544          */
1545
1546         r_u->status = pass_oem_change(user_name, q_u->lm_newpass.pass, q_u->lm_oldhash.hash,
1547                                 q_u->nt_newpass.pass, q_u->nt_oldhash.hash);
1548
1549         init_samr_r_chgpasswd_user(r_u, r_u->status);
1550
1551         DEBUG(5,("_samr_chgpasswd_user: %d\n", __LINE__));
1552
1553         return r_u->status;
1554 }
1555
1556 /*******************************************************************
1557 makes a SAMR_R_LOOKUP_RIDS structure.
1558 ********************************************************************/
1559
1560 static BOOL make_samr_lookup_rids(TALLOC_CTX *ctx, uint32 num_names, fstring names[],
1561             UNIHDR **pp_hdr_name, UNISTR2 **pp_uni_name)
1562 {
1563         uint32 i;
1564         UNIHDR *hdr_name=NULL;
1565         UNISTR2 *uni_name=NULL;
1566
1567         *pp_uni_name = NULL;
1568         *pp_hdr_name = NULL;
1569
1570         if (num_names != 0) {
1571                 hdr_name = (UNIHDR *)talloc_zero(ctx, sizeof(UNIHDR)*num_names);
1572                 if (hdr_name == NULL)
1573                         return False;
1574
1575                 uni_name = (UNISTR2 *)talloc_zero(ctx,sizeof(UNISTR2)*num_names);
1576                 if (uni_name == NULL)
1577                         return False;
1578         }
1579
1580         for (i = 0; i < num_names; i++) {
1581                 DEBUG(10, ("names[%d]:%s\n", i, names[i] ? names[i] : ""));
1582                 init_unistr2(&uni_name[i], names[i], UNI_FLAGS_NONE);
1583                 init_uni_hdr(&hdr_name[i], &uni_name[i]);
1584         }
1585
1586         *pp_uni_name = uni_name;
1587         *pp_hdr_name = hdr_name;
1588
1589         return True;
1590 }
1591
1592 /*******************************************************************
1593  _samr_lookup_rids
1594  ********************************************************************/
1595
1596 NTSTATUS _samr_lookup_rids(pipes_struct *p, SAMR_Q_LOOKUP_RIDS *q_u, SAMR_R_LOOKUP_RIDS *r_u)
1597 {
1598         fstring group_names[MAX_SAM_ENTRIES];
1599         uint32 *group_attrs = NULL;
1600         UNIHDR *hdr_name = NULL;
1601         UNISTR2 *uni_name = NULL;
1602         DOM_SID pol_sid;
1603         int num_rids = q_u->num_rids1;
1604         int i;
1605         uint32 acc_granted;
1606
1607         r_u->status = NT_STATUS_OK;
1608
1609         DEBUG(5,("_samr_lookup_rids: %d\n", __LINE__));
1610
1611         /* find the policy handle.  open a policy on it. */
1612         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &pol_sid, &acc_granted))
1613                 return NT_STATUS_INVALID_HANDLE;
1614
1615         if (num_rids > MAX_SAM_ENTRIES) {
1616                 num_rids = MAX_SAM_ENTRIES;
1617                 DEBUG(5,("_samr_lookup_rids: truncating entries to %d\n", num_rids));
1618         }
1619
1620         if (num_rids) {
1621                 if ((group_attrs = (uint32 *)talloc_zero(p->mem_ctx, num_rids * sizeof(uint32))) == NULL)
1622                         return NT_STATUS_NO_MEMORY;
1623         }
1624
1625         r_u->status = NT_STATUS_NONE_MAPPED;
1626
1627         become_root();  /* lookup_sid can require root privs */
1628
1629         for (i = 0; i < num_rids; i++) {
1630                 fstring tmpname;
1631                 fstring domname;
1632                 DOM_SID sid;
1633                 enum SID_NAME_USE type;
1634
1635                 group_attrs[i] = SID_NAME_UNKNOWN;
1636                 *group_names[i] = '\0';
1637
1638                 if (sid_equal(&pol_sid, get_global_sam_sid())) {
1639                         sid_copy(&sid, &pol_sid);
1640                         sid_append_rid(&sid, q_u->rid[i]);
1641
1642                         if (lookup_sid(&sid, domname, tmpname, &type)) {
1643                                 r_u->status = NT_STATUS_OK;
1644                                 group_attrs[i] = (uint32)type;
1645                                 fstrcpy(group_names[i],tmpname);
1646                                 DEBUG(5,("_samr_lookup_rids: %s:%d\n", group_names[i], group_attrs[i]));
1647                         }
1648                 }
1649         }
1650
1651         unbecome_root();
1652
1653         if(!make_samr_lookup_rids(p->mem_ctx, num_rids, group_names, &hdr_name, &uni_name))
1654                 return NT_STATUS_NO_MEMORY;
1655
1656         init_samr_r_lookup_rids(r_u, num_rids, hdr_name, uni_name, group_attrs);
1657
1658         DEBUG(5,("_samr_lookup_rids: %d\n", __LINE__));
1659
1660         return r_u->status;
1661 }
1662
1663 /*******************************************************************
1664  _samr_open_user. Safe - gives out no passwd info.
1665  ********************************************************************/
1666
1667 NTSTATUS _samr_open_user(pipes_struct *p, SAMR_Q_OPEN_USER *q_u, SAMR_R_OPEN_USER *r_u)
1668 {
1669         SAM_ACCOUNT *sampass=NULL;
1670         DOM_SID sid;
1671         POLICY_HND domain_pol = q_u->domain_pol;
1672         POLICY_HND *user_pol = &r_u->user_pol;
1673         struct samr_info *info = NULL;
1674         SEC_DESC *psd = NULL;
1675         uint32    acc_granted;
1676         uint32    des_access = q_u->access_mask;
1677         size_t    sd_size;
1678         BOOL ret;
1679         NTSTATUS nt_status;
1680
1681         r_u->status = NT_STATUS_OK;
1682
1683         /* find the domain policy handle and get domain SID / access bits in the domain policy. */
1684         if (!get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted))
1685                 return NT_STATUS_INVALID_HANDLE;
1686
1687         if (!NT_STATUS_IS_OK(nt_status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_open_user"))) {
1688                 return nt_status;
1689         }
1690
1691         nt_status = pdb_init_sam_talloc(p->mem_ctx, &sampass);
1692         if (!NT_STATUS_IS_OK(nt_status)) {
1693                 return nt_status;
1694         }
1695
1696         /* append the user's RID to it */
1697         if (!sid_append_rid(&sid, q_u->user_rid))
1698                 return NT_STATUS_NO_SUCH_USER;
1699
1700         /* check if access can be granted as requested by client. */
1701         samr_make_usr_obj_sd(p->mem_ctx, &psd, &sd_size, &sid);
1702         se_map_generic(&des_access, &usr_generic_mapping);
1703         if (!NT_STATUS_IS_OK(nt_status =
1704                              access_check_samr_object(psd, p->pipe_user.nt_user_token,
1705                                                       des_access, &acc_granted, "_samr_open_user"))) {
1706                 return nt_status;
1707         }
1708
1709         become_root();
1710         ret=pdb_getsampwsid(sampass, &sid);
1711         unbecome_root();
1712
1713         /* check that the SID exists in our domain. */
1714         if (ret == False) {
1715                 return NT_STATUS_NO_SUCH_USER;
1716         }
1717
1718         pdb_free_sam(&sampass);
1719
1720         /* associate the user's SID and access bits with the new handle. */
1721         if ((info = get_samr_info_by_sid(&sid)) == NULL)
1722                 return NT_STATUS_NO_MEMORY;
1723         info->acc_granted = acc_granted;
1724
1725         /* get a (unique) handle.  open a policy on it. */
1726         if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info))
1727                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1728
1729         return r_u->status;
1730 }
1731
1732 /*************************************************************************
1733  get_user_info_10. Safe. Only gives out acb bits.
1734  *************************************************************************/
1735
1736 static NTSTATUS get_user_info_10(TALLOC_CTX *mem_ctx, SAM_USER_INFO_10 *id10, DOM_SID *user_sid)
1737 {
1738         SAM_ACCOUNT *smbpass=NULL;
1739         BOOL ret;
1740         NTSTATUS nt_status;
1741
1742         nt_status = pdb_init_sam_talloc(mem_ctx, &smbpass);
1743
1744         if (!NT_STATUS_IS_OK(nt_status)) {
1745                 return nt_status;
1746         }
1747
1748         become_root();
1749         ret = pdb_getsampwsid(smbpass, user_sid);
1750         unbecome_root();
1751
1752         if (ret==False) {
1753                 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
1754                 return NT_STATUS_NO_SUCH_USER;
1755         }
1756
1757         DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass) ));
1758
1759         ZERO_STRUCTP(id10);
1760         init_sam_user_info10(id10, pdb_get_acct_ctrl(smbpass) );
1761
1762         pdb_free_sam(&smbpass);
1763
1764         return NT_STATUS_OK;
1765 }
1766
1767 /*************************************************************************
1768  get_user_info_12. OK - this is the killer as it gives out password info.
1769  Ensure that this is only allowed on an encrypted connection with a root
1770  user. JRA.
1771  *************************************************************************/
1772
1773 static NTSTATUS get_user_info_12(pipes_struct *p, TALLOC_CTX *mem_ctx, SAM_USER_INFO_12 * id12, DOM_SID *user_sid)
1774 {
1775         SAM_ACCOUNT *smbpass=NULL;
1776         BOOL ret;
1777         NTSTATUS nt_status;
1778
1779         if (!p->ntlmssp_auth_validated)
1780                 return NT_STATUS_ACCESS_DENIED;
1781
1782         if (!(p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) || !(p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL))
1783                 return NT_STATUS_ACCESS_DENIED;
1784
1785         /*
1786          * Do *NOT* do become_root()/unbecome_root() here ! JRA.
1787          */
1788
1789         nt_status = pdb_init_sam_talloc(mem_ctx, &smbpass);
1790
1791         if (!NT_STATUS_IS_OK(nt_status)) {
1792                 return nt_status;
1793         }
1794
1795         ret = pdb_getsampwsid(smbpass, user_sid);
1796
1797         if (ret == False) {
1798                 DEBUG(4, ("User %s not found\n", sid_string_static(user_sid)));
1799                 pdb_free_sam(&smbpass);
1800                 return (geteuid() == (uid_t)0) ? NT_STATUS_NO_SUCH_USER : NT_STATUS_ACCESS_DENIED;
1801         }
1802
1803         DEBUG(3,("User:[%s] 0x%x\n", pdb_get_username(smbpass), pdb_get_acct_ctrl(smbpass) ));
1804
1805         if ( pdb_get_acct_ctrl(smbpass) & ACB_DISABLED) {
1806                 pdb_free_sam(&smbpass);
1807                 return NT_STATUS_ACCOUNT_DISABLED;
1808         }
1809
1810         ZERO_STRUCTP(id12);
1811         init_sam_user_info12(id12, pdb_get_lanman_passwd(smbpass), pdb_get_nt_passwd(smbpass));
1812
1813         pdb_free_sam(&smbpass);
1814
1815         return NT_STATUS_OK;
1816 }
1817
1818 /*************************************************************************
1819  get_user_info_20
1820  *************************************************************************/
1821
1822 static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx, SAM_USER_INFO_20 *id20, DOM_SID *user_sid)
1823 {
1824         SAM_ACCOUNT *sampass=NULL;
1825         BOOL ret;
1826
1827         pdb_init_sam_talloc(mem_ctx, &sampass);
1828
1829         become_root();
1830         ret = pdb_getsampwsid(sampass, user_sid);
1831         unbecome_root();
1832
1833         if (ret == False) {
1834                 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
1835                 return NT_STATUS_NO_SUCH_USER;
1836         }
1837
1838         samr_clear_sam_passwd(sampass);
1839
1840         DEBUG(3,("User:[%s]\n",  pdb_get_username(sampass) ));
1841
1842         ZERO_STRUCTP(id20);
1843         init_sam_user_info20A(id20, sampass);
1844
1845         pdb_free_sam(&sampass);
1846
1847         return NT_STATUS_OK;
1848 }
1849
1850 /*************************************************************************
1851  get_user_info_21
1852  *************************************************************************/
1853
1854 static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx, SAM_USER_INFO_21 *id21,
1855                                  DOM_SID *user_sid, DOM_SID *domain_sid)
1856 {
1857         SAM_ACCOUNT *sampass=NULL;
1858         BOOL ret;
1859         NTSTATUS nt_status;
1860
1861         nt_status = pdb_init_sam_talloc(mem_ctx, &sampass);
1862         if (!NT_STATUS_IS_OK(nt_status)) {
1863                 return nt_status;
1864         }
1865
1866         become_root();
1867         ret = pdb_getsampwsid(sampass, user_sid);
1868         unbecome_root();
1869
1870         if (ret == False) {
1871                 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
1872                 return NT_STATUS_NO_SUCH_USER;
1873         }
1874
1875         samr_clear_sam_passwd(sampass);
1876
1877         DEBUG(3,("User:[%s]\n",  pdb_get_username(sampass) ));
1878
1879         ZERO_STRUCTP(id21);
1880         nt_status = init_sam_user_info21A(id21, sampass, domain_sid);
1881
1882         pdb_free_sam(&sampass);
1883
1884         return NT_STATUS_OK;
1885 }
1886
1887 /*******************************************************************
1888  _samr_query_userinfo
1889  ********************************************************************/
1890
1891 NTSTATUS _samr_query_userinfo(pipes_struct *p, SAMR_Q_QUERY_USERINFO *q_u, SAMR_R_QUERY_USERINFO *r_u)
1892 {
1893         SAM_USERINFO_CTR *ctr;
1894         struct samr_info *info = NULL;
1895         DOM_SID domain_sid;
1896         uint32 rid;
1897
1898         r_u->status=NT_STATUS_OK;
1899
1900         /* search for the handle */
1901         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
1902                 return NT_STATUS_INVALID_HANDLE;
1903
1904         domain_sid = info->sid;
1905
1906         sid_split_rid(&domain_sid, &rid);
1907
1908         if (!sid_check_is_in_our_domain(&info->sid))
1909                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1910
1911         DEBUG(5,("_samr_query_userinfo: sid:%s\n", sid_string_static(&info->sid)));
1912
1913         ctr = (SAM_USERINFO_CTR *)talloc_zero(p->mem_ctx, sizeof(SAM_USERINFO_CTR));
1914         if (!ctr)
1915                 return NT_STATUS_NO_MEMORY;
1916
1917         ZERO_STRUCTP(ctr);
1918
1919         /* ok!  user info levels (lots: see MSDEV help), off we go... */
1920         ctr->switch_value = q_u->switch_value;
1921
1922         switch (q_u->switch_value) {
1923         case 0x10:
1924                 ctr->info.id10 = (SAM_USER_INFO_10 *)talloc_zero(p->mem_ctx, sizeof(SAM_USER_INFO_10));
1925                 if (ctr->info.id10 == NULL)
1926                         return NT_STATUS_NO_MEMORY;
1927
1928                 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_10(p->mem_ctx, ctr->info.id10, &info->sid)))
1929                         return r_u->status;
1930                 break;
1931
1932 #if 0
1933 /* whoops - got this wrong.  i think.  or don't understand what's happening. */
1934         case 0x11:
1935         {
1936             NTTIME expire;
1937             info = (void *)&id11;
1938
1939             expire.low = 0xffffffff;
1940             expire.high = 0x7fffffff;
1941
1942             ctr->info.id = (SAM_USER_INFO_11 *)talloc_zero(p->mem_ctx,
1943                                     sizeof
1944                                     (*ctr->
1945                                      info.
