r4809: * include SeDiskOperatorPrivilege and SeRemoteShutdownPrivilege

  (noty enfornced yet though)
* add 'enable privileges (off by default) to control whether or
  not any privuleges can be assigned to SIDs
(This used to be commit cf63519169d2f3c56a6acf46b9257f4c11d5ea74)

diff --git a/source3/include/privileges.h b/source3/include/privileges.h
index b4972c7a602ef895a949ca11af058f1ecfc16fcd..85087f624f91c24be5923ce6baa5c33695b9d056 100644 (file)
--- a/source3/include/privileges.h
+++ b/source3/include/privileges.h
@@ -45,6 +45,8 @@
 #define SE_MACHINE_ACCOUNT             { { 0x00000010, 0x00000000, 0x00000000, 0x00000000 } }
 #define SE_PRINT_OPERATOR              { { 0x00000020, 0x00000000, 0x00000000, 0x00000000 } }
 #define SE_ADD_USERS                   { { 0x00000040, 0x00000000, 0x00000000, 0x00000000 } }
+#define SE_DISK_OPERATOR               { { 0x00000080, 0x00000000, 0x00000000, 0x00000000 } }
+#define SE_REMOTE_SHUTDOWN             { { 0x00000100, 0x00000000, 0x00000000, 0x00000000 } }
 
 #if 0  /* not needed currently */
 

diff --git a/source3/lib/privileges.c b/source3/lib/privileges.c
index 973e9acc65f7a6c965d998d035cfe342ebb517ec..b84800a0e10c4e7bfd1bdfe1d9af10adc400e34a 100644 (file)
--- a/source3/lib/privileges.c
+++ b/source3/lib/privileges.c
@@ -31,23 +31,23 @@ static SE_PRIV se_priv_all  = SE_ALL_PRIVS;
 static SE_PRIV se_priv_end  = SE_END;
 static SE_PRIV se_priv_none = SE_NONE;
 
-
-#define ALLOC_CHECK(ptr, err, label, str) do { if ((ptr) == NULL) \
-       { DEBUG(0, ("%s: out of memory!\n", str)); err = NT_STATUS_NO_MEMORY; goto label; } } while(0)
-       
 PRIVS privs[] = {
-       {SE_NETWORK_LOGON,              "SeNetworkLogonRight",                  "Access this computer from the network"},
+#if 0  /* usrmgr will display these twice if you include them.  We don't 
+          use them but we'll keep the bitmasks reserved in privileges.h anyways */
+          
+       {SE_NETWORK_LOGON,              "SeNetworkLogonRight",                  "Access this computer from network"},
        {SE_INTERACTIVE_LOGON,          "SeInteractiveLogonRight",              "Log on locally"},
        {SE_BATCH_LOGON,                "SeBatchLogonRight",                    "Log on as a batch job"},
        {SE_SERVICE_LOGON,              "SeServiceLogonRight",                  "Log on as a service"},
-
+#endif
        {SE_MACHINE_ACCOUNT,            "SeMachineAccountPrivilege",            "Add machines to domain"},
-       {SE_PRINT_OPERATOR,             "SePrintOperatorPrivilege",             "Printer Admin"},
+       {SE_PRINT_OPERATOR,             "SePrintOperatorPrivilege",             "Manage printers"},
        {SE_ADD_USERS,                  "SeAddUsersPrivilege",                  "Add users and groups to the domain"},
+       {SE_REMOTE_SHUTDOWN,            "SeRemoteShutdownPrivilege",            "Force shutdown from a remote system"},
+       {SE_DISK_OPERATOR,              "SeDiskOperatorPrivilege",              "Manage disk shares"},
 
