3b044944d9291e22eaf967f333cdfe3c0c09b0b7
[kai/samba.git] / source3 / rpc_server / srv_svcctl_nt.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  RPC Pipe client / server routines
4  *
5  *  Copyright (C) Marcin Krzysztof Porwit           2005.
6  *
7  *  Largely Rewritten (Again) by:
8  *  Copyright (C) Gerald (Jerry) Carter             2005.
9  *  Copyright (C) Guenther Deschner                 2008,2009.
10  *
11  *  This program is free software; you can redistribute it and/or modify
12  *  it under the terms of the GNU General Public License as published by
13  *  the Free Software Foundation; either version 3 of the License, or
14  *  (at your option) any later version.
15  *
16  *  This program is distributed in the hope that it will be useful,
17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19  *  GNU General Public License for more details.
20  *
21  *  You should have received a copy of the GNU General Public License
22  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
23  */
24
25 #include "includes.h"
26
27 #undef DBGC_CLASS
28 #define DBGC_CLASS DBGC_RPC_SRV
29
30 struct service_control_op {
31         const char *name;
32         SERVICE_CONTROL_OPS *ops;
33 };
34
35 #define SVCCTL_NUM_INTERNAL_SERVICES    4
36
37 /* handle external services */
38 extern SERVICE_CONTROL_OPS rcinit_svc_ops;
39
40 /* builtin services (see service_db.c and services/svc_*.c */
41 extern SERVICE_CONTROL_OPS spoolss_svc_ops;
42 extern SERVICE_CONTROL_OPS netlogon_svc_ops;
43 extern SERVICE_CONTROL_OPS winreg_svc_ops;
44 extern SERVICE_CONTROL_OPS wins_svc_ops;
45
46 /* make sure this number patches the number of builtin
47    SERVICE_CONTROL_OPS structure listed above */
48
49 #define SVCCTL_NUM_INTERNAL_SERVICES    4
50
51 struct service_control_op *svcctl_ops;
52
53 static const struct generic_mapping scm_generic_map =
54         { SC_MANAGER_READ_ACCESS, SC_MANAGER_WRITE_ACCESS, SC_MANAGER_EXECUTE_ACCESS, SC_MANAGER_ALL_ACCESS };
55 static const struct generic_mapping svc_generic_map =
56         { SERVICE_READ_ACCESS, SERVICE_WRITE_ACCESS, SERVICE_EXECUTE_ACCESS, SERVICE_ALL_ACCESS };
57
58
59 /********************************************************************
60 ********************************************************************/
61
62 bool init_service_op_table( void )
63 {
64         const char **service_list = lp_svcctl_list();
65         int num_services = SVCCTL_NUM_INTERNAL_SERVICES + str_list_length( service_list );
66         int i;
67
68         if ( !(svcctl_ops = TALLOC_ARRAY( NULL, struct service_control_op, num_services+1)) ) {
69                 DEBUG(0,("init_service_op_table: talloc() failed!\n"));
70                 return False;
71         }
72
73         /* services listed in smb.conf get the rc.init interface */
74
75         for ( i=0; service_list && service_list[i]; i++ ) {
76                 svcctl_ops[i].name = talloc_strdup( svcctl_ops, service_list[i] );
77                 svcctl_ops[i].ops  = &rcinit_svc_ops;
78         }
79
80         /* add builtin services */
81
82         svcctl_ops[i].name = talloc_strdup( svcctl_ops, "Spooler" );
83         svcctl_ops[i].ops  = &spoolss_svc_ops;
84         i++;
85
86         svcctl_ops[i].name = talloc_strdup( svcctl_ops, "NETLOGON" );
87         svcctl_ops[i].ops  = &netlogon_svc_ops;
88         i++;
89
90         svcctl_ops[i].name = talloc_strdup( svcctl_ops, "RemoteRegistry" );
91         svcctl_ops[i].ops  = &winreg_svc_ops;
92         i++;
93
94         svcctl_ops[i].name = talloc_strdup( svcctl_ops, "WINS" );
95         svcctl_ops[i].ops  = &wins_svc_ops;
96         i++;
97
98         /* NULL terminate the array */
99
100         svcctl_ops[i].name = NULL;
101         svcctl_ops[i].ops  = NULL;
102
103         return True;
104 }
105
106 /********************************************************************
107 ********************************************************************/
108
109 static struct service_control_op* find_service_by_name( const char *name )
110 {
111         int i;
112
113         for ( i=0; svcctl_ops[i].name; i++ ) {
114                 if ( strequal( name, svcctl_ops[i].name ) )
115                         return &svcctl_ops[i];
116         }
117
118         return NULL;
119 }
120 /********************************************************************
121 ********************************************************************/
122
123 static NTSTATUS svcctl_access_check( SEC_DESC *sec_desc, NT_USER_TOKEN *token,