1946                                      id11));
1947             ZERO_STRUCTP(ctr->info.id11);
1948             init_sam_user_info11(ctr->info.id11, &expire,
1949                          "BROOKFIELDS$",    /* name */
1950                          0x03ef,    /* user rid */
1951                          0x201, /* group rid */
1952                          0x0080);   /* acb info */
1953
1954             break;
1955         }
1956 #endif
1957
1958         case 0x12:
1959                 ctr->info.id12 = (SAM_USER_INFO_12 *)talloc_zero(p->mem_ctx, sizeof(SAM_USER_INFO_12));
1960                 if (ctr->info.id12 == NULL)
1961                         return NT_STATUS_NO_MEMORY;
1962
1963                 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_12(p, p->mem_ctx, ctr->info.id12, &info->sid)))
1964                         return r_u->status;
1965                 break;
1966
1967         case 20:
1968                 ctr->info.id20 = (SAM_USER_INFO_20 *)talloc_zero(p->mem_ctx,sizeof(SAM_USER_INFO_20));
1969                 if (ctr->info.id20 == NULL)
1970                         return NT_STATUS_NO_MEMORY;
1971                 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_20(p->mem_ctx, ctr->info.id20, &info->sid)))
1972                         return r_u->status;
1973                 break;
1974
1975         case 21:
1976                 ctr->info.id21 = (SAM_USER_INFO_21 *)talloc_zero(p->mem_ctx,sizeof(SAM_USER_INFO_21));
1977                 if (ctr->info.id21 == NULL)
1978                         return NT_STATUS_NO_MEMORY;
1979                 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_21(p->mem_ctx, ctr->info.id21,
1980                                                                     &info->sid, &domain_sid)))
1981                         return r_u->status;
1982                 break;
1983
1984         default:
1985                 return NT_STATUS_INVALID_INFO_CLASS;
1986         }
1987
1988         init_samr_r_query_userinfo(r_u, ctr, r_u->status);
1989
1990         DEBUG(5,("_samr_query_userinfo: %d\n", __LINE__));
1991
1992         return r_u->status;
1993 }
1994
1995 /*******************************************************************
1996  samr_reply_query_usergroups
1997  ********************************************************************/
1998
1999 NTSTATUS _samr_query_usergroups(pipes_struct *p, SAMR_Q_QUERY_USERGROUPS *q_u, SAMR_R_QUERY_USERGROUPS *r_u)
2000 {
2001         SAM_ACCOUNT *sam_pass=NULL;
2002         DOM_SID  sid;
2003         DOM_GID *gids = NULL;
2004         int num_groups = 0;
2005         uint32 acc_granted;
2006         BOOL ret;
2007
2008         /*
2009          * from the SID in the request:
2010          * we should send back the list of DOMAIN GROUPS
2011          * the user is a member of
2012          *
2013          * and only the DOMAIN GROUPS
2014          * no ALIASES !!! neither aliases of the domain
2015          * nor aliases of the builtin SID
2016          *
2017          * JFM, 12/2/2001
2018          */
2019
2020         r_u->status = NT_STATUS_OK;
2021
2022         DEBUG(5,("_samr_query_usergroups: %d\n", __LINE__));
2023
2024         /* find the policy handle.  open a policy on it. */
2025         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted))
2026                 return NT_STATUS_INVALID_HANDLE;
2027
2028         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_USER_GET_GROUPS, "_samr_query_usergroups"))) {
2029                 return r_u->status;
2030         }
2031
2032         if (!sid_check_is_in_our_domain(&sid))
2033                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
2034
2035         pdb_init_sam(&sam_pass);
2036
2037         become_root();
2038         ret = pdb_getsampwsid(sam_pass, &sid);
2039         unbecome_root();
2040
2041         if (ret == False) {
2042                 pdb_free_sam(&sam_pass);
2043                 return NT_STATUS_NO_SUCH_USER;
2044         }
2045
2046         if(!get_domain_user_groups(p->mem_ctx, &num_groups, &gids, sam_pass)) {
2047                 pdb_free_sam(&sam_pass);
2048                 return NT_STATUS_NO_SUCH_GROUP;
2049         }
2050
2051         /* construct the response.  lkclXXXX: gids are not copied! */
2052         init_samr_r_query_usergroups(r_u, num_groups, gids, r_u->status);
2053
2054         DEBUG(5,("_samr_query_usergroups: %d\n", __LINE__));
2055
2056         pdb_free_sam(&sam_pass);
2057
2058         return r_u->status;
2059 }
2060
2061 /*******************************************************************
2062  _samr_query_dom_info
2063  ********************************************************************/
2064
2065 NTSTATUS _samr_query_dom_info(pipes_struct *p, SAMR_Q_QUERY_DOMAIN_INFO *q_u, SAMR_R_QUERY_DOMAIN_INFO *r_u)
2066 {
2067         struct samr_info *info = NULL;
2068         SAM_UNK_CTR *ctr;
2069         uint32 min_pass_len,pass_hist,flag;
2070         time_t u_expire, u_min_age;
2071         NTTIME nt_expire, nt_min_age;
2072
2073         time_t u_lock_duration, u_reset_time;
2074         NTTIME nt_lock_duration, nt_reset_time;
2075         uint32 lockout;
2076
2077         time_t u_logout;
2078         NTTIME nt_logout;
2079
2080         uint32 account_policy_temp;
2081
2082         uint32 num_users=0, num_groups=0, num_aliases=0;
2083
2084         if ((ctr = (SAM_UNK_CTR *)talloc_zero(p->mem_ctx, sizeof(SAM_UNK_CTR))) == NULL)
2085                 return NT_STATUS_NO_MEMORY;
2086
2087         ZERO_STRUCTP(ctr);
2088
2089         r_u->status = NT_STATUS_OK;
2090
2091         DEBUG(5,("_samr_query_dom_info: %d\n", __LINE__));
2092
2093         /* find the policy handle.  open a policy on it. */
2094         if (!find_policy_by_hnd(p, &q_u->domain_pol, (void **)&info))
2095                 return NT_STATUS_INVALID_HANDLE;
2096
2097         switch (q_u->switch_value) {
2098                 case 0x01:
2099
2100                         account_policy_get(AP_MIN_PASSWORD_LEN, &account_policy_temp);
2101                         min_pass_len = account_policy_temp;
2102
2103                         account_policy_get(AP_PASSWORD_HISTORY, &account_policy_temp);
2104                         pass_hist = account_policy_temp;
2105
2106                         account_policy_get(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp);
2107                         flag = account_policy_temp;
2108
2109                         account_policy_get(AP_MAX_PASSWORD_AGE, &account_policy_temp);
2110                         u_expire = account_policy_temp;
2111
2112                         account_policy_get(AP_MIN_PASSWORD_AGE, &account_policy_temp);
2113                         u_min_age = account_policy_temp;
2114
2115                         unix_to_nt_time_abs(&nt_expire, u_expire);
2116                         unix_to_nt_time_abs(&nt_min_age, u_min_age);
2117
2118                         init_unk_info1(&ctr->info.inf1, (uint16)min_pass_len, (uint16)pass_hist,
2119                                        flag, nt_expire, nt_min_age);
2120                         break;
2121                 case 0x02:
2122                         become_root();
2123                         r_u->status=load_sampwd_entries(info, ACB_NORMAL, False);
2124                         unbecome_root();
2125                         if (!NT_STATUS_IS_OK(r_u->status)) {
2126                                 DEBUG(5, ("_samr_query_dispinfo: load_sampwd_entries failed\n"));
2127                                 return r_u->status;
2128                         }
2129                         num_users=info->disp_info.num_user_account;
2130                         free_samr_db(info);
2131
2132                         r_u->status=load_group_domain_entries(info, get_global_sam_sid());
2133                         if (!NT_STATUS_IS_OK(r_u->status)) {
2134                                 DEBUG(5, ("_samr_query_dispinfo: load_group_domain_entries failed\n"));
2135                                 return r_u->status;
2136                         }
2137                         num_groups=info->disp_info.num_group_account;
2138                         free_samr_db(info);
2139
2140                         /* The time call below is to get a sequence number for the sam. FIXME !!! JRA. */
2141                         init_unk_info2(&ctr->info.inf2, lp_workgroup(), global_myname(), (uint32) time(NULL),
2142                                        num_users, num_groups, num_aliases);
2143                         break;
2144                 case 0x03:
2145                         account_policy_get(AP_TIME_TO_LOGOUT, (unsigned int *)&u_logout);
2146                         unix_to_nt_time_abs(&nt_logout, u_logout);
2147
2148                         init_unk_info3(&ctr->info.inf3, nt_logout);
2149                         break;
2150                 case 0x05:
2151                         init_unk_info5(&ctr->info.inf5, global_myname());
2152                         break;
2153                 case 0x06:
2154                         init_unk_info6(&ctr->info.inf6);
2155                         break;
2156                 case 0x07:
2157                         init_unk_info7(&ctr->info.inf7);
2158                         break;
2159                 case 0x0c:
2160                         account_policy_get(AP_LOCK_ACCOUNT_DURATION, &account_policy_temp);
2161                         u_lock_duration = account_policy_temp;
2162
2163                         account_policy_get(AP_RESET_COUNT_TIME, &account_policy_temp);
2164                         u_reset_time = account_policy_temp;
2165
2166                         account_policy_get(AP_BAD_ATTEMPT_LOCKOUT, &account_policy_temp);
2167                         lockout = account_policy_temp;
2168
2169                         unix_to_nt_time_abs(&nt_lock_duration, u_lock_duration);
2170                         unix_to_nt_time_abs(&nt_reset_time, u_reset_time);
2171
2172                         init_unk_info12(&ctr->info.inf12, nt_lock_duration, nt_reset_time, (uint16)lockout);
2173                         break;
2174                 default:
2175                         return NT_STATUS_INVALID_INFO_CLASS;
2176                 }
2177
2178         init_samr_r_query_dom_info(r_u, q_u->switch_value, ctr, NT_STATUS_OK);
2179
2180         DEBUG(5,("_samr_query_dom_info: %d\n", __LINE__));
2181
2182         return r_u->status;
2183 }
2184
2185 /*******************************************************************
2186  _samr_create_user
2187  Create an account, can be either a normal user or a machine.
2188  This funcion will need to be updated for bdc/domain trusts.
2189  ********************************************************************/
2190
2191 NTSTATUS _samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_CREATE_USER *r_u)
2192 {
2193         SAM_ACCOUNT *sam_pass=NULL;
2194         fstring account;
2195         DOM_SID sid;
2196         pstring add_script;
2197         POLICY_HND dom_pol = q_u->domain_pol;
2198         UNISTR2 user_account = q_u->uni_name;
2199         uint16 acb_info = q_u->acb_info;
2200         POLICY_HND *user_pol = &r_u->user_pol;
2201         struct samr_info *info = NULL;
2202         BOOL ret;
2203         NTSTATUS nt_status;
2204         struct passwd *pw;
2205         uint32 acc_granted;
2206         SEC_DESC *psd;
2207         size_t    sd_size;
2208         uint32 new_rid = 0;
2209         /* check this, when giving away 'add computer to domain' privs */
2210         uint32    des_access = GENERIC_RIGHTS_USER_ALL_ACCESS;
2211
2212         /* Get the domain SID stored in the domain policy */
2213         if (!get_lsa_policy_samr_sid(p, &dom_pol, &sid, &acc_granted))
2214                 return NT_STATUS_INVALID_HANDLE;
2215
2216         if (!NT_STATUS_IS_OK(nt_status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_CREATE_USER, "_samr_create_user"))) {
2217                 return nt_status;
2218         }
2219
2220         /* find the account: tell the caller if it exists.
2221           lkclXXXX i have *no* idea if this is a problem or not
2222           or even if you are supposed to construct a different
2223           reply if the account already exists...
2224          */
2225
2226         rpcstr_pull(account, user_account.buffer, sizeof(account), user_account.uni_str_len*2, 0);
2227         strlower_m(account);
2228
2229         pdb_init_sam(&sam_pass);
2230
2231         become_root();
2232         ret = pdb_getsampwnam(sam_pass, account);
2233         unbecome_root();
2234         if (ret == True) {
2235                 /* this account exists: say so */
2236                 pdb_free_sam(&sam_pass);
2237                 return NT_STATUS_USER_EXISTS;
2238         }
2239
2240         pdb_free_sam(&sam_pass);
2241
2242         /*
2243          * NB. VERY IMPORTANT ! This call must be done as the current pipe user,
2244          * *NOT* surrounded by a become_root()/unbecome_root() call. This ensures
2245          * that only people with write access to the smbpasswd file will be able
2246          * to create a user. JRA.
2247          */
2248
2249         /*
2250          * add the user in the /etc/passwd file or the unix authority system.
2251          * We don't check if the smb_create_user() function succed or not for 2 reasons:
2252          * a) local_password_change() checks for us if the /etc/passwd account really exists
2253          * b) smb_create_user() would return an error if the account already exists
2254          * and as it could return an error also if it can't create the account, it would be tricky.
2255          *
2256          * So we go the easy way, only check after if the account exists.
2257          * JFM (2/3/2001), to clear any possible bad understanding (-:
2258          *
2259          * We now have seperate script paramaters for adding users/machines so we
2260          * now have some sainity-checking to match.
2261          */
2262
2263         DEBUG(10,("checking account %s at pos %lu for $ termination\n",account, (unsigned long)strlen(account)-1));
2264
2265         /*
2266          * we used to have code here that made sure the acb_info flags
2267          * matched with the users named (e.g. an account flags as a machine
2268          * trust account ended in '$').  It has been ifdef'd out for a long
2269          * time, so I replaced it with this comment.     --jerry
2270          */
2271
2272         /* the passdb lookup has failed; check to see if we need to run the
2273            add user/machine script */
2274
2275         pw = Get_Pwnam(account);
2276
2277         /*********************************************************************
2278          * HEADS UP!  If we have to create a new user account, we have to get
2279          * a new RID from somewhere.  This used to be done by the passdb
2280          * backend. It has been moved into idmap now.  Since idmap is now
2281          * wrapped up behind winbind, this means you have to run winbindd if you
2282          * want new accounts to get a new RID when "enable rid algorithm = no".
2283          * Tough.  We now have a uniform way of allocating RIDs regardless
2284          * of what ever passdb backend people may use.