        {SE_END,                        "",                                     ""}
 };
-       
 
 #if 0  /* not needed currently */
 PRIVS privs[] = {
@@ -74,12 +74,9 @@ PRIVS privs[] = {
        {SE_AUDIT,                      "SeAuditPrivilege",                     "Audit"},
        {SE_SYSTEM_ENVIRONMENT,         "SeSystemEnvironmentPrivilege",         "System Environment Privilege"},
        {SE_CHANGE_NOTIFY,              "SeChangeNotifyPrivilege",              "Change Notify"},
-       {SE_REMOTE_SHUTDOWN,            "SeRemoteShutdownPrivilege",            "Remote Shutdown Privilege"},
        {SE_UNDOCK,                     "SeUndockPrivilege",                    "Undock"},
        {SE_SYNC_AGENT,                 "SeSynchronizationAgentPrivilege",      "Synchronization Agent"},
        {SE_ENABLE_DELEGATION,          "SeEnableDelegationPrivilege",          "Enable Delegation"},
-       {SE_PRINT_OPERATOR,             "SePrintOperatorPrivilege",             "Printer Operator"},
-       {SE_ADD_USERS,                  "SeAddUsersPrivilege",                  "Add Users"},
        {SE_ALL_PRIVS,                  "SeAllPrivileges",                      "All Privileges"}
        {SE_END,                        "",                                     ""}
 };
@@ -181,6 +178,12 @@ static BOOL get_privileges( const DOM_SID *sid, SE_PRIV *mask )
        TDB_CONTEXT *tdb = get_account_pol_tdb();
        fstring keystr;
        TDB_DATA key, data;
+
+       /* Fail if the admin has not enable privileges */
+       
+       if ( !lp_enable_privileges() ) {
+               return False;
+       }
        
        if ( !tdb )
                return False;
@@ -203,6 +206,7 @@ static BOOL get_privileges( const DOM_SID *sid, SE_PRIV *mask )
        
        se_priv_copy( mask, (SE_PRIV*)data.dptr );
        
+       
        return True;
 }
 
@@ -427,29 +431,6 @@ NTSTATUS privilege_enumerate_accounts(DOM_SID **sids, int *num_sids)
        return NT_STATUS_OK;
 }
 
-#if 0  /* JERRY - not used */
-/***************************************************************************
- Retrieve the SIDs assigned to a given privilege
-****************************************************************************/
-
- NTSTATUS priv_get_sids(const char *privname, DOM_SID **sids, int *num_sids)
-{
-       TDB_CONTEXT *tdb = get_account_pol_tdb();
-       PRIV_SID_LIST priv;
-       
-       ZERO_STRUCT(priv);      
-
-       tdb_traverse( tdb, priv_traverse_fn, &priv);
-
-       /* give the memory away; caller will free */
-       
-       *sids      = priv.sids.list;
-       *num_sids  = priv.sids.count;
-
-       return NT_STATUS_OK;
-}
-#endif
-
 /***************************************************************************
  Add privilege to sid
 ****************************************************************************/
@@ -563,20 +544,19 @@ NTSTATUS privilege_create_account(const DOM_SID *sid )
  ****************************************************************************/
 NTSTATUS privilege_set_init(PRIVILEGE_SET *priv_set)
 {
-       NTSTATUS ret;
        TALLOC_CTX *mem_ctx;
        
        ZERO_STRUCTP( priv_set );
 
        mem_ctx = talloc_init("privilege set");
-       ALLOC_CHECK(mem_ctx, ret, done, "init_privilege");
+       if ( !mem_ctx ) {
+               DEBUG(0,("privilege_set_init: failed to initialize talloc ctx!\n"));
+               return NT_STATUS_NO_MEMORY;
+       }
 
        priv_set->mem_ctx = mem_ctx;
 
-       ret = NT_STATUS_OK;
-
-done:
-       return ret;
+       return NT_STATUS_OK;
 }
 
 /****************************************************************************
@@ -614,7 +594,6 @@ void privilege_set_free(PRIVILEGE_SET *priv_set)
 
 NTSTATUS dup_luid_attr(TALLOC_CTX *mem_ctx, LUID_ATTR **new_la, LUID_ATTR *old_la, int count)
 {
-       NTSTATUS ret;
        int i;
 
        /* don't crash if the source pointer is NULL (since we don't
@@ -624,7 +603,10 @@ NTSTATUS dup_luid_attr(TALLOC_CTX *mem_ctx, LUID_ATTR **new_la, LUID_ATTR *old_l
                return NT_STATUS_OK;
 
        *new_la = TALLOC_ARRAY(mem_ctx, LUID_ATTR, count);
-       ALLOC_CHECK(new_la, ret, done, "dupalloc_luid_attr");
+       if ( !*new_la ) {
+               DEBUG(0,("dup_luid_attr: failed to alloc new LUID_ATTR array [%d]\n", count));
+               return NT_STATUS_NO_MEMORY;
+       }
 
        for (i=0; i<count; i++) {
                (*new_la)[i].luid.high = old_la[i].luid.high;
@@ -632,38 +614,8 @@ NTSTATUS dup_luid_attr(TALLOC_CTX *mem_ctx, LUID_ATTR **new_la, LUID_ATTR *old_l
                (*new_la)[i].attr = old_la[i].attr;
        }
        