124                                      uint32 access_desired, uint32 *access_granted )
125 {
126         if ( geteuid() == sec_initial_uid() ) {
127                 DEBUG(5,("svcctl_access_check: using root's token\n"));
128                 token = get_root_nt_token();
129         }
130
131         return se_access_check( sec_desc, token, access_desired, access_granted);
132 }
133
134 /********************************************************************
135 ********************************************************************/
136
137 static SEC_DESC* construct_scm_sd( TALLOC_CTX *ctx )
138 {
139         SEC_ACE ace[2];
140         size_t i = 0;
141         SEC_DESC *sd;
142         SEC_ACL *acl;
143         size_t sd_size;
144
145         /* basic access for Everyone */
146
147         init_sec_ace(&ace[i++], &global_sid_World,
148                 SEC_ACE_TYPE_ACCESS_ALLOWED, SC_MANAGER_READ_ACCESS, 0);
149
150         /* Full Access 'BUILTIN\Administrators' */
151
152         init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators,
153                 SEC_ACE_TYPE_ACCESS_ALLOWED, SC_MANAGER_ALL_ACCESS, 0);
154
155
156         /* create the security descriptor */
157
158         if ( !(acl = make_sec_acl(ctx, NT4_ACL_REVISION, i, ace)) )
159                 return NULL;
160
161         if ( !(sd = make_sec_desc(ctx, SECURITY_DESCRIPTOR_REVISION_1,
162                                   SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL,
163                                   acl, &sd_size)) )
164                 return NULL;
165
166         return sd;
167 }
168
169 /******************************************************************
170  Find a registry key handle and return a SERVICE_INFO
171  *****************************************************************/
172
173 static SERVICE_INFO *find_service_info_by_hnd(pipes_struct *p, POLICY_HND *hnd)
174 {
175         SERVICE_INFO *service_info = NULL;
176
177         if( !find_policy_by_hnd( p, hnd, (void **)(void *)&service_info) ) {
178                 DEBUG(2,("find_service_info_by_hnd: handle not found\n"));
179                 return NULL;
180         }
181
182         return service_info;
183 }
184
185 /******************************************************************
186  *****************************************************************/
187
188 static WERROR create_open_service_handle( pipes_struct *p, POLICY_HND *handle, uint32 type,
189                                           const char *service, uint32 access_granted )
190 {
191         SERVICE_INFO *info = NULL;
192         WERROR result = WERR_OK;
193         struct service_control_op *s_op;
194
195         if ( !(info = TALLOC_ZERO_P( NULL, SERVICE_INFO )) )
196                 return WERR_NOMEM;
197
198         /* the Service Manager has a NULL name */
199
200         info->type = SVC_HANDLE_IS_SCM;
201
202         switch ( type ) {
203         case SVC_HANDLE_IS_SCM:
204                 info->type = SVC_HANDLE_IS_SCM;
205                 break;
206
207         case SVC_HANDLE_IS_DBLOCK:
208                 info->type = SVC_HANDLE_IS_DBLOCK;
209                 break;
210
211         case SVC_HANDLE_IS_SERVICE:
212                 info->type = SVC_HANDLE_IS_SERVICE;
213
214                 /* lookup the SERVICE_CONTROL_OPS */
215
216                 if ( !(s_op = find_service_by_name( service )) ) {
217                         result = WERR_NO_SUCH_SERVICE;
218                         goto done;
219                 }
220
221                 info->ops = s_op->ops;
222
223                 if ( !(info->name  = talloc_strdup( info, s_op->name )) ) {
224                         result = WERR_NOMEM;
225                         goto done;
226                 }
227                 break;
228
229         default:
230                 result = WERR_NO_SUCH_SERVICE;
231                 goto done;
232         }
233
234         info->access_granted = access_granted;
235
236         /* store the SERVICE_INFO and create an open handle */
237
238         if ( !create_policy_hnd( p, handle, info ) ) {
239                 result = WERR_ACCESS_DENIED;
240                 goto done;
241         }
242
243 done:
244         if ( !W_ERROR_IS_OK(result) )
245                 TALLOC_FREE(info);
246
247         return result;
248 }
249
250 /********************************************************************
251  _svcctl_OpenSCManagerW
252 ********************************************************************/
253
254 WERROR _svcctl_OpenSCManagerW(pipes_struct *p,