2285          *                                             --jerry (2003-07-10)
2286          *********************************************************************/
2287
2288         if ( !pw ) {
2289                 /*
2290                  * we can't check both the ending $ and the acb_info.
2291                  *
2292                  * UserManager creates trust accounts (ending in $,
2293                  * normal that hidden accounts) with the acb_info equals to ACB_NORMAL.
2294                  * JFM, 11/29/2001
2295                  */
2296                 if (account[strlen(account)-1] == '$')
2297                         pstrcpy(add_script, lp_addmachine_script());
2298                 else
2299                         pstrcpy(add_script, lp_adduser_script());
2300
2301                 if (*add_script) {
2302                         int add_ret;
2303                         all_string_sub(add_script, "%u", account, sizeof(account));
2304                         add_ret = smbrun(add_script,NULL);
2305                         DEBUG(3,("_samr_create_user: Running the command `%s' gave %d\n", add_script, add_ret));
2306                 }
2307                 else    /* no add user script -- ask winbindd to do it */
2308                 {
2309                         if ( !winbind_create_user( account, &new_rid ) ) {
2310                                 DEBUG(3,("_samr_create_user: winbind_create_user(%s) failed\n",
2311                                         account));
2312                         }
2313                 }
2314
2315         }
2316
2317         /* implicit call to getpwnam() next.  we have a valid SID coming out of this call */
2318
2319         if ( !NT_STATUS_IS_OK(nt_status = pdb_init_sam_new(&sam_pass, account, new_rid)) )
2320                 return nt_status;
2321
2322         pdb_set_acct_ctrl(sam_pass, acb_info, PDB_CHANGED);
2323
2324         if (!pdb_add_sam_account(sam_pass)) {
2325                 pdb_free_sam(&sam_pass);
2326                 DEBUG(0, ("could not add user/computer %s to passdb.  Check permissions?\n",
2327                           account));
2328                 return NT_STATUS_ACCESS_DENIED;
2329         }
2330
2331         /* Get the user's SID */
2332         sid_copy(&sid, pdb_get_user_sid(sam_pass));
2333
2334         samr_make_usr_obj_sd(p->mem_ctx, &psd, &sd_size, &sid);
2335         se_map_generic(&des_access, &usr_generic_mapping);
2336         if (!NT_STATUS_IS_OK(nt_status =
2337                              access_check_samr_object(psd, p->pipe_user.nt_user_token,
2338                                                       des_access, &acc_granted, "_samr_create_user"))) {
2339                 return nt_status;
2340         }
2341
2342         /* associate the user's SID with the new handle. */
2343         if ((info = get_samr_info_by_sid(&sid)) == NULL) {
2344                 pdb_free_sam(&sam_pass);
2345                 return NT_STATUS_NO_MEMORY;
2346         }
2347
2348         ZERO_STRUCTP(info);
2349         info->sid = sid;
2350         info->acc_granted = acc_granted;
2351
2352         /* get a (unique) handle.  open a policy on it. */
2353         if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info)) {
2354                 pdb_free_sam(&sam_pass);
2355                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2356         }
2357
2358         r_u->user_rid=pdb_get_user_rid(sam_pass);
2359
2360         r_u->access_granted = acc_granted;
2361
2362         pdb_free_sam(&sam_pass);
2363
2364         return NT_STATUS_OK;
2365 }
2366
2367 /*******************************************************************
2368  samr_reply_connect_anon
2369  ********************************************************************/
2370
2371 NTSTATUS _samr_connect_anon(pipes_struct *p, SAMR_Q_CONNECT_ANON *q_u, SAMR_R_CONNECT_ANON *r_u)
2372 {
2373         struct samr_info *info = NULL;
2374         uint32    des_access = q_u->access_mask;
2375
2376         /* Access check */
2377
2378         if (!pipe_access_check(p)) {
2379                 DEBUG(3, ("access denied to samr_connect_anon\n"));
2380                 r_u->status = NT_STATUS_ACCESS_DENIED;
2381                 return r_u->status;
2382         }
2383
2384         /* set up the SAMR connect_anon response */
2385
2386         r_u->status = NT_STATUS_OK;
2387
2388         /* associate the user's SID with the new handle. */
2389         if ((info = get_samr_info_by_sid(NULL)) == NULL)
2390                 return NT_STATUS_NO_MEMORY;
2391
2392         /* don't give away the farm but this is probably ok.  The SA_RIGHT_SAM_ENUM_DOMAINS
2393            was observed from a win98 client trying to enumerate users (when configured
2394            user level access control on shares)   --jerry */
2395
2396         se_map_generic( &des_access, &sam_generic_mapping );
2397         info->acc_granted = des_access & (SA_RIGHT_SAM_ENUM_DOMAINS|SA_RIGHT_SAM_OPEN_DOMAIN);
2398
2399         info->status = q_u->unknown_0;
2400
2401         /* get a (unique) handle.  open a policy on it. */
2402         if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
2403                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2404
2405         return r_u->status;
2406 }
2407
2408 /*******************************************************************
2409  samr_reply_connect
2410  ********************************************************************/
2411
2412 NTSTATUS _samr_connect(pipes_struct *p, SAMR_Q_CONNECT *q_u, SAMR_R_CONNECT *r_u)
2413 {
2414         struct samr_info *info = NULL;
2415         SEC_DESC *psd = NULL;
2416         uint32    acc_granted;
2417         uint32    des_access = q_u->access_mask;
2418         size_t    sd_size;
2419         NTSTATUS  nt_status;
2420
2421
2422         DEBUG(5,("_samr_connect: %d\n", __LINE__));
2423
2424         /* Access check */
2425
2426         if (!pipe_access_check(p)) {
2427                 DEBUG(3, ("access denied to samr_connect\n"));
2428                 r_u->status = NT_STATUS_ACCESS_DENIED;
2429                 return r_u->status;
2430         }
2431
2432         samr_make_sam_obj_sd(p->mem_ctx, &psd, &sd_size);
2433         se_map_generic(&des_access, &sam_generic_mapping);
2434         if (!NT_STATUS_IS_OK(nt_status =
2435                              access_check_samr_object(psd, p->pipe_user.nt_user_token,
2436                                                       des_access, &acc_granted, "_samr_connect"))) {
2437                 return nt_status;
2438         }
2439
2440         r_u->status = NT_STATUS_OK;
2441
2442         /* associate the user's SID and access granted with the new handle. */
2443         if ((info = get_samr_info_by_sid(NULL)) == NULL)
2444                 return NT_STATUS_NO_MEMORY;
2445
2446         info->acc_granted = acc_granted;
2447         info->status = q_u->access_mask;
2448
2449         /* get a (unique) handle.  open a policy on it. */
2450         if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
2451                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2452
2453         DEBUG(5,("_samr_connect: %d\n", __LINE__));
2454
2455         return r_u->status;
2456 }
2457
2458 /*******************************************************************
2459  samr_connect4
2460  ********************************************************************/
2461
2462 NTSTATUS _samr_connect4(pipes_struct *p, SAMR_Q_CONNECT4 *q_u, SAMR_R_CONNECT4 *r_u)
2463 {
2464         struct samr_info *info = NULL;
2465         SEC_DESC *psd = NULL;
2466         uint32    acc_granted;
2467         uint32    des_access = q_u->access_mask;
2468         size_t    sd_size;
2469         NTSTATUS  nt_status;
2470
2471
2472         DEBUG(5,("_samr_connect4: %d\n", __LINE__));
2473
2474         /* Access check */
2475
2476         if (!pipe_access_check(p)) {
2477                 DEBUG(3, ("access denied to samr_connect4\n"));
2478                 r_u->status = NT_STATUS_ACCESS_DENIED;
2479                 return r_u->status;
2480         }
2481
2482         samr_make_sam_obj_sd(p->mem_ctx, &psd, &sd_size);
2483         se_map_generic(&des_access, &sam_generic_mapping);
2484         if (!NT_STATUS_IS_OK(nt_status =
2485                              access_check_samr_object(psd, p->pipe_user.nt_user_token,
2486                                                       des_access, &acc_granted, "_samr_connect"))) {
2487                 return nt_status;
2488         }
2489
2490         r_u->status = NT_STATUS_OK;
2491
2492         /* associate the user's SID and access granted with the new handle. */
2493         if ((info = get_samr_info_by_sid(NULL)) == NULL)
2494                 return NT_STATUS_NO_MEMORY;
2495
2496         info->acc_granted = acc_granted;
2497         info->status = q_u->access_mask;
2498
2499         /* get a (unique) handle.  open a policy on it. */
2500         if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
2501                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2502
2503         DEBUG(5,("_samr_connect: %d\n", __LINE__));
2504
2505         return r_u->status;
2506 }
2507
2508 /**********************************************************************
2509  api_samr_lookup_domain
2510  **********************************************************************/
2511
2512 NTSTATUS _samr_lookup_domain(pipes_struct *p, SAMR_Q_LOOKUP_DOMAIN *q_u, SAMR_R_LOOKUP_DOMAIN *r_u)
2513 {
2514         struct samr_info *info;
2515         fstring domain_name;
2516         DOM_SID sid;
2517
2518         r_u->status = NT_STATUS_OK;
2519
2520         if (!find_policy_by_hnd(p, &q_u->connect_pol, (void**)&info))
2521                 return NT_STATUS_INVALID_HANDLE;
2522
2523         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted,
2524                 SA_RIGHT_SAM_ENUM_DOMAINS, "_samr_lookup_domain")))
2525         {
2526                 return r_u->status;
2527         }
2528
2529         rpcstr_pull(domain_name, q_u->uni_domain.buffer, sizeof(domain_name), q_u->uni_domain.uni_str_len*2, 0);
2530
2531         ZERO_STRUCT(sid);
2532
2533         if (!secrets_fetch_domain_sid(domain_name, &sid)) {
2534                 r_u->status = NT_STATUS_NO_SUCH_DOMAIN;
2535         }
2536
2537         DEBUG(2,("Returning domain sid for domain %s -> %s\n", domain_name, sid_string_static(&sid)));
2538
2539         init_samr_r_lookup_domain(r_u, &sid, r_u->status);
2540
2541         return r_u->status;
2542 }
2543
2544 /******************************************************************
2545 makes a SAMR_R_ENUM_DOMAINS structure.
2546 ********************************************************************/
2547
2548 static BOOL make_enum_domains(TALLOC_CTX *ctx, SAM_ENTRY **pp_sam,
2549                         UNISTR2 **pp_uni_name, uint32 num_sam_entries, fstring doms[])
2550 {
2551         uint32 i;
2552         SAM_ENTRY *sam;
2553         UNISTR2 *uni_name;
2554
2555         DEBUG(5, ("make_enum_domains\n"));
2556
2557         *pp_sam = NULL;
2558         *pp_uni_name = NULL;
2559
2560         if (num_sam_entries == 0)
2561                 return True;
2562
2563         sam = (SAM_ENTRY *)talloc_zero(ctx, sizeof(SAM_ENTRY)*num_sam_entries);
2564         uni_name = (UNISTR2 *)talloc_zero(ctx, sizeof(UNISTR2)*num_sam_entries);
2565
2566         if (sam == NULL || uni_name == NULL)
2567                 return False;
2568
2569         for (i = 0; i < num_sam_entries; i++) {
2570                 init_unistr2(&uni_name[i], doms[i], UNI_FLAGS_NONE);
2571                 init_sam_entry(&sam[i], &uni_name[i], 0);
2572         }
2573
2574         *pp_sam = sam;
2575         *pp_uni_name = uni_name;
2576
2577         return True;
2578 }
2579
2580 /**********************************************************************
2581  api_samr_enum_domains
2582  **********************************************************************/
2583
2584 NTSTATUS _samr_enum_domains(pipes_struct *p, SAMR_Q_ENUM_DOMAINS *q_u, SAMR_R_ENUM_DOMAINS *r_u)
2585 {
2586         struct samr_info *info;
2587         uint32 num_entries = 2;
2588         fstring dom[2];
2589         const char *name;
2590
2591         r_u->status = NT_STATUS_OK;
2592
2593         if (!find_policy_by_hnd(p, &q_u->pol, (void**)&info))
2594                 return NT_STATUS_INVALID_HANDLE;
2595
2596         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted, SA_RIGHT_SAM_ENUM_DOMAINS, "_samr_enum_domains"))) {
2597                 return r_u->status;
2598         }
2599
2600         name = get_global_sam_name();
2601
2602         fstrcpy(dom[0],name);
2603         strupper_m(dom[0]);
2604         fstrcpy(dom[1],"Builtin");
2605
2606         if (!make_enum_domains(p->mem_ctx, &r_u->sam, &r_u->uni_dom_name, num_entries, dom))
2607                 return NT_STATUS_NO_MEMORY;
2608
2609         init_samr_r_enum_domains(r_u, q_u->start_idx + num_entries, num_entries);
2610
2611         return r_u->status;
2612 }
2613
2614 /*******************************************************************
2615  api_samr_open_alias
2616  ********************************************************************/
2617
2618 NTSTATUS _samr_open_alias(pipes_struct *p, SAMR_Q_OPEN_ALIAS *q_u, SAMR_R_OPEN_ALIAS *r_u)
2619 {
2620         DOM_SID sid;
2621         POLICY_HND domain_pol = q_u->dom_pol;
2622         uint32 alias_rid = q_u->rid_alias;
2623         POLICY_HND *alias_pol = &r_u->pol;
2624         struct    samr_info *info = NULL;
2625         SEC_DESC *psd = NULL;
2626         uint32    acc_granted;
2627         uint32    des_access = q_u->access_mask;
2628         size_t    sd_size;
2629         NTSTATUS  status;
2630
2631         r_u->status = NT_STATUS_OK;
2632
2633         /* find the domain policy and get the SID / access bits stored in the domain policy */
2634         if (!get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted))
2635                 return NT_STATUS_INVALID_HANDLE;
2636
2637         if (!NT_STATUS_IS_OK(status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_open_alias"))) {
2638                 return status;
2639         }
2640
2641         /* append the alias' RID to it */
2642         if (!sid_append_rid(&sid, alias_rid))
2643                 return NT_STATUS_NO_SUCH_USER;
2644
2645         /*check if access can be granted as requested by client. */
2646         samr_make_ali_obj_sd(p->mem_ctx, &psd, &sd_size);
2647         se_map_generic(&des_access,&ali_generic_mapping);
2648         if (!NT_STATUS_IS_OK(status =
2649                              access_check_samr_object(psd, p->pipe_user.nt_user_token,
2650                                                       des_access, &acc_granted, "_samr_open_alias"))) {
2651                 return status;
2652         }
2653
2654         /*
2655          * we should check if the rid really exist !!!
2656          * JFM.
