*/
#include "includes.h"
+#include "smbd/globals.h"
#include "../libcli/auth/libcli_auth.h"
#undef DBGC_CLASS
level of access for further checks.
********************************************************************/
-static NTSTATUS access_check_samr_object( SEC_DESC *psd, NT_USER_TOKEN *token,
+NTSTATUS access_check_object( SEC_DESC *psd, NT_USER_TOKEN *token,
SE_PRIV *rights, uint32 rights_mask,
uint32 des_access, uint32 *acc_granted,
const char *debug )
saved_mask = (des_access & rights_mask);
des_access &= ~saved_mask;
- DEBUG(4,("access_check_samr_object: user rights access mask [0x%x]\n",
+ DEBUG(4,("access_check_object: user rights access mask [0x%x]\n",
rights_mask));
}
Map any MAXIMUM_ALLOWED_ACCESS request to a valid access set.
********************************************************************/
-static void map_max_allowed_access(const NT_USER_TOKEN *token,
+void map_max_allowed_access(const NT_USER_TOKEN *token,
uint32_t *pacc_requested)
{
if (!((*pacc_requested) & MAXIMUM_ALLOWED_ACCESS)) {
}
*pacc_requested &= ~MAXIMUM_ALLOWED_ACCESS;
- /* At least try for generic read. */
- *pacc_requested = GENERIC_READ_ACCESS;
+ /* At least try for generic read|execute - Everyone gets that. */
+ *pacc_requested = GENERIC_READ_ACCESS|GENERIC_EXECUTE_ACCESS;
/* root gets anything. */
if (geteuid() == sec_initial_uid()) {
SAMR_DOMAIN_ACCESS_CREATE_ALIAS);
}
- status = access_check_samr_object( psd, p->server_info->ptok,
+ status = access_check_object( psd, p->server_info->ptok,
&se_rights, extra_access, des_access,
&acc_granted, "_samr_OpenDomain" );
make_group_sam_entry_list(p->mem_ctx, &samr_entries,
num_groups, groups);
+ if (MAX_SAM_ENTRIES <= num_groups) {
+ status = STATUS_MORE_ENTRIES;
+ } else {
+ status = NT_STATUS_OK;
+ }
+
samr_array->count = num_groups;
samr_array->entries = samr_entries;
DEBUG(5,("_samr_EnumDomainAliases: %d\n", __LINE__));
+ if (MAX_SAM_ENTRIES <= num_aliases) {
+ status = STATUS_MORE_ENTRIES;
+ } else {
+ status = NT_STATUS_OK;
+ }
+
samr_array->count = num_aliases;
samr_array->entries = samr_entries;
uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
uint32 max_entries = r->in.max_entries;
- uint32 enum_context = r->in.start_idx;
- uint32 max_size = r->in.buf_size;
union samr_DispInfo *disp_info = r->out.info;
}
/* first limit the number of entries we will return */
- if(max_entries > max_sam_entries) {
+ if (r->in.max_entries > max_sam_entries) {
DEBUG(5, ("_samr_QueryDisplayInfo: client requested %d "
- "entries, limiting to %d\n", max_entries,
+ "entries, limiting to %d\n", r->in.max_entries,
max_sam_entries));
max_entries = max_sam_entries;
}
temp_size=max_entries*struct_size;
- if (temp_size>max_size) {
- max_entries=MIN((max_size/struct_size),max_entries);;
+ if (temp_size > r->in.buf_size) {
+ max_entries = MIN((r->in.buf_size / struct_size),max_entries);;
DEBUG(5, ("_samr_QueryDisplayInfo: buffer size limits to "
"only %d entries\n", max_entries));
}
return NT_STATUS_ACCESS_DENIED;
}
DEBUG(10,("_samr_QueryDisplayInfo: starting user enumeration at index %u\n",
- (unsigned int)enum_context ));
+ (unsigned int)r->in.start_idx));
} else {
DEBUG(10,("_samr_QueryDisplayInfo: using cached user enumeration at index %u\n",
- (unsigned int)enum_context ));
+ (unsigned int)r->in.start_idx));
}
num_account = pdb_search_entries(dinfo->disp_info->users,
- enum_context, max_entries,
+ r->in.start_idx, max_entries,
&entries);
break;
case 2:
return NT_STATUS_ACCESS_DENIED;
}
DEBUG(10,("_samr_QueryDisplayInfo: starting machine enumeration at index %u\n",
- (unsigned int)enum_context ));
+ (unsigned int)r->in.start_idx));
} else {
DEBUG(10,("_samr_QueryDisplayInfo: using cached machine enumeration at index %u\n",
- (unsigned int)enum_context ));
+ (unsigned int)r->in.start_idx));
}
num_account = pdb_search_entries(dinfo->disp_info->machines,
