Add extra abilities for a user with SeAddUsers, so they

can manipulate groups and aliases.
Jeremy.

diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c
index 8b1a90af0279ca05ad816a29ffb9d81188b1a6be..f1725e2454177c91bcf54cdf509a7954bb721270 100644 (file)
--- a/source3/rpc_server/srv_samr_nt.c
+++ b/source3/rpc_server/srv_samr_nt.c
@@ -537,6 +537,7 @@ NTSTATUS _samr_OpenDomain(pipes_struct *p,
        uint32    des_access = r->in.access_mask;
        NTSTATUS  status;
        size_t    sd_size;
+       uint32_t extra_access = SAMR_DOMAIN_ACCESS_CREATE_USER;
        SE_PRIV se_rights;
 
        /* find the connection policy handle. */
@@ -555,13 +556,25 @@ NTSTATUS _samr_OpenDomain(pipes_struct *p,
 
        /*
         * Users with SeMachineAccount or SeAddUser get additional
-        * SAMR_DOMAIN_ACCESS_CREATE_USER access, but no more.
+        * SAMR_DOMAIN_ACCESS_CREATE_USER access.
         */
        se_priv_copy( &se_rights, &se_machine_account );
        se_priv_add( &se_rights, &se_add_users );
 
+       /*
+        * Users with SeAddUser get the ability to manipulate groups
+        * and aliases.
+        */
+       if (user_has_any_privilege(p->server_info->ptok, &se_add_users)) {
+               extra_access |= (SAMR_DOMAIN_ACCESS_CREATE_GROUP |
+                               SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS |
+                               SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT |
+                               SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS |
+                               SAMR_DOMAIN_ACCESS_CREATE_ALIAS);
+       }
+
        status = access_check_samr_object( psd, p->server_info->ptok,
-               &se_rights, SAMR_DOMAIN_ACCESS_CREATE_USER, des_access,
+               &se_rights, extra_access, des_access,
                &acc_granted, "_samr_OpenDomain" );
 
        if ( !NT_STATUS_IS_OK(status) )