2657          */
2658
2659         /* associate the user's SID with the new handle. */
2660         if ((info = get_samr_info_by_sid(&sid)) == NULL)
2661                 return NT_STATUS_NO_MEMORY;
2662
2663         info->acc_granted = acc_granted;
2664
2665         /* get a (unique) handle.  open a policy on it. */
2666         if (!create_policy_hnd(p, alias_pol, free_samr_info, (void *)info))
2667                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2668
2669         return r_u->status;
2670 }
2671
2672 /*******************************************************************
2673  set_user_info_10
2674  ********************************************************************/
2675
2676 static BOOL set_user_info_10(const SAM_USER_INFO_10 *id10, DOM_SID *sid)
2677 {
2678         SAM_ACCOUNT *pwd =NULL;
2679         BOOL ret;
2680
2681         pdb_init_sam(&pwd);
2682
2683         ret = pdb_getsampwsid(pwd, sid);
2684
2685         if(ret==False) {
2686                 pdb_free_sam(&pwd);
2687                 return False;
2688         }
2689
2690         if (id10 == NULL) {
2691                 DEBUG(5, ("set_user_info_10: NULL id10\n"));
2692                 pdb_free_sam(&pwd);
2693                 return False;
2694         }
2695
2696         /* FIX ME: check if the value is really changed --metze */
2697         if (!pdb_set_acct_ctrl(pwd, id10->acb_info, PDB_CHANGED)) {
2698                 pdb_free_sam(&pwd);
2699                 return False;
2700         }
2701
2702         if(!pdb_update_sam_account(pwd)) {
2703                 pdb_free_sam(&pwd);
2704                 return False;
2705         }
2706
2707         pdb_free_sam(&pwd);
2708
2709         return True;
2710 }
2711
2712 /*******************************************************************
2713  set_user_info_12
2714  ********************************************************************/
2715
2716 static BOOL set_user_info_12(SAM_USER_INFO_12 *id12, DOM_SID *sid)
2717 {
2718         SAM_ACCOUNT *pwd = NULL;
2719
2720         pdb_init_sam(&pwd);
2721
2722         if(!pdb_getsampwsid(pwd, sid)) {
2723                 pdb_free_sam(&pwd);
2724                 return False;
2725         }
2726
2727         if (id12 == NULL) {
2728                 DEBUG(2, ("set_user_info_12: id12 is NULL\n"));
2729                 pdb_free_sam(&pwd);
2730                 return False;
2731         }
2732
2733         if (!pdb_set_lanman_passwd (pwd, id12->lm_pwd, PDB_CHANGED)) {
2734                 pdb_free_sam(&pwd);
2735                 return False;
2736         }
2737         if (!pdb_set_nt_passwd     (pwd, id12->nt_pwd, PDB_CHANGED)) {
2738                 pdb_free_sam(&pwd);
2739                 return False;
2740         }
2741         if (!pdb_set_pass_changed_now (pwd)) {
2742                 pdb_free_sam(&pwd);
2743                 return False;
2744         }
2745
2746         if(!pdb_update_sam_account(pwd)) {
2747                 pdb_free_sam(&pwd);
2748                 return False;
2749         }
2750
2751         pdb_free_sam(&pwd);
2752         return True;
2753 }
2754
2755 /*******************************************************************
2756  The GROUPSID field in the SAM_ACCOUNT changed. Try to tell unix.
2757  ********************************************************************/
2758 static BOOL set_unix_primary_group(SAM_ACCOUNT *sampass)
2759 {
2760         struct group *grp;
2761         gid_t gid;
2762
2763         if (!NT_STATUS_IS_OK(sid_to_gid(pdb_get_group_sid(sampass),
2764                                         &gid))) {
2765                 DEBUG(2,("Could not get gid for primary group of "
2766                          "user %s\n", pdb_get_username(sampass)));
2767                 return False;
2768         }
2769
2770         grp = getgrgid(gid);
2771
2772         if (grp == NULL) {
2773                 DEBUG(2,("Could not find primary group %lu for "
2774                          "user %s\n", (unsigned long)gid,
2775                          pdb_get_username(sampass)));
2776                 return False;
2777         }
2778
2779         if (smb_set_primary_group(grp->gr_name,
2780                                   pdb_get_username(sampass)) != 0) {
2781                 DEBUG(2,("Could not set primary group for user %s to "
2782                          "%s\n",
2783                          pdb_get_username(sampass), grp->gr_name));
2784                 return False;
2785         }
2786
2787         return True;
2788 }
2789
2790
2791 /*******************************************************************
2792  set_user_info_21
2793  ********************************************************************/
2794
2795 static BOOL set_user_info_21(SAM_USER_INFO_21 *id21, DOM_SID *sid)
2796 {
2797         SAM_ACCOUNT *pwd = NULL;
2798
2799         if (id21 == NULL) {
2800                 DEBUG(5, ("set_user_info_21: NULL id21\n"));
2801                 return False;
2802         }
2803
2804         pdb_init_sam(&pwd);
2805
2806         if (!pdb_getsampwsid(pwd, sid)) {
2807                 pdb_free_sam(&pwd);
2808                 return False;
2809         }
2810
2811         copy_id21_to_sam_passwd(pwd, id21);
2812
2813         /*
2814          * The funny part about the previous two calls is
2815          * that pwd still has the password hashes from the
2816          * passdb entry.  These have not been updated from
2817          * id21.  I don't know if they need to be set.    --jerry
2818          */
2819
2820         if (IS_SAM_CHANGED(pwd, PDB_GROUPSID))
2821                 set_unix_primary_group(pwd);
2822
2823         /* write the change out */
2824         if(!pdb_update_sam_account(pwd)) {
2825                 pdb_free_sam(&pwd);
2826                 return False;
2827         }
2828
2829         pdb_free_sam(&pwd);
2830
2831         return True;
2832 }
2833
2834 /*******************************************************************
2835  set_user_info_23
2836  ********************************************************************/
2837
2838 static BOOL set_user_info_23(SAM_USER_INFO_23 *id23, DOM_SID *sid)
2839 {
2840         SAM_ACCOUNT *pwd = NULL;
2841         pstring plaintext_buf;
2842         uint32 len;
2843         uint16 acct_ctrl;
2844
2845         if (id23 == NULL) {
2846                 DEBUG(5, ("set_user_info_23: NULL id23\n"));
2847                 return False;
2848         }
2849
2850         pdb_init_sam(&pwd);
2851
2852         if (!pdb_getsampwsid(pwd, sid)) {
2853                 pdb_free_sam(&pwd);
2854                 return False;
2855         }
2856
2857         DEBUG(5, ("Attempting administrator password change (level 23) for user %s\n",
2858                   pdb_get_username(pwd)));
2859
2860         acct_ctrl = pdb_get_acct_ctrl(pwd);
2861
2862         if (!decode_pw_buffer((char*)id23->pass, plaintext_buf, 256, &len)) {
2863                 pdb_free_sam(&pwd);
2864                 return False;
2865         }
2866
2867         if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
2868                 pdb_free_sam(&pwd);
2869                 return False;
2870         }
2871
2872         copy_id23_to_sam_passwd(pwd, id23);
2873
2874         /* if it's a trust account, don't update /etc/passwd */
2875         if (    ( (acct_ctrl &  ACB_DOMTRUST) == ACB_DOMTRUST ) ||
2876                 ( (acct_ctrl &  ACB_WSTRUST) ==  ACB_WSTRUST) ||
2877                 ( (acct_ctrl &  ACB_SVRTRUST) ==  ACB_SVRTRUST) ) {
2878                 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
2879         } else  {
2880                 /* update the UNIX password */
2881                 if (lp_unix_password_sync() )
2882                         if(!chgpasswd(pdb_get_username(pwd), "", plaintext_buf, True)) {
2883                                 pdb_free_sam(&pwd);
2884                                 return False;
2885                         }
2886         }
2887
2888         ZERO_STRUCT(plaintext_buf);
2889
2890         if (IS_SAM_CHANGED(pwd, PDB_GROUPSID))
2891                 set_unix_primary_group(pwd);
2892
2893         if(!pdb_update_sam_account(pwd)) {
2894                 pdb_free_sam(&pwd);
2895                 return False;
2896         }
2897
2898         pdb_free_sam(&pwd);
2899
2900         return True;
2901 }
2902
2903 /*******************************************************************
2904  set_user_info_pw
2905  ********************************************************************/
2906
2907 static BOOL set_user_info_pw(char *pass, DOM_SID *sid)
2908 {
2909         SAM_ACCOUNT *pwd = NULL;
2910         uint32 len;
2911         pstring plaintext_buf;
2912         uint16 acct_ctrl;
2913
2914         pdb_init_sam(&pwd);
2915
2916         if (!pdb_getsampwsid(pwd, sid)) {
2917                 pdb_free_sam(&pwd);
2918                 return False;
2919         }
2920
2921         DEBUG(5, ("Attempting administrator password change for user %s\n",
2922                   pdb_get_username(pwd)));
2923
2924         acct_ctrl = pdb_get_acct_ctrl(pwd);
2925
2926         ZERO_STRUCT(plaintext_buf);
2927
2928         if (!decode_pw_buffer(pass, plaintext_buf, 256, &len)) {
2929                 pdb_free_sam(&pwd);
2930                 return False;
2931         }
2932
2933         if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
2934                 pdb_free_sam(&pwd);
2935                 return False;
2936         }
2937
2938         /* if it's a trust account, don't update /etc/passwd */
2939         if ( ( (acct_ctrl &  ACB_DOMTRUST) == ACB_DOMTRUST ) ||
2940                 ( (acct_ctrl &  ACB_WSTRUST) ==  ACB_WSTRUST) ||
2941                 ( (acct_ctrl &  ACB_SVRTRUST) ==  ACB_SVRTRUST) ) {
2942                 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
2943         } else {
2944                 /* update the UNIX password */
2945                 if (lp_unix_password_sync()) {
2946                         if(!chgpasswd(pdb_get_username(pwd), "", plaintext_buf, True)) {
2947                                 pdb_free_sam(&pwd);
2948                                 return False;
2949                         }
2950                 }
2951         }
2952
2953         ZERO_STRUCT(plaintext_buf);
2954
2955         DEBUG(5,("set_user_info_pw: pdb_update_pwd()\n"));
2956
2957         /* update the SAMBA password */
2958         if(!pdb_update_sam_account(pwd)) {
2959                 pdb_free_sam(&pwd);
2960                 return False;
2961         }
2962
2963         pdb_free_sam(&pwd);
2964
2965         return True;
2966 }
2967
2968 /*******************************************************************
2969  samr_reply_set_userinfo
2970  ********************************************************************/
2971
2972 NTSTATUS _samr_set_userinfo(pipes_struct *p, SAMR_Q_SET_USERINFO *q_u, SAMR_R_SET_USERINFO *r_u)
2973 {
2974         DOM_SID sid;
2975         POLICY_HND *pol = &q_u->pol;
2976         uint16 switch_value = q_u->switch_value;
2977         SAM_USERINFO_CTR *ctr = q_u->ctr;
2978         uint32 acc_granted;
2979         uint32 acc_required;
2980
2981         DEBUG(5, ("_samr_set_userinfo: %d\n", __LINE__));
2982
2983         r_u->status = NT_STATUS_OK;
2984
2985         /* find the policy handle.  open a policy on it. */
2986         if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted))
2987                 return NT_STATUS_INVALID_HANDLE;
2988
2989         acc_required = SA_RIGHT_USER_SET_LOC_COM | SA_RIGHT_USER_SET_ATTRIBUTES; /* This is probably wrong */
2990         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, acc_required, "_samr_set_userinfo"))) {
2991                 return r_u->status;
2992         }
2993
2994         DEBUG(5, ("_samr_set_userinfo: sid:%s, level:%d\n", sid_string_static(&sid), switch_value));
2995
2996         if (ctr == NULL) {
2997                 DEBUG(5, ("_samr_set_userinfo: NULL info level\n"));
2998                 return NT_STATUS_INVALID_INFO_CLASS;
2999         }
3000
3001         /* ok!  user info levels (lots: see MSDEV help), off we go... */
3002         switch (switch_value) {
3003                 case 0x12:
3004                         if (!set_user_info_12(ctr->info.id12, &sid))
3005                                 return NT_STATUS_ACCESS_DENIED;
3006                         break;
3007
3008                 case 24:
3009                         SamOEMhash(ctr->info.id24->pass, p->session_key, 516);
3010
3011                         dump_data(100, (char *)ctr->info.id24->pass, 516);
3012
3013                         if (!set_user_info_pw((char *)ctr->info.id24->pass, &sid))
3014                                 return NT_STATUS_ACCESS_DENIED;
3015                         break;
3016
3017                 case 25:
3018 #if 0
3019                         /*
3020                          * Currently we don't really know how to unmarshall
3021                          * the level 25 struct, and the password encryption
3022                          * is different. This is a placeholder for when we
3023                          * do understand it. In the meantime just return INVALID
3024                          * info level and W2K SP2 drops down to level 23... JRA.
3025                          */
3026
3027                         SamOEMhash(ctr->info.id25->pass, p->session_key, 532);
3028
3029                         dump_data(100, (char *)ctr->info.id25->pass, 532);
3030
3031                         if (!set_user_info_pw(ctr->info.id25->pass, &sid))
3032                                 return NT_STATUS_ACCESS_DENIED;
3033                         break;
3034 #endif
3035                         return NT_STATUS_INVALID_INFO_CLASS;
3036
3037                 case 23:
3038                         SamOEMhash(ctr->info.id23->pass, p->session_key, 516);
3039
3040                         dump_data(100, (char *)ctr->info.id23->pass, 516);
3041
3042                         if (!set_user_info_23(ctr->info.id23, &sid))
3043                                 return NT_STATUS_ACCESS_DENIED;
3044                         break;
3045
3046                 default:
3047                         return NT_STATUS_INVALID_INFO_CLASS;
3048         }
3049
3050         return r_u->status;
3051 }
3052
3053 /*******************************************************************
3054  samr_reply_set_userinfo2
3055  ********************************************************************/
3056
3057 NTSTATUS _samr_set_userinfo2(pipes_struct *p, SAMR_Q_SET_USERINFO2 *q_u, SAMR_R_SET_USERINFO2 *r_u)
3058 {
3059         DOM_SID sid;
3060         SAM_USERINFO_CTR *ctr = q_u->ctr;
3061         POLICY_HND *pol = &q_u->pol;
3062         uint16 switch_value = q_u->switch_value;
3063         uint32 acc_granted;
3064         uint32 acc_required;
3065
3066         DEBUG(5, ("samr_reply_set_userinfo2: %d\n", __LINE__));
3067
3068         r_u->status = NT_STATUS_OK;
3069
3070         /* find the policy handle.  open a policy on it. */
3071         if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted))
3072                 return NT_STATUS_INVALID_HANDLE;
3073
3074         acc_required = SA_RIGHT_USER_SET_LOC_COM | SA_RIGHT_USER_SET_ATTRIBUTES; /* This is probably wrong */
3075         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, acc_required, "_samr_set_userinfo2"))) {
3076                 return r_u->status;
3077         }
3078
3079         DEBUG(5, ("samr_reply_set_userinfo2: sid:%s\n", sid_string_static(&sid)));
3080
3081         if (ctr == NULL) {
3082                 DEBUG(5, ("samr_reply_set_userinfo2: NULL info level\n"));
3083                 return NT_STATUS_INVALID_INFO_CLASS;
3084         }
3085
3086         switch_value=ctr->switch_value;
3087
3088         /* ok!  user info levels (lots: see MSDEV help), off we go... */
3089         switch (switch_value) {
3090                 case 21:
3091                         if (!set_user_info_21(ctr->info.id21, &sid))
3092                                 return NT_STATUS_ACCESS_DENIED;
3093                         break;
3094                 case 16:
3095                         if (!set_user_info_10(ctr->info.id10, &sid))
3096                                 return NT_STATUS_ACCESS_DENIED;
3097                         break;
3098                 case 18:
3099                         /* Used by AS/U JRA. */
3100                         if (!set_user_info_12(ctr->info.id12, &sid))
3101                                 return NT_STATUS_ACCESS_DENIED;
3102                         break;
3103                 default:
3104                         return NT_STATUS_INVALID_INFO_CLASS;
3105         }
3106
3107         return r_u->status;
3108 }
3109
3110 /*********************************************************************
3111  _samr_query_aliasmem
3112 *********************************************************************/
3113
3114 NTSTATUS _samr_query_useraliases(pipes_struct *p, SAMR_Q_QUERY_USERALIASES *q_u, SAMR_R_QUERY_USERALIASES *r_u)
3115 {
3116         int num_groups = 0, tmp_num_groups=0;
3117         uint32 *rids=NULL, *new_rids=NULL, *tmp_rids=NULL;
3118         struct samr_info *info = NULL;
3119         int i,j;
3120
3121         NTSTATUS ntstatus1;
3122         NTSTATUS ntstatus2;
3123
3124         /* until i see a real useraliases query, we fack one up */
3125
3126         /* I have seen one, JFM 2/12/2001 */
3127         /*
3128          * Explanation of what this call does:
3129          * for all the SID given in the request:
3130          * return a list of alias (local groups)
3131          * that have those SID as members.