- enum_context, max_entries,
+ r->in.start_idx, max_entries,
&entries);
break;
case 3:
return NT_STATUS_ACCESS_DENIED;
}
DEBUG(10,("_samr_QueryDisplayInfo: starting group enumeration at index %u\n",
- (unsigned int)enum_context ));
+ (unsigned int)r->in.start_idx));
} else {
DEBUG(10,("_samr_QueryDisplayInfo: using cached group enumeration at index %u\n",
- (unsigned int)enum_context ));
+ (unsigned int)r->in.start_idx));
}
num_account = pdb_search_entries(dinfo->disp_info->groups,
- enum_context, max_entries,
+ r->in.start_idx, max_entries,
&entries);
break;
default:
switch (r->in.level) {
case 1:
disp_ret = init_samr_dispinfo_1(p->mem_ctx, &disp_info->info1,
- num_account, enum_context,
+ num_account, r->in.start_idx,
entries);
break;
case 2:
disp_ret = init_samr_dispinfo_2(p->mem_ctx, &disp_info->info2,
- num_account, enum_context,
+ num_account, r->in.start_idx,
entries);
break;
case 3:
disp_ret = init_samr_dispinfo_3(p->mem_ctx, &disp_info->info3,
- num_account, enum_context,
+ num_account, r->in.start_idx,
entries);
break;
case 4:
disp_ret = init_samr_dispinfo_4(p->mem_ctx, &disp_info->info4,
- num_account, enum_context,
+ num_account, r->in.start_idx,
entries);
break;
case 5:
disp_ret = init_samr_dispinfo_5(p->mem_ctx, &disp_info->info5,
- num_account, enum_context,
+ num_account, r->in.start_idx,
entries);
break;
default:
NTSTATUS _samr_ChangePasswordUser2(pipes_struct *p,
struct samr_ChangePasswordUser2 *r)
{
+ struct smbd_server_connection *sconn = smbd_server_conn;
NTSTATUS status;
fstring user_name;
fstring wks;
* function.
*/
- (void)map_username(user_name);
+ (void)map_username(sconn, user_name);
/*
* UNIX username case mangling not required, pass_oem_change
NTSTATUS _samr_OemChangePasswordUser2(pipes_struct *p,
struct samr_OemChangePasswordUser2 *r)
{
+ struct smbd_server_connection *sconn = smbd_server_conn;
NTSTATUS status;
fstring user_name;
const char *wks = NULL;
* function.
*/
- (void)map_username(user_name);
+ (void)map_username(sconn, user_name);
/*
* UNIX username case mangling not required, pass_oem_change
NTSTATUS _samr_ChangePasswordUser3(pipes_struct *p,
struct samr_ChangePasswordUser3 *r)
{
+ struct smbd_server_connection *sconn = smbd_server_conn;
NTSTATUS status;
fstring user_name;
const char *wks = NULL;
* function.
*/
- (void)map_username(user_name);
+ (void)map_username(sconn, user_name);
/*
* UNIX username case mangling not required, pass_oem_change
TALLOC_FREE(sampass);
- nt_status = access_check_samr_object(psd, p->server_info->ptok,
+ nt_status = access_check_object(psd, p->server_info->ptok,
&se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
&acc_granted, "_samr_OpenUser");
* just assume we have all the rights we need ?
*/
- nt_status = access_check_samr_object(psd, p->server_info->ptok,
+ nt_status = access_check_object(psd, p->server_info->ptok,
&se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
&acc_granted, "_samr_CreateUser2");
make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
se_map_generic(&des_access, &sam_generic_mapping);
- nt_status = access_check_samr_object(psd, p->server_info->ptok,
+ nt_status = access_check_object(psd, p->server_info->ptok,
NULL, 0, des_access, &acc_granted, fn);
if ( !NT_STATUS_IS_OK(nt_status) )
se_priv_copy( &se_rights, &se_add_users );
- status = access_check_samr_object(psd, p->server_info->ptok,
+ status = access_check_object(psd, p->server_info->ptok,
&se_rights, GENERIC_RIGHTS_ALIAS_ALL_ACCESS,
des_access, &acc_granted, "_samr_OpenAlias");
se_priv_copy( &se_rights, &se_add_users );
- status = access_check_samr_object(psd, p->server_info->ptok,
+ status = access_check_object(psd, p->server_info->ptok,
&se_rights, GENERIC_RIGHTS_GROUP_ALL_ACCESS,
des_access, &acc_granted, "_samr_OpenGroup");
git.samba.org / ira / wip.git / blobdiff