255                               struct svcctl_OpenSCManagerW *r)
256 {
257         SEC_DESC *sec_desc;
258         uint32 access_granted = 0;
259         NTSTATUS status;
260
261         /* perform access checks */
262
263         if ( !(sec_desc = construct_scm_sd( p->mem_ctx )) )
264                 return WERR_NOMEM;
265
266         se_map_generic( &r->in.access_mask, &scm_generic_map );
267         status = svcctl_access_check( sec_desc, p->server_info->ptok,
268                                       r->in.access_mask, &access_granted );
269         if ( !NT_STATUS_IS_OK(status) )
270                 return ntstatus_to_werror( status );
271
272         return create_open_service_handle( p, r->out.handle, SVC_HANDLE_IS_SCM, NULL, access_granted );
273 }
274
275 /********************************************************************
276  _svcctl_OpenServiceW
277 ********************************************************************/
278
279 WERROR _svcctl_OpenServiceW(pipes_struct *p,
280                             struct svcctl_OpenServiceW *r)
281 {
282         SEC_DESC *sec_desc;
283         uint32 access_granted = 0;
284         NTSTATUS status;
285         const char *service = NULL;
286
287         service = r->in.ServiceName;
288         if (!service) {
289                 return WERR_NOMEM;
290         }
291         DEBUG(5, ("_svcctl_OpenServiceW: Attempting to open Service [%s], \n", service));
292
293         /* based on my tests you can open a service if you have a valid scm handle */
294
295         if ( !find_service_info_by_hnd( p, r->in.scmanager_handle) )
296                 return WERR_BADFID;
297
298         /* perform access checks.  Use the root token in order to ensure that we
299            retrieve the security descriptor */
300
301         if ( !(sec_desc = svcctl_get_secdesc( p->mem_ctx, service, get_root_nt_token() )) )
302                 return WERR_NOMEM;
303
304         se_map_generic( &r->in.access_mask, &svc_generic_map );
305         status = svcctl_access_check( sec_desc, p->server_info->ptok,
306                                       r->in.access_mask, &access_granted );
307         if ( !NT_STATUS_IS_OK(status) )
308                 return ntstatus_to_werror( status );
309
310         return create_open_service_handle( p, r->out.handle, SVC_HANDLE_IS_SERVICE, service, access_granted );
311 }
312
313 /********************************************************************
314  _svcctl_CloseServiceHandle
315 ********************************************************************/
316
317 WERROR _svcctl_CloseServiceHandle(pipes_struct *p,
318                                   struct svcctl_CloseServiceHandle *r)
319 {
320         if ( !close_policy_hnd( p, r->in.handle ) )
321                 return  WERR_BADFID;
322
323         ZERO_STRUCTP(r->out.handle);
324
325         return WERR_OK;
326 }
327
328 /********************************************************************
329  _svcctl_GetServiceDisplayNameW
330 ********************************************************************/
331
332 WERROR _svcctl_GetServiceDisplayNameW(pipes_struct *p,
333                                       struct svcctl_GetServiceDisplayNameW *r)
334 {
335         const char *service;
336         const char *display_name;
337         SERVICE_INFO *info = find_service_info_by_hnd( p, r->in.handle );
338
339         /* can only use an SCM handle here */
340
341         if ( !info || (info->type != SVC_HANDLE_IS_SCM) )
342                 return WERR_BADFID;
343
344         service = r->in.service_name;
345
346         display_name = svcctl_lookup_dispname(p->mem_ctx, service,
347                                               p->server_info->ptok);
348         if (!display_name) {
349                 display_name = "";
350         }
351
352         *r->out.display_name = display_name;
353         *r->out.display_name_length = strlen(display_name);
354
355         return WERR_OK;
356 }
357
358 /********************************************************************
359  _svcctl_QueryServiceStatus
360 ********************************************************************/
361
362 WERROR _svcctl_QueryServiceStatus(pipes_struct *p,
363                                   struct svcctl_QueryServiceStatus *r)
364 {
365         SERVICE_INFO *info = find_service_info_by_hnd( p, r->in.handle );
366
367         /* perform access checks */
368
369         if ( !info || (info->type != SVC_HANDLE_IS_SERVICE) )
370                 return WERR_BADFID;
371