3132          *
3133          * and that's the alias in the domain specified
3134          * in the policy_handle
3135          *
3136          * if the policy handle is on an incorrect sid
3137          * for example a user's sid
3138          * we should reply NT_STATUS_OBJECT_TYPE_MISMATCH
3139          */
3140
3141         r_u->status = NT_STATUS_OK;
3142
3143         DEBUG(5,("_samr_query_useraliases: %d\n", __LINE__));
3144
3145         /* find the policy handle.  open a policy on it. */
3146         if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info))
3147                 return NT_STATUS_INVALID_HANDLE;
3148
3149         ntstatus1 = access_check_samr_function(info->acc_granted, SA_RIGHT_DOMAIN_LOOKUP_ALIAS_BY_MEM, "_samr_query_useraliases");
3150         ntstatus2 = access_check_samr_function(info->acc_granted, SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_query_useraliases");
3151
3152         if (!NT_STATUS_IS_OK(ntstatus1) || !NT_STATUS_IS_OK(ntstatus2)) {
3153                 if (!(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus2)) &&
3154                     !(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus1))) {
3155                         return (NT_STATUS_IS_OK(ntstatus1)) ? ntstatus2 : ntstatus1;
3156                 }
3157         }
3158
3159         if (!sid_check_is_domain(&info->sid) &&
3160             !sid_check_is_builtin(&info->sid))
3161                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
3162
3163
3164         for (i=0; i<q_u->num_sids1; i++) {
3165
3166                 r_u->status=get_alias_user_groups(p->mem_ctx, &info->sid, &tmp_num_groups, &tmp_rids, &(q_u->sid[i].sid));
3167
3168                 /*
3169                  * if there is an error, we just continue as
3170                  * it can be an unfound user or group
3171                  */
3172                 if (!NT_STATUS_IS_OK(r_u->status)) {
3173                         DEBUG(10,("_samr_query_useraliases: an error occured while getting groups\n"));
3174                         continue;
3175                 }
3176
3177                 if (tmp_num_groups==0) {
3178                         DEBUG(10,("_samr_query_useraliases: no groups found\n"));
3179                         continue;
3180                 }
3181
3182                 new_rids=(uint32 *)talloc_realloc(p->mem_ctx, rids, (num_groups+tmp_num_groups)*sizeof(uint32));
3183                 if (new_rids==NULL) {
3184                         DEBUG(0,("_samr_query_useraliases: could not realloc memory\n"));
3185                         return NT_STATUS_NO_MEMORY;
3186                 }
3187                 rids=new_rids;
3188
3189                 for (j=0; j<tmp_num_groups; j++)
3190                         rids[j+num_groups]=tmp_rids[j];
3191
3192                 safe_free(tmp_rids);
3193
3194                 num_groups+=tmp_num_groups;
3195         }
3196
3197         init_samr_r_query_useraliases(r_u, num_groups, rids, NT_STATUS_OK);
3198         return NT_STATUS_OK;
3199 }
3200
3201 /*********************************************************************
3202  _samr_query_aliasmem
3203 *********************************************************************/
3204
3205 NTSTATUS _samr_query_aliasmem(pipes_struct *p, SAMR_Q_QUERY_ALIASMEM *q_u, SAMR_R_QUERY_ALIASMEM *r_u)
3206 {
3207         int i;
3208
3209         GROUP_MAP map;
3210         int num_uids = 0;
3211         DOM_SID2 *sid;
3212         uid_t *uid=NULL;
3213
3214         DOM_SID alias_sid;
3215         DOM_SID als_sid;
3216         uint32 alias_rid;
3217         fstring alias_sid_str;
3218         DOM_SID temp_sid;
3219
3220         SAM_ACCOUNT *sam_user = NULL;
3221         BOOL check;
3222         uint32 acc_granted;
3223
3224         /* find the policy handle.  open a policy on it. */
3225         if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
3226                 return NT_STATUS_INVALID_HANDLE;
3227
3228         if (!NT_STATUS_IS_OK(r_u->status =
3229                 access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_GET_MEMBERS, "_samr_query_aliasmem"))) {
3230                 return r_u->status;
3231         }
3232
3233         sid_copy(&als_sid, &alias_sid);
3234         sid_to_string(alias_sid_str, &alias_sid);
3235         sid_split_rid(&alias_sid, &alias_rid);
3236
3237         DEBUG(10, ("sid is %s\n", alias_sid_str));
3238
3239         if (sid_equal(&alias_sid, &global_sid_Builtin)) {
3240                 DEBUG(10, ("lookup on Builtin SID (S-1-5-32)\n"));
3241                 if(!get_builtin_group_from_sid(als_sid, &map))
3242                         return NT_STATUS_NO_SUCH_ALIAS;
3243         } else {
3244                 if (sid_equal(&alias_sid, get_global_sam_sid())) {
3245                         DEBUG(10, ("lookup on Server SID\n"));
3246                         if(!get_local_group_from_sid(als_sid, &map))
3247                                 return NT_STATUS_NO_SUCH_ALIAS;
3248                 }
3249         }
3250
3251         if(!get_uid_list_of_group(map.gid, &uid, &num_uids))
3252                 return NT_STATUS_NO_SUCH_ALIAS;
3253
3254         DEBUG(10, ("sid is %s\n", alias_sid_str));
3255         sid = (DOM_SID2 *)talloc_zero(p->mem_ctx, sizeof(DOM_SID2) * num_uids);
3256         if (num_uids!=0 && sid == NULL)
3257                 return NT_STATUS_NO_MEMORY;
3258
3259         for (i = 0; i < num_uids; i++) {
3260                 struct passwd *pass;
3261                 uint32 rid;
3262
3263                 sid_copy(&temp_sid, get_global_sam_sid());
3264
3265                 pass = getpwuid_alloc(uid[i]);
3266                 if (!pass) continue;
3267
3268                 if (!NT_STATUS_IS_OK(pdb_init_sam(&sam_user))) {
3269                         passwd_free(&pass);
3270                         continue;
3271                 }
3272
3273                 become_root();
3274                 check = pdb_getsampwnam(sam_user, pass->pw_name);
3275                 unbecome_root();
3276
3277                 if (check != True) {
3278                         pdb_free_sam(&sam_user);
3279                         passwd_free(&pass);
3280                         continue;
3281                 }
3282
3283                 rid = pdb_get_user_rid(sam_user);
3284                 if (rid == 0) {
3285                         pdb_free_sam(&sam_user);
3286                         passwd_free(&pass);
3287                         continue;
3288                 }
3289
3290                 pdb_free_sam(&sam_user);
3291                 passwd_free(&pass);
3292
3293                 sid_append_rid(&temp_sid, rid);
3294
3295                 init_dom_sid2(&sid[i], &temp_sid);
3296         }
3297
3298         DEBUG(10, ("sid is %s\n", alias_sid_str));
3299         init_samr_r_query_aliasmem(r_u, num_uids, sid, NT_STATUS_OK);
3300
3301         return NT_STATUS_OK;
3302 }
3303
3304 /*********************************************************************
3305  _samr_query_groupmem
3306 *********************************************************************/
3307
3308 NTSTATUS _samr_query_groupmem(pipes_struct *p, SAMR_Q_QUERY_GROUPMEM *q_u, SAMR_R_QUERY_GROUPMEM *r_u)
3309 {
3310         int num_uids = 0;
3311         int i;
3312         DOM_SID group_sid;
3313         uint32 group_rid;
3314         fstring group_sid_str;
3315         uid_t *uid=NULL;
3316
3317         GROUP_MAP map;
3318
3319         uint32 *rid=NULL;
3320         uint32 *attr=NULL;
3321
3322         SAM_ACCOUNT *sam_user = NULL;
3323         BOOL check;
3324         uint32 acc_granted;
3325
3326         /* find the policy handle.  open a policy on it. */
3327         if (!get_lsa_policy_samr_sid(p, &q_u->group_pol, &group_sid, &acc_granted))
3328                 return NT_STATUS_INVALID_HANDLE;
3329
3330         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_GET_MEMBERS, "_samr_query_groupmem"))) {
3331                 return r_u->status;
3332         }
3333
3334         /* todo: change to use sid_compare_front */
3335
3336         sid_split_rid(&group_sid, &group_rid);
3337         sid_to_string(group_sid_str, &group_sid);
3338         DEBUG(10, ("sid is %s\n", group_sid_str));
3339
3340         /* can we get a query for an SID outside our domain ? */
3341         if (!sid_equal(&group_sid, get_global_sam_sid()))
3342                 return NT_STATUS_NO_SUCH_GROUP;
3343
3344         sid_append_rid(&group_sid, group_rid);
3345         DEBUG(10, ("lookup on Domain SID\n"));
3346
3347         if(!get_domain_group_from_sid(group_sid, &map))
3348                 return NT_STATUS_NO_SUCH_GROUP;
3349
3350         if(!get_uid_list_of_group(map.gid, &uid, &num_uids))
3351                 return NT_STATUS_NO_SUCH_GROUP;
3352
3353         rid=talloc_zero(p->mem_ctx, sizeof(uint32)*num_uids);
3354         attr=talloc_zero(p->mem_ctx, sizeof(uint32)*num_uids);
3355
3356         if (num_uids!=0 && (rid==NULL || attr==NULL))
3357                 return NT_STATUS_NO_MEMORY;
3358
3359         for (i=0; i<num_uids; i++) {
3360                 struct passwd *pass;
3361                 uint32 urid;
3362
3363                 pass = getpwuid_alloc(uid[i]);
3364                 if (!pass) continue;
3365
3366                 if (!NT_STATUS_IS_OK(pdb_init_sam(&sam_user))) {
3367                         passwd_free(&pass);
3368                         continue;
3369                 }
3370
3371                 become_root();
3372                 check = pdb_getsampwnam(sam_user, pass->pw_name);
3373                 unbecome_root();
3374
3375                 if (check != True) {
3376                         pdb_free_sam(&sam_user);
3377                         passwd_free(&pass);
3378                         continue;
3379                 }
3380
3381                 urid = pdb_get_user_rid(sam_user);
3382                 if (urid == 0) {
3383                         pdb_free_sam(&sam_user);
3384                         passwd_free(&pass);
3385                         continue;
3386                 }
3387
3388                 pdb_free_sam(&sam_user);
3389                 passwd_free(&pass);
3390
3391                 rid[i] = urid;
3392                 attr[i] = SID_NAME_USER;
3393         }
3394
3395         init_samr_r_query_groupmem(r_u, num_uids, rid, attr, NT_STATUS_OK);
3396
3397         return NT_STATUS_OK;
3398 }
3399
3400 /*********************************************************************
3401  _samr_add_aliasmem
3402 *********************************************************************/
3403
3404 NTSTATUS _samr_add_aliasmem(pipes_struct *p, SAMR_Q_ADD_ALIASMEM *q_u, SAMR_R_ADD_ALIASMEM *r_u)
3405 {
3406         DOM_SID alias_sid;
3407         fstring alias_sid_str;
3408         uid_t uid;
3409         struct passwd *pwd;
3410         struct group *grp;
3411         fstring grp_name;
3412         GROUP_MAP map;
3413         NTSTATUS ret;
3414         SAM_ACCOUNT *sam_user = NULL;
3415         BOOL check;
3416         uint32 acc_granted;
3417
3418         /* Find the policy handle. Open a policy on it. */
3419         if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
3420                 return NT_STATUS_INVALID_HANDLE;
3421
3422         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_ADD_MEMBER, "_samr_add_aliasmem"))) {
3423                 return r_u->status;
3424         }
3425
3426         sid_to_string(alias_sid_str, &alias_sid);
3427         DEBUG(10, ("sid is %s\n", alias_sid_str));
3428
3429         if (sid_compare(&alias_sid, get_global_sam_sid())>0) {
3430                 DEBUG(10, ("adding member on Server SID\n"));
3431                 if(!get_local_group_from_sid(alias_sid, &map))
3432                         return NT_STATUS_NO_SUCH_ALIAS;
3433
3434         } else {
3435                 if (sid_compare(&alias_sid, &global_sid_Builtin)>0) {
3436                         DEBUG(10, ("adding member on BUILTIN SID\n"));
3437                         if( !get_local_group_from_sid(alias_sid, &map))
3438                                 return NT_STATUS_NO_SUCH_ALIAS;
3439
3440                 } else
3441                         return NT_STATUS_NO_SUCH_ALIAS;
3442         }
3443
3444         ret = pdb_init_sam(&sam_user);
3445         if (!NT_STATUS_IS_OK(ret))
3446                 return ret;
3447
3448         check = pdb_getsampwsid(sam_user, &q_u->sid.sid);
3449
3450         if (check != True) {
3451                 pdb_free_sam(&sam_user);
3452                 return NT_STATUS_NO_SUCH_USER;
3453         }
3454
3455         /* check a real user exist before we run the script to add a user to a group */
3456         if (!NT_STATUS_IS_OK(sid_to_uid(pdb_get_user_sid(sam_user), &uid))) {
3457                 pdb_free_sam(&sam_user);
3458                 return NT_STATUS_NO_SUCH_USER;
3459         }
3460
3461         pdb_free_sam(&sam_user);
3462
3463         if ((pwd=getpwuid_alloc(uid)) == NULL) {
3464                 return NT_STATUS_NO_SUCH_USER;
3465         }
3466
3467         if ((grp=getgrgid(map.gid)) == NULL) {
3468                 passwd_free(&pwd);
3469                 return NT_STATUS_NO_SUCH_ALIAS;
3470         }
3471
3472         /* we need to copy the name otherwise it's overloaded in user_in_group_list */
3473         fstrcpy(grp_name, grp->gr_name);
3474
3475         /* if the user is already in the group */
3476         if(user_in_unix_group_list(pwd->pw_name, grp_name)) {
3477                 passwd_free(&pwd);
3478                 return NT_STATUS_MEMBER_IN_ALIAS;
3479         }
3480
3481         /*
3482          * ok, the group exist, the user exist, the user is not in the group,
3483          * we can (finally) add it to the group !