-       ret = NT_STATUS_OK;
-
-done:
-       return ret;
-}
-
-#if 0 /* not used */
-/****************************************************************************
- Performa deep copy of a PRIVILEGE_SET structure.  Assumes an initialized 
- destination structure.
-*****************************************************************************/
-
- BOOL dup_privilege_set( PRIVILEGE_SET *dest, PRIVILEGE_SET *src )
-{
-       NTSTATUS result;
-       
-       if ( !dest || !src )
-               return False;
-
-       result = dup_luid_attr( dest->mem_ctx, &dest->set, src->set, src->count );
-       if ( !NT_STATUS_IS_OK(result) ) {
-               DEBUG(0,("dup_privilege_set: Failed to dup LUID_ATTR array [%s]\n", 
-                       nt_errstr(result) ));
-               return False;
-       }
-       
-       dest->control  = src->control;
-       dest->count    = src->count;
-
-       return True;
+       return NT_STATUS_OK;
 }
-#endif
 
 /****************************************************************************
  Does the user have the specified privilege ?  We only deal with one privilege
@@ -732,21 +684,6 @@ int count_all_privileges( void )
        return count;
 }
 
-#if 0  /* not used */
-/*******************************************************************
- return True is the SID has an entry in the account_pol.tdb
-*******************************************************************/
-
- BOOL is_privileged_sid( DOM_SID *sid ) 
-{
-       SE_PRIV mask;
-
-       /* check if the lookup succeeds */
-
-       return get_privileges( sid, &mask );
-}
-#endif
-
 /*******************************************************************
 *******************************************************************/
 

diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index e6beebedb8e8540929105d81488d9538f0444c75..8531b2fdd13603fd5d7233d5028adb76efc50aed 100644 (file)
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -291,6 +291,7 @@ typedef struct
        BOOL bKernelChangeNotify;
        BOOL bUseKerberosKeytab;
        BOOL bDeferSharingViolations;
+       BOOL bEnablePrivileges;
        int restrict_anonymous;
        int name_cache_timeout;
        int client_signing;
@@ -809,6 +810,7 @@ static struct parm_struct parm_table[] = {
        {"root dir", P_STRING, P_GLOBAL, &Globals.szRootdir, NULL, NULL, FLAG_HIDE}, 
        {"root", P_STRING, P_GLOBAL, &Globals.szRootdir, NULL, NULL, FLAG_HIDE}, 
        {"guest account", P_STRING, P_GLOBAL, &Globals.szGuestaccount, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED}, 
+       {"enable privileges", P_BOOL, P_GLOBAL, &Globals.bEnablePrivileges, NULL, NULL, FLAG_ADVANCED}, 
 
        {"pam password change", P_BOOL, P_GLOBAL, &Globals.bPamPasswordChange, NULL, NULL, FLAG_ADVANCED}, 
        {"passwd program", P_STRING, P_GLOBAL, &Globals.szPasswdProgram, NULL, NULL, FLAG_ADVANCED}, 
@@ -1538,6 +1540,12 @@ static void init_globals(void)
 
        Globals.bDeferSharingViolations = True;
        string_set(&Globals.smb_ports, SMB_PORTS);
+
+       /* don't enable privileges by default since Domain 
+          Admins can then assign thr rights to perform certain 
+          operations as root */
+
+       Globals.bEnablePrivileges = False;
 }
 
 static TALLOC_CTX *lp_talloc;
@@ -1775,6 +1783,7 @@ FN_GLOBAL_BOOL(lp_hostname_lookups, &Globals.bHostnameLookups)
 FN_GLOBAL_BOOL(lp_kernel_change_notify, &Globals.bKernelChangeNotify)
 FN_GLOBAL_BOOL(lp_use_kerberos_keytab, &Globals.bUseKerberosKeytab)
 FN_GLOBAL_BOOL(lp_defer_sharing_violations, &Globals.bDeferSharingViolations)
+FN_GLOBAL_BOOL(lp_enable_privileges, &Globals.bEnablePrivileges)
 FN_GLOBAL_INTEGER(lp_os_level, &Globals.os_level)
 FN_GLOBAL_INTEGER(lp_max_ttl, &Globals.max_ttl)
 FN_GLOBAL_INTEGER(lp_max_wins_ttl, &Globals.max_wins_ttl)