372         if ( !(info->access_granted & SC_RIGHT_SVC_QUERY_STATUS) )
373                 return WERR_ACCESS_DENIED;
374
375         /* try the service specific status call */
376
377         return info->ops->service_status( info->name, r->out.service_status );
378 }
379
380 /********************************************************************
381 ********************************************************************/
382
383 static int enumerate_status( TALLOC_CTX *ctx, struct ENUM_SERVICE_STATUSW **status, NT_USER_TOKEN *token )
384 {
385         int num_services = 0;
386         int i;
387         struct ENUM_SERVICE_STATUSW *st;
388         const char *display_name;
389
390         /* just count */
391         while ( svcctl_ops[num_services].name )
392                 num_services++;
393
394         if ( !(st = TALLOC_ARRAY( ctx, struct ENUM_SERVICE_STATUSW, num_services )) ) {
395                 DEBUG(0,("enumerate_status: talloc() failed!\n"));
396                 return -1;
397         }
398
399         for ( i=0; i<num_services; i++ ) {
400                 st[i].service_name = talloc_strdup(st, svcctl_ops[i].name );
401
402                 display_name = svcctl_lookup_dispname(ctx, svcctl_ops[i].name, token );
403                 st[i].display_name = talloc_strdup(st, display_name ? display_name : "");
404
405                 svcctl_ops[i].ops->service_status( svcctl_ops[i].name, &st[i].status );
406         }
407
408         *status = st;
409
410         return num_services;
411 }
412
413 /********************************************************************
414  _svcctl_EnumServicesStatusW
415 ********************************************************************/
416
417 WERROR _svcctl_EnumServicesStatusW(pipes_struct *p,
418                                    struct svcctl_EnumServicesStatusW *r)
419 {
420         struct ENUM_SERVICE_STATUSW *services = NULL;
421         int num_services;
422         int i = 0;
423         size_t buffer_size = 0;
424         WERROR result = WERR_OK;
425         SERVICE_INFO *info = find_service_info_by_hnd( p, r->in.handle );
426         NT_USER_TOKEN *token = p->server_info->ptok;
427         DATA_BLOB blob = data_blob_null;
428
429         /* perform access checks */
430
431         if ( !info || (info->type != SVC_HANDLE_IS_SCM) )
432                 return WERR_BADFID;
433
434         if ( !(info->access_granted & SC_RIGHT_MGR_ENUMERATE_SERVICE) ) {
435                 return WERR_ACCESS_DENIED;
436         }
437
438         num_services = enumerate_status( p->mem_ctx, &services, token );
439         if (num_services == -1 ) {
440                 return WERR_NOMEM;
441         }
442
443         for ( i=0; i<num_services; i++ ) {
444                 buffer_size += ndr_size_ENUM_SERVICE_STATUSW(&services[i], NULL, 0);
445         }
446
447         buffer_size += buffer_size % 4;
448
449         if (buffer_size > r->in.buf_size ) {
450                 num_services = 0;
451                 result = WERR_MORE_DATA;
452         }
453
454         if ( W_ERROR_IS_OK(result) ) {
455
456                 enum ndr_err_code ndr_err;
457                 struct ndr_push *ndr;
458
459                 ndr = ndr_push_init_ctx(p->mem_ctx, NULL);
460                 if (ndr == NULL) {
461                         return WERR_INVALID_PARAM;
462                 }
463
464                 ndr_err = ndr_push_ENUM_SERVICE_STATUSW_array(
465                         ndr, num_services, services);
466                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
467                         return ntstatus_to_werror(ndr_map_error2ntstatus(ndr_err));
468                 }
469
470                 blob = ndr_push_blob(ndr);
471         }
472
473         r->out.service                  = blob.data;
474         *r->out.bytes_needed            = (buffer_size > r->in.buf_size) ? buffer_size : r->in.buf_size;
475         *r->out.services_returned       = (uint32)num_services;
476         *r->out.resume_handle           = 0x0;
477
478         return result;
479 }
480
481 /********************************************************************
482  _svcctl_StartServiceW
483 ********************************************************************/
484
485 WERROR _svcctl_StartServiceW(pipes_struct *p,
486                              struct svcctl_StartServiceW *r)
487 {
488         SERVICE_INFO *info = find_service_info_by_hnd( p, r->in.handle );
489
490         /* perform access checks */
491
492         if ( !info || (info->type != SVC_HANDLE_IS_SERVICE) )