3484          */
3485         smb_add_user_group(grp_name, pwd->pw_name);
3486
3487         /* check if the user has been added then ... */
3488         if(!user_in_unix_group_list(pwd->pw_name, grp_name)) {
3489                 passwd_free(&pwd);
3490                 return NT_STATUS_MEMBER_NOT_IN_ALIAS;   /* don't know what to reply else */
3491         }
3492
3493         passwd_free(&pwd);
3494         return NT_STATUS_OK;
3495 }
3496
3497 /*********************************************************************
3498  _samr_del_aliasmem
3499 *********************************************************************/
3500
3501 NTSTATUS _samr_del_aliasmem(pipes_struct *p, SAMR_Q_DEL_ALIASMEM *q_u, SAMR_R_DEL_ALIASMEM *r_u)
3502 {
3503         DOM_SID alias_sid;
3504         fstring alias_sid_str;
3505         struct group *grp;
3506         fstring grp_name;
3507         GROUP_MAP map;
3508         SAM_ACCOUNT *sam_pass=NULL;
3509         uint32 acc_granted;
3510
3511         /* Find the policy handle. Open a policy on it. */
3512         if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
3513                 return NT_STATUS_INVALID_HANDLE;
3514
3515         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_REMOVE_MEMBER, "_samr_del_aliasmem"))) {
3516                 return r_u->status;
3517         }
3518
3519         sid_to_string(alias_sid_str, &alias_sid);
3520         DEBUG(10, ("_samr_del_aliasmem:sid is %s\n", alias_sid_str));
3521
3522         if (!sid_check_is_in_our_domain(&alias_sid) &&
3523             !sid_check_is_in_builtin(&alias_sid)) {
3524                 DEBUG(10, ("_samr_del_aliasmem:invalid alias group\n"));
3525                 return NT_STATUS_NO_SUCH_ALIAS;
3526         }
3527
3528         if( !get_local_group_from_sid(alias_sid, &map))
3529                 return NT_STATUS_NO_SUCH_ALIAS;
3530
3531         if ((grp=getgrgid(map.gid)) == NULL)
3532                 return NT_STATUS_NO_SUCH_ALIAS;
3533
3534         /* we need to copy the name otherwise it's overloaded in user_in_unix_group_list */
3535         fstrcpy(grp_name, grp->gr_name);
3536
3537         /* check if the user exists before trying to remove it from the group */
3538         pdb_init_sam(&sam_pass);
3539         if(!pdb_getsampwsid(sam_pass, &q_u->sid.sid)) {
3540                 DEBUG(5,("_samr_del_aliasmem:User %s doesn't exist.\n", pdb_get_username(sam_pass)));
3541                 pdb_free_sam(&sam_pass);
3542                 return NT_STATUS_NO_SUCH_USER;
3543         }
3544
3545         /* if the user is not in the group */
3546         if(!user_in_unix_group_list(pdb_get_username(sam_pass), grp_name)) {
3547                 pdb_free_sam(&sam_pass);
3548                 return NT_STATUS_MEMBER_IN_ALIAS;
3549         }
3550
3551         smb_delete_user_group(grp_name, pdb_get_username(sam_pass));
3552
3553         /* check if the user has been removed then ... */
3554         if(user_in_unix_group_list(pdb_get_username(sam_pass), grp_name)) {
3555                 pdb_free_sam(&sam_pass);
3556                 return NT_STATUS_MEMBER_NOT_IN_ALIAS;   /* don't know what to reply else */
3557         }
3558
3559         pdb_free_sam(&sam_pass);
3560         return NT_STATUS_OK;
3561 }
3562
3563 /*********************************************************************
3564  _samr_add_groupmem
3565 *********************************************************************/
3566
3567 NTSTATUS _samr_add_groupmem(pipes_struct *p, SAMR_Q_ADD_GROUPMEM *q_u, SAMR_R_ADD_GROUPMEM *r_u)
3568 {
3569         DOM_SID group_sid;
3570         DOM_SID user_sid;
3571         fstring group_sid_str;
3572         uid_t uid;
3573         struct passwd *pwd;
3574         struct group *grp;
3575         fstring grp_name;
3576         GROUP_MAP map;
3577         NTSTATUS ret;
3578         SAM_ACCOUNT *sam_user=NULL;
3579         BOOL check;
3580         uint32 acc_granted;
3581
3582         /* Find the policy handle. Open a policy on it. */
3583         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
3584                 return NT_STATUS_INVALID_HANDLE;
3585
3586         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_ADD_MEMBER, "_samr_add_groupmem"))) {
3587                 return r_u->status;
3588         }
3589
3590         sid_to_string(group_sid_str, &group_sid);
3591         DEBUG(10, ("sid is %s\n", group_sid_str));
3592
3593         if (sid_compare(&group_sid, get_global_sam_sid())<=0)
3594                 return NT_STATUS_NO_SUCH_GROUP;
3595
3596         DEBUG(10, ("lookup on Domain SID\n"));
3597
3598         if(!get_domain_group_from_sid(group_sid, &map))
3599                 return NT_STATUS_NO_SUCH_GROUP;
3600
3601         sid_copy(&user_sid, get_global_sam_sid());
3602         sid_append_rid(&user_sid, q_u->rid);
3603
3604         ret = pdb_init_sam(&sam_user);
3605         if (!NT_STATUS_IS_OK(ret))
3606                 return ret;
3607
3608         check = pdb_getsampwsid(sam_user, &user_sid);
3609
3610         if (check != True) {
3611                 pdb_free_sam(&sam_user);
3612                 return NT_STATUS_NO_SUCH_USER;
3613         }
3614
3615         /* check a real user exist before we run the script to add a user to a group */
3616         if (!NT_STATUS_IS_OK(sid_to_uid(pdb_get_user_sid(sam_user), &uid))) {
3617                 pdb_free_sam(&sam_user);
3618                 return NT_STATUS_NO_SUCH_USER;
3619         }
3620
3621         pdb_free_sam(&sam_user);
3622
3623         if ((pwd=getpwuid_alloc(uid)) == NULL) {
3624                 return NT_STATUS_NO_SUCH_USER;
3625         }
3626
3627         if ((grp=getgrgid(map.gid)) == NULL) {
3628                 passwd_free(&pwd);
3629                 return NT_STATUS_NO_SUCH_GROUP;
3630         }
3631
3632         /* we need to copy the name otherwise it's overloaded in user_in_unix_group_list */
3633         fstrcpy(grp_name, grp->gr_name);
3634
3635         /* if the user is already in the group */
3636         if(user_in_unix_group_list(pwd->pw_name, grp_name)) {
3637                 passwd_free(&pwd);
3638                 return NT_STATUS_MEMBER_IN_GROUP;
3639         }
3640
3641         /*
3642          * ok, the group exist, the user exist, the user is not in the group,
3643          *
3644          * we can (finally) add it to the group !
3645          */
3646
3647         smb_add_user_group(grp_name, pwd->pw_name);
3648
3649         /* check if the user has been added then ... */
3650         if(!user_in_unix_group_list(pwd->pw_name, grp_name)) {
3651                 passwd_free(&pwd);
3652                 return NT_STATUS_MEMBER_NOT_IN_GROUP;           /* don't know what to reply else */
3653         }
3654
3655         passwd_free(&pwd);
3656         return NT_STATUS_OK;
3657 }
3658
3659 /*********************************************************************
3660  _samr_del_groupmem
3661 *********************************************************************/
3662
3663 NTSTATUS _samr_del_groupmem(pipes_struct *p, SAMR_Q_DEL_GROUPMEM *q_u, SAMR_R_DEL_GROUPMEM *r_u)
3664 {
3665         DOM_SID group_sid;
3666         DOM_SID user_sid;
3667         SAM_ACCOUNT *sam_pass=NULL;
3668         GROUP_MAP map;
3669         fstring grp_name;
3670         struct group *grp;
3671         uint32 acc_granted;
3672
3673         /*
3674          * delete the group member named q_u->rid
3675          * who is a member of the sid associated with the handle
3676          * the rid is a user's rid as the group is a domain group.
3677          */
3678
3679         /* Find the policy handle. Open a policy on it. */
3680         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
3681                 return NT_STATUS_INVALID_HANDLE;
3682
3683         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_REMOVE_MEMBER, "_samr_del_groupmem"))) {
3684                 return r_u->status;
3685         }
3686
3687         if (!sid_check_is_in_our_domain(&group_sid))
3688                 return NT_STATUS_NO_SUCH_GROUP;
3689
3690         sid_copy(&user_sid, get_global_sam_sid());
3691         sid_append_rid(&user_sid, q_u->rid);
3692
3693         if (!get_domain_group_from_sid(group_sid, &map))
3694                 return NT_STATUS_NO_SUCH_GROUP;
3695
3696         if ((grp=getgrgid(map.gid)) == NULL)
3697                 return NT_STATUS_NO_SUCH_GROUP;
3698
3699         /* we need to copy the name otherwise it's overloaded in user_in_group_list */
3700         fstrcpy(grp_name, grp->gr_name);
3701
3702         /* check if the user exists before trying to remove it from the group */
3703         pdb_init_sam(&sam_pass);
3704         if (!pdb_getsampwsid(sam_pass, &user_sid)) {
3705                 DEBUG(5,("User %s doesn't exist.\n", pdb_get_username(sam_pass)));
3706                 pdb_free_sam(&sam_pass);
3707                 return NT_STATUS_NO_SUCH_USER;
3708         }
3709
3710         /* if the user is not in the group */
3711         if (!user_in_unix_group_list(pdb_get_username(sam_pass), grp_name)) {
3712                 pdb_free_sam(&sam_pass);
3713                 return NT_STATUS_MEMBER_NOT_IN_GROUP;
3714         }
3715
3716         smb_delete_user_group(grp_name, pdb_get_username(sam_pass));
3717
3718         /* check if the user has been removed then ... */
3719         if (user_in_unix_group_list(pdb_get_username(sam_pass), grp_name)) {
3720                 pdb_free_sam(&sam_pass);
3721                 return NT_STATUS_ACCESS_DENIED;         /* don't know what to reply else */
3722         }
3723
3724         pdb_free_sam(&sam_pass);
3725         return NT_STATUS_OK;
3726
3727 }
3728
3729 /****************************************************************************
