s3-samr: remove duplicate copies of SAM server specific access rights.

Guenther

diff --git a/source3/include/rpc_secdes.h b/source3/include/rpc_secdes.h
index fb73498b0df75a3dbd8d687282f8e5d62e7e1950..cb0854eb71d634b849e206646b5e0b5f7e47db00 100644 (file)
--- a/source3/include/rpc_secdes.h
+++ b/source3/include/rpc_secdes.h
@@ -214,37 +214,6 @@ struct standard_mapping {
                SA_RIGHT_FILE_WRITE_DATA        | \
                SA_RIGHT_FILE_READ_DATA)
 
-/* SAM server specific access rights */
-
-#define SA_RIGHT_SAM_CONNECT_SERVER    0x00000001
-#define SA_RIGHT_SAM_SHUTDOWN_SERVER   0x00000002
-#define SA_RIGHT_SAM_INITIALISE_SERVER 0x00000004
-#define SA_RIGHT_SAM_CREATE_DOMAIN     0x00000008
-#define SA_RIGHT_SAM_ENUM_DOMAINS      0x00000010
-#define SA_RIGHT_SAM_OPEN_DOMAIN       0x00000020
-
-#define SA_RIGHT_SAM_ALL_ACCESS                0x0000003F
-
-#define GENERIC_RIGHTS_SAM_ALL_ACCESS \
-               (STANDARD_RIGHTS_REQUIRED_ACCESS| \
-               SA_RIGHT_SAM_ALL_ACCESS)
-
-#define GENERIC_RIGHTS_SAM_READ        \
-               (STANDARD_RIGHTS_READ_ACCESS    | \
-               SA_RIGHT_SAM_ENUM_DOMAINS)
-
-#define GENERIC_RIGHTS_SAM_WRITE \
-               (STANDARD_RIGHTS_WRITE_ACCESS   | \
-               SA_RIGHT_SAM_CREATE_DOMAIN      | \
-               SA_RIGHT_SAM_INITIALISE_SERVER  | \
-               SA_RIGHT_SAM_SHUTDOWN_SERVER)
-
-#define GENERIC_RIGHTS_SAM_EXECUTE \
-               (STANDARD_RIGHTS_EXECUTE_ACCESS | \
-               SA_RIGHT_SAM_OPEN_DOMAIN        | \
-               SA_RIGHT_SAM_CONNECT_SERVER)            
-
-
 /* Domain Object specific access rights */
 
 #define SA_RIGHT_DOMAIN_LOOKUP_INFO_1          0x00000001

diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c
index 97da3a4f3d970525591f493b1eeaedd74f600f72..d5be53b09f3a11df9a51abb4d45a7bed4810e12e 100644 (file)
--- a/source3/rpc_server/srv_samr_nt.c
+++ b/source3/rpc_server/srv_samr_nt.c
@@ -622,7 +622,7 @@ NTSTATUS _samr_OpenDomain(pipes_struct *p,
                return NT_STATUS_INVALID_HANDLE;
 
        status = access_check_samr_function(info->acc_granted,
-                                           SA_RIGHT_SAM_OPEN_DOMAIN,
+                                           SAMR_ACCESS_OPEN_DOMAIN,
                                            "_samr_OpenDomain" );
 
        if ( !NT_STATUS_IS_OK(status) )
@@ -2891,7 +2891,7 @@ NTSTATUS _samr_QueryDomainInfo(pipes_struct *p,
        }
 
        status = access_check_samr_function(info->acc_granted,
-                                           SA_RIGHT_SAM_OPEN_DOMAIN,
+                                           SAMR_ACCESS_OPEN_DOMAIN,
                                            "_samr_QueryDomainInfo" );
 
        if ( !NT_STATUS_IS_OK(status) )
@@ -3284,14 +3284,14 @@ NTSTATUS _samr_Connect(pipes_struct *p,
        if ((info = get_samr_info_by_sid(NULL)) == NULL)
                return NT_STATUS_NO_MEMORY;
 
-       /* don't give away the farm but this is probably ok.  The SA_RIGHT_SAM_ENUM_DOMAINS
+       /* don't give away the farm but this is probably ok.  The SAMR_ACCESS_ENUM_DOMAINS
           was observed from a win98 client trying to enumerate users (when configured
           user level access control on shares)   --jerry */
 
        map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
 
        se_map_generic( &des_access, &sam_generic_mapping );
-       info->acc_granted = des_access & (SA_RIGHT_SAM_ENUM_DOMAINS|SA_RIGHT_SAM_OPEN_DOMAIN);
+       info->acc_granted = des_access & (SAMR_ACCESS_ENUM_DOMAINS|SAMR_ACCESS_OPEN_DOMAIN);
 
        /* get a (unique) handle.  open a policy on it. */
        if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
@@ -3474,11 +3474,11 @@ NTSTATUS _samr_LookupDomain(pipes_struct *p,
        if (!find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info))
                return NT_STATUS_INVALID_HANDLE;
 
-       /* win9x user manager likes to use SA_RIGHT_SAM_ENUM_DOMAINS here.
+       /* win9x user manager likes to use SAMR_ACCESS_ENUM_DOMAINS here.
           Reverted that change so we will work with RAS servers again */
 
        status = access_check_samr_function(info->acc_granted,
-                                           SA_RIGHT_SAM_OPEN_DOMAIN,
+                                           SAMR_ACCESS_OPEN_DOMAIN,
                                            "_samr_LookupDomain");
        if (!NT_STATUS_IS_OK(status)) {
                return status;
@@ -3524,7 +3524,7 @@ NTSTATUS _samr_EnumDomains(pipes_struct *p,
                return NT_STATUS_INVALID_HANDLE;
 
        status = access_check_samr_function(info->acc_granted,
-                                           SA_RIGHT_SAM_ENUM_DOMAINS,
+                                           SAMR_ACCESS_ENUM_DOMAINS,
                                            "_samr_EnumDomains");
        if (!NT_STATUS_IS_OK(status)) {
                return status;

diff --git a/source3/utils/net_rpc.c b/source3/utils/net_rpc.c
index ad22a55cdb068a8b00e9a13905dafb344cac9564..9db755d30b1e0bf66d3315a325ccfe819072133f 100644 (file)
--- a/source3/utils/net_rpc.c
+++ b/source3/utils/net_rpc.c
@@ -6113,7 +6113,7 @@ static int rpc_trustdom_list(struct net_context *c, int argc, const char **argv)
        /* SamrConnect2 */
        nt_status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
                                         pipe_hnd->desthost,
-                                        SA_RIGHT_SAM_OPEN_DOMAIN,
+                                        SAMR_ACCESS_OPEN_DOMAIN,
                                         &connect_hnd);
        if (!NT_STATUS_IS_OK(nt_status)) {
                DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",