493                 return WERR_BADFID;
494
495         if ( !(info->access_granted & SC_RIGHT_SVC_START) )
496                 return WERR_ACCESS_DENIED;
497
498         return info->ops->start_service( info->name );
499 }
500
501 /********************************************************************
502  _svcctl_ControlService
503 ********************************************************************/
504
505 WERROR _svcctl_ControlService(pipes_struct *p,
506                               struct svcctl_ControlService *r)
507 {
508         SERVICE_INFO *info = find_service_info_by_hnd( p, r->in.handle );
509
510         /* perform access checks */
511
512         if ( !info || (info->type != SVC_HANDLE_IS_SERVICE) )
513                 return WERR_BADFID;
514
515         switch ( r->in.control ) {
516         case SVCCTL_CONTROL_STOP:
517                 if ( !(info->access_granted & SC_RIGHT_SVC_STOP) )
518                         return WERR_ACCESS_DENIED;
519
520                 return info->ops->stop_service( info->name,
521                                                 r->out.service_status );
522
523         case SVCCTL_CONTROL_INTERROGATE:
524                 if ( !(info->access_granted & SC_RIGHT_SVC_QUERY_STATUS) )
525                         return WERR_ACCESS_DENIED;
526
527                 return info->ops->service_status( info->name,
528                                                   r->out.service_status );
529         default:
530                 return WERR_ACCESS_DENIED;
531         }
532 }
533
534 /********************************************************************
535  _svcctl_EnumDependentServicesW
536 ********************************************************************/
537
538 WERROR _svcctl_EnumDependentServicesW(pipes_struct *p,
539                                       struct svcctl_EnumDependentServicesW *r)
540 {
541         SERVICE_INFO *info = find_service_info_by_hnd( p, r->in.service );
542
543         /* perform access checks */
544
545         if ( !info || (info->type != SVC_HANDLE_IS_SERVICE) )
546                 return WERR_BADFID;
547
548         if ( !(info->access_granted & SC_RIGHT_SVC_ENUMERATE_DEPENDENTS) )
549                 return WERR_ACCESS_DENIED;
550
551         /* we have to set the outgoing buffer size to the same as the
552            incoming buffer size (even in the case of failure */
553         /* this is done in the autogenerated server already - gd */
554
555         *r->out.bytes_needed = r->in.buf_size;
556
557         /* no dependent services...basically a stub function */
558         *r->out.services_returned = 0;
559
560         return WERR_OK;
561 }
562
563 /********************************************************************
564  _svcctl_QueryServiceStatusEx
565 ********************************************************************/
566
567 WERROR _svcctl_QueryServiceStatusEx(pipes_struct *p,
568                                     struct svcctl_QueryServiceStatusEx *r)
569 {
570         SERVICE_INFO *info = find_service_info_by_hnd( p, r->in.handle );
571         uint32 buffer_size;
572
573         /* perform access checks */
574
575         if ( !info || (info->type != SVC_HANDLE_IS_SERVICE) )
576                 return WERR_BADFID;
577
578         if ( !(info->access_granted & SC_RIGHT_SVC_QUERY_STATUS) )
579                 return WERR_ACCESS_DENIED;
580
581         /* we have to set the outgoing buffer size to the same as the
582            incoming buffer size (even in the case of failure) */
583
584         *r->out.bytes_needed = r->in.buf_size;
585
586         switch ( r->in.info_level ) {
587                 case SVC_STATUS_PROCESS_INFO:
588                 {
589                         struct SERVICE_STATUS_PROCESS svc_stat_proc;
590                         enum ndr_err_code ndr_err;
591                         DATA_BLOB blob;
592
593                         /* Get the status of the service.. */
594                         info->ops->service_status( info->name, &svc_stat_proc.status );
595                         svc_stat_proc.process_id     = sys_getpid();
596                         svc_stat_proc.service_flags  = 0x0;
597
598                         ndr_err = ndr_push_struct_blob(&blob, p->mem_ctx, NULL,
599                                                        &svc_stat_proc,
600                                                        (ndr_push_flags_fn_t)ndr_push_SERVICE_STATUS_PROCESS);
601                         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