3730  Delete a UNIX user on demand.
3731 ****************************************************************************/
3732
3733 static int smb_delete_user(const char *unix_user)
3734 {
3735         pstring del_script;
3736         int ret;
3737
3738         /* try winbindd first since it is impossible to determine where
3739            a user came from via NSS.  Try the delete user script if this fails
3740            meaning the user did not exist in winbindd's list of accounts */
3741
3742         if ( winbind_delete_user( unix_user ) ) {
3743                 DEBUG(3,("winbind_delete_user: removed user (%s)\n", unix_user));
3744                 return 0;
3745         }
3746
3747
3748         /* fall back to 'delete user script' */
3749
3750         pstrcpy(del_script, lp_deluser_script());
3751         if (! *del_script)
3752                 return -1;
3753         all_string_sub(del_script, "%u", unix_user, sizeof(pstring));
3754         ret = smbrun(del_script,NULL);
3755         DEBUG(3,("smb_delete_user: Running the command `%s' gave %d\n",del_script,ret));
3756
3757         return ret;
3758 }
3759
3760 /*********************************************************************
3761  _samr_delete_dom_user
3762 *********************************************************************/
3763
3764 NTSTATUS _samr_delete_dom_user(pipes_struct *p, SAMR_Q_DELETE_DOM_USER *q_u, SAMR_R_DELETE_DOM_USER *r_u )
3765 {
3766         DOM_SID user_sid;
3767         SAM_ACCOUNT *sam_pass=NULL;
3768         uint32 acc_granted;
3769
3770         DEBUG(5, ("_samr_delete_dom_user: %d\n", __LINE__));
3771
3772         /* Find the policy handle. Open a policy on it. */
3773         if (!get_lsa_policy_samr_sid(p, &q_u->user_pol, &user_sid, &acc_granted))
3774                 return NT_STATUS_INVALID_HANDLE;
3775
3776         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS, "_samr_delete_dom_user"))) {
3777                 return r_u->status;
3778         }
3779
3780         if (!sid_check_is_in_our_domain(&user_sid))
3781                 return NT_STATUS_CANNOT_DELETE;
3782
3783         /* check if the user exists before trying to delete */
3784         pdb_init_sam(&sam_pass);
3785         if(!pdb_getsampwsid(sam_pass, &user_sid)) {
3786                 DEBUG(5,("_samr_delete_dom_user:User %s doesn't exist.\n",
3787                         sid_string_static(&user_sid)));
3788                 pdb_free_sam(&sam_pass);
3789                 return NT_STATUS_NO_SUCH_USER;
3790         }
3791
3792         /* delete the unix side */
3793         /*
3794          * note: we don't check if the delete really happened
3795          * as the script is not necessary present
3796          * and maybe the sysadmin doesn't want to delete the unix side
3797          */
3798         smb_delete_user(pdb_get_username(sam_pass));
3799
3800         /* and delete the samba side */
3801         if (!pdb_delete_sam_account(sam_pass)) {
3802                 DEBUG(5,("_samr_delete_dom_user:Failed to delete entry for user %s.\n", pdb_get_username(sam_pass)));
3803                 pdb_free_sam(&sam_pass);
3804                 return NT_STATUS_CANNOT_DELETE;
3805         }
3806
3807         pdb_free_sam(&sam_pass);
3808
3809         if (!close_policy_hnd(p, &q_u->user_pol))
3810                 return NT_STATUS_OBJECT_NAME_INVALID;
3811
3812         return NT_STATUS_OK;
3813 }
3814
3815 /*********************************************************************
3816  _samr_delete_dom_group
3817 *********************************************************************/
3818
3819 NTSTATUS _samr_delete_dom_group(pipes_struct *p, SAMR_Q_DELETE_DOM_GROUP *q_u, SAMR_R_DELETE_DOM_GROUP *r_u)
3820 {
3821         DOM_SID group_sid;
3822         DOM_SID dom_sid;
3823         uint32 group_rid;
3824         fstring group_sid_str;
3825         gid_t gid;
3826         struct group *grp;
3827         GROUP_MAP map;
3828         uint32 acc_granted;
3829
3830         DEBUG(5, ("samr_delete_dom_group: %d\n", __LINE__));
3831
3832         /* Find the policy handle. Open a policy on it. */
3833         if (!get_lsa_policy_samr_sid(p, &q_u->group_pol, &group_sid, &acc_granted))
3834                 return NT_STATUS_INVALID_HANDLE;
3835
3836         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS, "_samr_delete_dom_group"))) {
3837                 return r_u->status;
3838         }
3839
3840         sid_copy(&dom_sid, &group_sid);
3841         sid_to_string(group_sid_str, &dom_sid);
3842         sid_split_rid(&dom_sid, &group_rid);
3843
3844         DEBUG(10, ("sid is %s\n", group_sid_str));
3845
3846         /* we check if it's our SID before deleting */
3847         if (!sid_equal(&dom_sid, get_global_sam_sid()))
3848                 return NT_STATUS_NO_SUCH_GROUP;
3849
3850         DEBUG(10, ("lookup on Domain SID\n"));
3851
3852         if(!get_domain_group_from_sid(group_sid, &map))
3853                 return NT_STATUS_NO_SUCH_GROUP;
3854
3855         gid=map.gid;
3856
3857         /* check if group really exists */
3858         if ( (grp=getgrgid(gid)) == NULL)
3859                 return NT_STATUS_NO_SUCH_GROUP;
3860
3861         /* we can delete the UNIX group */
3862         smb_delete_group(grp->gr_name);
3863
3864         /* check if the group has been successfully deleted */
3865         if ( (grp=getgrgid(gid)) != NULL)
3866                 return NT_STATUS_ACCESS_DENIED;
3867
3868         if(!pdb_delete_group_mapping_entry(group_sid))
3869                 return NT_STATUS_ACCESS_DENIED;
3870
3871         if (!close_policy_hnd(p, &q_u->group_pol))
3872                 return NT_STATUS_OBJECT_NAME_INVALID;
3873
3874         return NT_STATUS_OK;
3875 }
3876
3877 /*********************************************************************
3878  _samr_delete_dom_alias
3879 *********************************************************************/
3880
3881 NTSTATUS _samr_delete_dom_alias(pipes_struct *p, SAMR_Q_DELETE_DOM_ALIAS *q_u, SAMR_R_DELETE_DOM_ALIAS *r_u)
3882 {
3883         DOM_SID alias_sid;
3884         DOM_SID dom_sid;
3885         uint32 alias_rid;
3886         fstring alias_sid_str;
3887         gid_t gid;
3888         struct group *grp;
3889         GROUP_MAP map;
3890         uint32 acc_granted;
3891
3892         DEBUG(5, ("_samr_delete_dom_alias: %d\n", __LINE__));
3893
3894         /* Find the policy handle. Open a policy on it. */
3895         if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted))
3896                 return NT_STATUS_INVALID_HANDLE;
3897
3898         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS, "_samr_delete_dom_alias"))) {
3899                 return r_u->status;
3900         }
3901
3902         sid_copy(&dom_sid, &alias_sid);
3903         sid_to_string(alias_sid_str, &dom_sid);
3904         sid_split_rid(&dom_sid, &alias_rid);
3905
3906         DEBUG(10, ("sid is %s\n", alias_sid_str));
3907
3908         /* we check if it's our SID before deleting */
3909         if (!sid_equal(&dom_sid, get_global_sam_sid()))
3910                 return NT_STATUS_NO_SUCH_ALIAS;
3911
3912         DEBUG(10, ("lookup on Local SID\n"));
3913
3914         if(!get_local_group_from_sid(alias_sid, &map))
3915                 return NT_STATUS_NO_SUCH_ALIAS;
3916
3917         gid=map.gid;
3918
3919         /* check if group really exists */
3920         if ( (grp=getgrgid(gid)) == NULL)
3921                 return NT_STATUS_NO_SUCH_ALIAS;
3922
3923         /* we can delete the UNIX group */
3924         smb_delete_group(grp->gr_name);
3925
3926         /* check if the group has been successfully deleted */
3927         if ( (grp=getgrgid(gid)) != NULL)
3928                 return NT_STATUS_ACCESS_DENIED;
3929
3930         /* don't check if we removed it as it could be an un-mapped group */
3931         pdb_delete_group_mapping_entry(alias_sid);
3932
3933         if (!close_policy_hnd(p, &q_u->alias_pol))
3934                 return NT_STATUS_OBJECT_NAME_INVALID;
3935
3936         return NT_STATUS_OK;
3937 }
3938
3939 /*********************************************************************
3940  _samr_create_dom_group
3941 *********************************************************************/
3942
3943 NTSTATUS _samr_create_dom_group(pipes_struct *p, SAMR_Q_CREATE_DOM_GROUP *q_u, SAMR_R_CREATE_DOM_GROUP *r_u)
3944 {
3945         DOM_SID dom_sid;
3946         DOM_SID info_sid;
3947         fstring name;
3948         fstring sid_string;
3949         struct group *grp;
3950         struct samr_info *info;
3951         uint32 acc_granted;
3952         gid_t gid;
3953
3954         /* Find the policy handle. Open a policy on it. */
3955         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &dom_sid, &acc_granted))
3956                 return NT_STATUS_INVALID_HANDLE;
3957
3958         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_CREATE_GROUP, "_samr_create_dom_group"))) {
3959                 return r_u->status;
3960         }
3961
3962         if (!sid_equal(&dom_sid, get_global_sam_sid()))
3963                 return NT_STATUS_ACCESS_DENIED;
3964
3965         /* TODO: check if allowed to create group and add a become_root/unbecome_root pair.*/
3966
3967         unistr2_to_ascii(name, &q_u->uni_acct_desc, sizeof(name)-1);
3968
3969         /* check if group already exist */
3970         if ((grp=getgrnam(name)) != NULL)
3971                 return NT_STATUS_GROUP_EXISTS;
3972
3973         /* we can create the UNIX group */
3974         if (smb_create_group(name, &gid) != 0)
3975                 return NT_STATUS_ACCESS_DENIED;
3976
3977         /* check if the group has been successfully created */
3978         if ((grp=getgrgid(gid)) == NULL)
3979                 return NT_STATUS_ACCESS_DENIED;
3980
3981         r_u->rid=pdb_gid_to_group_rid(grp->gr_gid);
3982
3983         /* add the group to the mapping table */
3984         sid_copy(&info_sid, get_global_sam_sid());
3985         sid_append_rid(&info_sid, r_u->rid);
3986         sid_to_string(sid_string, &info_sid);
3987
3988         if(!add_initial_entry(grp->gr_gid, sid_string, SID_NAME_DOM_GRP, name, NULL))
3989                 return NT_STATUS_ACCESS_DENIED;
3990
3991         if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
3992                 return NT_STATUS_NO_MEMORY;
3993
3994         /* get a (unique) handle.  open a policy on it. */
3995         if (!create_policy_hnd(p, &r_u->pol, free_samr_info, (void *)info))
3996                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3997
3998         return NT_STATUS_OK;
3999 }
4000
4001 /*********************************************************************
4002  _samr_create_dom_alias
4003 *********************************************************************/
4004
4005 NTSTATUS _samr_create_dom_alias(pipes_struct *p, SAMR_Q_CREATE_DOM_ALIAS *q_u, SAMR_R_CREATE_DOM_ALIAS *r_u)
4006 {
4007         DOM_SID dom_sid;
4008         DOM_SID info_sid;
4009         fstring name;
4010         fstring sid_string;
4011         struct group *grp;
4012         struct samr_info *info;
4013         uint32 acc_granted;
4014         gid_t gid;
4015
4016         /* Find the policy handle. Open a policy on it. */
4017         if (!get_lsa_policy_samr_sid(p, &q_u->dom_pol, &dom_sid, &acc_granted))
4018                 return NT_STATUS_INVALID_HANDLE;
4019
4020         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_CREATE_ALIAS, "_samr_create_alias"))) {
4021                 return r_u->status;
4022         }
4023
4024         if (!sid_equal(&dom_sid, get_global_sam_sid()))
4025                 return NT_STATUS_ACCESS_DENIED;
4026
4027         /* TODO: check if allowed to create group  and add a become_root/unbecome_root pair.*/
4028
4029         unistr2_to_ascii(name, &q_u->uni_acct_desc, sizeof(name)-1);
4030
4031         /* check if group already exists */
4032         if ( (grp=getgrnam(name)) != NULL)
4033                 return NT_STATUS_GROUP_EXISTS;
4034
4035         /* we can create the UNIX group */
4036         if (smb_create_group(name, &gid) != 0)
4037                 return NT_STATUS_ACCESS_DENIED;
4038
4039         /* check if the group has been successfully created */
4040         if ((grp=getgrgid(gid)) == NULL)
4041                 return NT_STATUS_ACCESS_DENIED;
4042
4043         r_u->rid=pdb_gid_to_group_rid(grp->gr_gid);
4044
4045         sid_copy(&info_sid, get_global_sam_sid());
4046         sid_append_rid(&info_sid, r_u->rid);
4047         sid_to_string(sid_string, &info_sid);
4048
4049         /* add the group to the mapping table */
4050         if(!add_initial_entry(grp->gr_gid, sid_string, SID_NAME_ALIAS, name, NULL))
4051                 return NT_STATUS_ACCESS_DENIED;
4052
4053         if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
4054                 return NT_STATUS_NO_MEMORY;
4055
4056         /* get a (unique) handle.  open a policy on it. */
4057         if (!create_policy_hnd(p, &r_u->alias_pol, free_samr_info, (void *)info))
4058                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4059
4060         return NT_STATUS_OK;
4061 }
4062
4063 /*********************************************************************
4064  _samr_query_groupinfo
4065
4066 sends the name/comment pair of a domain group
4067 level 1 send also the number of users of that group
4068 *********************************************************************/
4069
4070 NTSTATUS _samr_query_groupinfo(pipes_struct *p, SAMR_Q_QUERY_GROUPINFO *q_u, SAMR_R_QUERY_GROUPINFO *r_u)
4071 {
4072         DOM_SID group_sid;
4073         GROUP_MAP map;
4074         uid_t *uid=NULL;
4075         int num_uids=0;
4076         GROUP_INFO_CTR *ctr;
4077         uint32 acc_granted;
4078
4079         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
4080                 return NT_STATUS_INVALID_HANDLE;
4081
4082         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_LOOKUP_INFO, "_samr_query_groupinfo"))) {
4083                 return r_u->status;
4084         }
4085
4086         if (!get_domain_group_from_sid(group_sid, &map))
4087                 return NT_STATUS_INVALID_HANDLE;
4088
4089         ctr=(GROUP_INFO_CTR *)talloc_zero(p->mem_ctx, sizeof(GROUP_INFO_CTR));
4090         if (ctr==NULL)
4091                 return NT_STATUS_NO_MEMORY;
4092
4093         switch (q_u->switch_level) {
4094                 case 1:
4095                         ctr->switch_value1 = 1;
4096                         if(!get_uid_list_of_group(map.gid, &uid, &num_uids))
4097                                 return NT_STATUS_NO_SUCH_GROUP;
4098                         init_samr_group_info1(&ctr->group.info1, map.nt_name, map.comment, num_uids);
4099                         SAFE_FREE(uid);
4100                         break;
4101                 case 3:
4102                         ctr->switch_value1 = 3;
4103                         init_samr_group_info3(&ctr->group.info3);
4104                         break;
4105                 case 4:
4106                         ctr->switch_value1 = 4;
4107                         init_samr_group_info4(&ctr->group.info4, map.comment);
4108                         break;
4109                 default:
4110                         return NT_STATUS_INVALID_INFO_CLASS;
4111         }
4112
4113         init_samr_r_query_groupinfo(r_u, ctr, NT_STATUS_OK);
4114
4115         return NT_STATUS_OK;
4116 }
4117
4118 /*********************************************************************
4119  _samr_set_groupinfo
4120
4121  update a domain group's comment.
4122 *********************************************************************/
4123
4124 NTSTATUS _samr_set_groupinfo(pipes_struct *p, SAMR_Q_SET_GROUPINFO *q_u, SAMR_R_SET_GROUPINFO *r_u)
4125 {
4126         DOM_SID group_sid;
4127         GROUP_MAP map;
4128         GROUP_INFO_CTR *ctr;
4129         uint32 acc_granted;
4130
4131         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted))
4132                 return NT_STATUS_INVALID_HANDLE;
4133
4134         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_SET_INFO, "_samr_set_groupinfo"))) {
4135                 return r_u->status;
4136         }
4137
4138         if (!get_domain_group_from_sid(group_sid, &map))
4139                 return NT_STATUS_NO_SUCH_GROUP;
4140
4141         ctr=q_u->ctr;
4142
4143         switch (ctr->switch_value1) {
4144                 case 1:
4145                         unistr2_to_ascii(map.comment, &(ctr->group.info1.uni_acct_desc), sizeof(map.comment)-1);
4146                         break;
4147                 case 4:
4148                         unistr2_to_ascii(map.comment, &(ctr->group.info4.uni_acct_desc), sizeof(map.comment)-1);
4149                         break;
4150                 default:
4151                         return NT_STATUS_INVALID_INFO_CLASS;
4152         }
4153
4154         if(!pdb_update_group_mapping_entry(&map)) {
4155                 return NT_STATUS_NO_SUCH_GROUP;
4156         }
4157
4158         return NT_STATUS_OK;
4159 }
4160
4161 /*********************************************************************
4162  _samr_set_aliasinfo
4163
4164  update an alias's comment.
4165 *********************************************************************/
4166
4167 NTSTATUS _samr_set_aliasinfo(pipes_struct *p, SAMR_Q_SET_ALIASINFO *q_u, SAMR_R_SET_ALIASINFO *r_u)
4168 {
4169         DOM_SID group_sid;
4170         GROUP_MAP map;
4171         ALIAS_INFO_CTR *ctr;
4172         uint32 acc_granted;
4173
4174         if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &group_sid, &acc_granted))
4175                 return NT_STATUS_INVALID_HANDLE;
4176
4177         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_SET_INFO, "_samr_set_aliasinfo"))) {
4178                 return r_u->status;
4179         }
4180
4181         if (!get_local_group_from_sid(group_sid, &map))
4182                 return NT_STATUS_NO_SUCH_GROUP;
4183
4184         ctr=&q_u->ctr;
4185
4186         switch (ctr->switch_value1) {
4187                 case 3:
4188                         unistr2_to_ascii(map.comment, &(ctr->alias.info3.uni_acct_desc), sizeof(map.comment)-1);
4189                         break;
4190                 default:
4191                         return NT_STATUS_INVALID_INFO_CLASS;
4192         }
4193
4194         if(!pdb_update_group_mapping_entry(&map)) {
4195                 return NT_STATUS_NO_SUCH_GROUP;
4196         }
4197
4198         return NT_STATUS_OK;
4199 }
4200
4201 /*********************************************************************
4202  _samr_get_dom_pwinfo
4203 *********************************************************************/
4204
4205 NTSTATUS _samr_get_dom_pwinfo(pipes_struct *p, SAMR_Q_GET_DOM_PWINFO *q_u, SAMR_R_GET_DOM_PWINFO *r_u)
4206 {
4207         /* Perform access check.  Since this rpc does not require a
4208            policy handle it will not be caught by the access checks on
4209            SAMR_CONNECT or SAMR_CONNECT_ANON. */
4210
4211         if (!pipe_access_check(p)) {
4212                 DEBUG(3, ("access denied to samr_get_dom_pwinfo\n"));
4213                 r_u->status = NT_STATUS_ACCESS_DENIED;
4214                 return r_u->status;
4215         }
4216
4217         /* Actually, returning zeros here works quite well :-). */
4218
4219         return NT_STATUS_OK;
4220 }
4221
4222 /*********************************************************************
4223  _samr_open_group
4224 *********************************************************************/
4225
4226 NTSTATUS _samr_open_group(pipes_struct *p, SAMR_Q_OPEN_GROUP *q_u, SAMR_R_OPEN_GROUP *r_u)
4227 {
4228         DOM_SID sid;
4229         DOM_SID info_sid;
4230         GROUP_MAP map;
4231         struct samr_info *info;
4232         SEC_DESC         *psd = NULL;
4233         uint32            acc_granted;
4234         uint32            des_access = q_u->access_mask;
4235         size_t            sd_size;
4236         NTSTATUS          status;
4237         fstring sid_string;
4238
4239         if (!get_lsa_policy_samr_sid(p, &q_u->domain_pol, &sid, &acc_granted))
4240                 return NT_STATUS_INVALID_HANDLE;
4241
4242         if (!NT_STATUS_IS_OK(status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_open_group"))) {
4243                 return status;
4244         }
4245
4246         /*check if access can be granted as requested by client. */
4247         samr_make_grp_obj_sd(p->mem_ctx, &psd, &sd_size);
4248         se_map_generic(&des_access,&grp_generic_mapping);
4249         if (!NT_STATUS_IS_OK(status =
4250                              access_check_samr_object(psd, p->pipe_user.nt_user_token,
4251                                                       des_access, &acc_granted, "_samr_open_group"))) {
4252                 return status;
4253         }
4254
4255
4256         /* this should not be hard-coded like this */
4257         if (!sid_equal(&sid, get_global_sam_sid()))
4258                 return NT_STATUS_ACCESS_DENIED;
4259
4260         sid_copy(&info_sid, get_global_sam_sid());
4261         sid_append_rid(&info_sid, q_u->rid_group);
4262         sid_to_string(sid_string, &info_sid);
4263
4264         if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
4265                 return NT_STATUS_NO_MEMORY;
4266
4267         info->acc_granted = acc_granted;
4268
4269         DEBUG(10, ("_samr_open_group:Opening SID: %s\n", sid_string));
4270
4271         /* check if that group really exists */
4272         if (!get_domain_group_from_sid(info->sid, &map))
4273                 return NT_STATUS_NO_SUCH_GROUP;
4274
4275         /* get a (unique) handle.  open a policy on it. */
4276         if (!create_policy_hnd(p, &r_u->pol, free_samr_info, (void *)info))
4277                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4278
4279         return NT_STATUS_OK;
4280 }
4281
4282 /*********************************************************************
4283  _samr_remove_user_foreign_domain
4284 *********************************************************************/
4285
4286 NTSTATUS _samr_remove_user_foreign_domain(pipes_struct *p,
4287                                           SAMR_Q_REMOVE_USER_FOREIGN_DOMAIN *q_u,
4288                                           SAMR_R_REMOVE_USER_FOREIGN_DOMAIN *r_u)
4289 {
4290         DOM_SID                 user_sid, dom_sid;
4291         SAM_ACCOUNT             *sam_pass=NULL;
4292         uint32                  acc_granted;
4293
4294         sid_copy( &user_sid, &q_u->sid.sid );
4295
4296         DEBUG(5,("_samr_remove_user_foreign_domain: removing user [%s]\n",
4297                 sid_string_static(&user_sid)));
4298
4299         /* Find the policy handle. Open a policy on it. */
4300
4301         if (!get_lsa_policy_samr_sid(p, &q_u->dom_pol, &dom_sid, &acc_granted))
4302                 return NT_STATUS_INVALID_HANDLE;
4303
4304         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted,
4305                 STD_RIGHT_DELETE_ACCESS, "_samr_remove_user_foreign_domain")))
4306         {
4307                 return r_u->status;
4308         }
4309
4310         if ( !sid_check_is_in_our_domain(&user_sid) ) {
4311                 DEBUG(5,("_samr_remove_user_foreign_domain: user not is our domain!\n"));
4312                 return NT_STATUS_NO_SUCH_USER;
4313         }
4314
4315         /* check if the user exists before trying to delete */
4316
4317         pdb_init_sam(&sam_pass);
4318
4319         if ( !pdb_getsampwsid(sam_pass, &user_sid) ) {
4320
4321                 DEBUG(5,("_samr_remove_user_foreign_domain:User %s doesn't exist.\n",
4322                         sid_string_static(&user_sid)));
4323
4324                 pdb_free_sam(&sam_pass);
4325
4326                 return NT_STATUS_NO_SUCH_USER;
4327         }
4328
4329         /*
4330          * delete the unix side
4331          *
4332          * note: we don't check if the delete really happened
4333          * as the script is not necessary present
4334          * and maybe the sysadmin doesn't want to delete the unix side
4335          */
4336
4337         smb_delete_user(pdb_get_username(sam_pass));
4338
4339         /* and delete the samba side */
4340
4341         if ( !pdb_delete_sam_account(sam_pass) ) {
4342
4343                 DEBUG(5,("_samr_delete_dom_user:Failed to delete entry for user %s.\n", pdb_get_username(sam_pass)));
4344                 pdb_free_sam(&sam_pass);
4345
4346                 return NT_STATUS_CANNOT_DELETE;
4347         }
4348
4349         pdb_free_sam(&sam_pass);
4350
4351         return NT_STATUS_OK;
4352 }
4353
4354 /*******************************************************************
4355  _samr_unknown_2e
4356  ********************************************************************/
4357
4358 NTSTATUS _samr_unknown_2e(pipes_struct *p, SAMR_Q_UNKNOWN_2E *q_u, SAMR_R_UNKNOWN_2E *r_u)
4359 {
4360         struct samr_info *info = NULL;
4361         SAM_UNK_CTR *ctr;
4362         uint32 min_pass_len,pass_hist,flag;
4363         time_t u_expire, u_min_age;
4364         NTTIME nt_expire, nt_min_age;
4365
4366         time_t u_lock_duration, u_reset_time;
4367         NTTIME nt_lock_duration, nt_reset_time;
4368         uint32 lockout;
4369
4370         time_t u_logout;
4371         NTTIME nt_logout;
4372
4373         uint32 num_users=0, num_groups=0, num_aliases=0;
4374
4375         uint32 account_policy_temp;
4376
4377         if ((ctr = (SAM_UNK_CTR *)talloc_zero(p->mem_ctx, sizeof(SAM_UNK_CTR))) == NULL)
4378                 return NT_STATUS_NO_MEMORY;
4379
4380         ZERO_STRUCTP(ctr);
4381
4382         r_u->status = NT_STATUS_OK;
4383
4384         DEBUG(5,("_samr_unknown_2e: %d\n", __LINE__));
4385
4386         /* find the policy handle.  open a policy on it. */
4387         if (!find_policy_by_hnd(p, &q_u->domain_pol, (void **)&info))
4388                 return NT_STATUS_INVALID_HANDLE;
4389
4390         switch (q_u->switch_value) {
4391                 case 0x01:
4392                         account_policy_get(AP_MIN_PASSWORD_LEN, &account_policy_temp);
4393                         min_pass_len = account_policy_temp;
4394
4395                         account_policy_get(AP_PASSWORD_HISTORY, &account_policy_temp);
4396                         pass_hist = account_policy_temp;
4397
4398                         account_policy_get(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp);
4399                         flag = account_policy_temp;
4400
4401                         account_policy_get(AP_MAX_PASSWORD_AGE, &account_policy_temp);
4402                         u_expire = account_policy_temp;
4403
4404                         account_policy_get(AP_MIN_PASSWORD_AGE, &account_policy_temp);
4405                         u_min_age = account_policy_temp;
4406
4407                         unix_to_nt_time_abs(&nt_expire, u_expire);
4408                         unix_to_nt_time_abs(&nt_min_age, u_min_age);
4409
4410                         init_unk_info1(&ctr->info.inf1, (uint16)min_pass_len, (uint16)pass_hist,
4411                                        flag, nt_expire, nt_min_age);
4412                         break;
4413                 case 0x02:
4414                         become_root();
4415                         r_u->status=load_sampwd_entries(info, ACB_NORMAL, False);
4416                         unbecome_root();
4417                         if (!NT_STATUS_IS_OK(r_u->status)) {
4418                                 DEBUG(5, ("_samr_unknown_2e: load_sampwd_entries failed\n"));
4419                                 return r_u->status;
4420                         }
4421                         num_users=info->disp_info.num_user_account;
4422                         free_samr_db(info);
4423
4424                         r_u->status=load_group_domain_entries(info, get_global_sam_sid());
4425                         if (NT_STATUS_IS_ERR(r_u->status)) {
4426                                 DEBUG(5, ("_samr_unknown_2e: load_group_domain_entries failed\n"));
4427                                 return r_u->status;
4428                         }
4429                         num_groups=info->disp_info.num_group_account;
4430                         free_samr_db(info);
4431
4432                         /* The time call below is to get a sequence number for the sam. FIXME !!! JRA. */
4433                         init_unk_info2(&ctr->info.inf2, lp_workgroup(), global_myname(), (uint32) time(NULL),
4434                                        num_users, num_groups, num_aliases);
4435                         break;
4436                 case 0x03:
4437                         account_policy_get(AP_TIME_TO_LOGOUT, &account_policy_temp);
4438                         u_logout = account_policy_temp;
4439
4440                         unix_to_nt_time_abs(&nt_logout, u_logout);
4441
4442                         init_unk_info3(&ctr->info.inf3, nt_logout);
4443                         break;
4444                 case 0x05:
4445                         init_unk_info5(&ctr->info.inf5, global_myname());
4446                         break;
4447                 case 0x06:
4448                         init_unk_info6(&ctr->info.inf6);
4449                         break;
4450                 case 0x07:
4451                         init_unk_info7(&ctr->info.inf7);
4452                         break;
4453                 case 0x0c:
4454                         account_policy_get(AP_LOCK_ACCOUNT_DURATION, &account_policy_temp);
4455                         u_lock_duration = account_policy_temp;
4456
4457                         account_policy_get(AP_RESET_COUNT_TIME, &account_policy_temp);
4458                         u_reset_time = account_policy_temp;
4459
4460                         account_policy_get(AP_BAD_ATTEMPT_LOCKOUT, &account_policy_temp);
4461                         lockout = account_policy_temp;
4462
4463                         unix_to_nt_time_abs(&nt_lock_duration, u_lock_duration);
4464                         unix_to_nt_time_abs(&nt_reset_time, u_reset_time);
4465
4466                         init_unk_info12(&ctr->info.inf12, nt_lock_duration, nt_reset_time, (uint16)lockout);
4467                         break;
4468                 default:
4469                         return NT_STATUS_INVALID_INFO_CLASS;
4470         }
4471
4472         init_samr_r_samr_unknown_2e(r_u, q_u->switch_value, ctr, NT_STATUS_OK);
4473
4474         DEBUG(5,("_samr_unknown_2e: %d\n", __LINE__));
4475
4476         return r_u->status;
4477 }
4478
4479 /*******************************************************************
4480  _samr_
4481  ********************************************************************/
4482
4483 NTSTATUS _samr_set_dom_info(pipes_struct *p, SAMR_Q_SET_DOMAIN_INFO *q_u, SAMR_R_SET_DOMAIN_INFO *r_u)
4484 {
4485         time_t u_expire, u_min_age;
4486         time_t u_logout;
4487         time_t u_lock_duration, u_reset_time;
4488
4489         r_u->status = NT_STATUS_OK;
4490
4491         DEBUG(5,("_samr_set_dom_info: %d\n", __LINE__));
4492
4493         /* find the policy handle.  open a policy on it. */
4494         if (!find_policy_by_hnd(p, &q_u->domain_pol, NULL))
4495                 return NT_STATUS_INVALID_HANDLE;
4496
4497         DEBUG(5,("_samr_set_dom_info: switch_value: %d\n", q_u->switch_value));
4498
4499         switch (q_u->switch_value) {
4500                 case 0x01:
4501                         u_expire=nt_time_to_unix_abs(&q_u->ctr->info.inf1.expire);
4502                         u_min_age=nt_time_to_unix_abs(&q_u->ctr->info.inf1.min_passwordage);
4503
4504                         account_policy_set(AP_MIN_PASSWORD_LEN, (uint32)q_u->ctr->info.inf1.min_length_password);
4505                         account_policy_set(AP_PASSWORD_HISTORY, (uint32)q_u->ctr->info.inf1.password_history);
4506                         account_policy_set(AP_USER_MUST_LOGON_TO_CHG_PASS, (uint32)q_u->ctr->info.inf1.flag);
4507                         account_policy_set(AP_MAX_PASSWORD_AGE, (int)u_expire);
4508                         account_policy_set(AP_MIN_PASSWORD_AGE, (int)u_min_age);
4509                         break;
4510                 case 0x02:
4511                         break;
4512                 case 0x03:
4513                         u_logout=nt_time_to_unix_abs(&q_u->ctr->info.inf3.logout);
4514                         account_policy_set(AP_TIME_TO_LOGOUT, (int)u_logout);
4515                         break;
4516                 case 0x05:
4517                         break;
4518                 case 0x06:
4519                         break;
4520                 case 0x07:
4521                         break;
4522                 case 0x0c:
4523                         u_lock_duration=nt_time_to_unix_abs(&q_u->ctr->info.inf12.duration);
4524                         u_reset_time=nt_time_to_unix_abs(&q_u->ctr->info.inf12.reset_count);
4525
4526                         account_policy_set(AP_LOCK_ACCOUNT_DURATION, (int)u_lock_duration);
4527                         account_policy_set(AP_RESET_COUNT_TIME, (int)u_reset_time);
4528                         account_policy_set(AP_BAD_ATTEMPT_LOCKOUT, (uint32)q_u->ctr->info.inf12.bad_attempt_lockout);
4529                         break;
4530                 default:
4531                         return NT_STATUS_INVALID_INFO_CLASS;
4532         }
4533
4534         init_samr_r_set_domain_info(r_u, NT_STATUS_OK);
4535
4536         DEBUG(5,("_samr_set_dom_info: %d\n", __LINE__));
4537
4538         return r_u->status;
4539 }
4540