602                                 return WERR_INVALID_PARAM;
603                         }
604
605                         r->out.buffer = blob.data;
606                         buffer_size = sizeof(struct SERVICE_STATUS_PROCESS);
607                         break;
608                 }
609
610                 default:
611                         return WERR_UNKNOWN_LEVEL;
612         }
613
614
615         buffer_size += buffer_size % 4;
616         *r->out.bytes_needed = (buffer_size > r->in.buf_size) ? buffer_size : r->in.buf_size;
617
618         if (buffer_size > r->in.buf_size ) {
619                 return WERR_INSUFFICIENT_BUFFER;
620         }
621
622         return WERR_OK;
623 }
624
625 /********************************************************************
626 ********************************************************************/
627
628 static WERROR fill_svc_config( TALLOC_CTX *ctx, const char *name,
629                                struct QUERY_SERVICE_CONFIG *config,
630                                NT_USER_TOKEN *token )
631 {
632         REGVAL_CTR *values;
633         REGISTRY_VALUE *val;
634
635         /* retrieve the registry values for this service */
636
637         if ( !(values = svcctl_fetch_regvalues( name, token )) )
638                 return WERR_REG_CORRUPT;
639
640         /* now fill in the individual values */
641
642         if ( (val = regval_ctr_getvalue( values, "DisplayName" )) != NULL )
643                 config->displayname = regval_sz(val);
644         else
645                 config->displayname = name;
646
647         if ( (val = regval_ctr_getvalue( values, "ObjectName" )) != NULL ) {
648                 config->startname = regval_sz(val);
649         }
650
651         if ( (val = regval_ctr_getvalue( values, "ImagePath" )) != NULL ) {
652                 config->executablepath = regval_sz(val);
653         }
654
655         /* a few hard coded values */
656         /* loadordergroup and dependencies are empty */
657
658         config->tag_id           = 0x00000000;                  /* unassigned loadorder group */
659         config->service_type     = SERVICE_TYPE_WIN32_OWN_PROCESS;
660         config->error_control    = SVCCTL_SVC_ERROR_NORMAL;
661
662         /* set the start type.  NetLogon and WINS are disabled to prevent
663            the client from showing the "Start" button (if of course the services
664            are not running */
665
666         if ( strequal( name, "NETLOGON" ) && ( lp_servicenumber(name) == -1 ) )
667                 config->start_type = SVCCTL_DISABLED;
668         else if ( strequal( name, "WINS" ) && ( !lp_wins_support() ))
669                 config->start_type = SVCCTL_DISABLED;
670         else
671                 config->start_type = SVCCTL_DEMAND_START;
672
673
674         TALLOC_FREE( values );
675
676         return WERR_OK;
677 }
678
679 /********************************************************************
680  _svcctl_QueryServiceConfigW
681 ********************************************************************/
682
683 WERROR _svcctl_QueryServiceConfigW(pipes_struct *p,
684                                    struct svcctl_QueryServiceConfigW *r)
685 {
686         SERVICE_INFO *info = find_service_info_by_hnd( p, r->in.handle );
687         uint32 buffer_size;
688         WERROR wresult;
689
690         /* perform access checks */
691
692         if ( !info || (info->type != SVC_HANDLE_IS_SERVICE) )
693                 return WERR_BADFID;
694
695         if ( !(info->access_granted & SC_RIGHT_SVC_QUERY_CONFIG) )
696                 return WERR_ACCESS_DENIED;
697
698         /* we have to set the outgoing buffer size to the same as the
699            incoming buffer size (even in the case of failure */
700
701         *r->out.bytes_needed = r->in.buf_size;
702
703         wresult = fill_svc_config( p->mem_ctx, info->name, r->out.query,
704                                    p->server_info->ptok);
705         if ( !W_ERROR_IS_OK(wresult) )
706                 return wresult;
707
708         buffer_size = ndr_size_QUERY_SERVICE_CONFIG(r->out.query, NULL, 0);
709         *r->out.bytes_needed = (buffer_size > r->in.buf_size) ? buffer_size : r->in.buf_size;
710
711         if (buffer_size > r->in.buf_size ) {
712                 ZERO_STRUCTP(r->out.query);
713                 return WERR_INSUFFICIENT_BUFFER;
714         }
715
716         return WERR_OK;
717 }
718
719 /********************************************************************
720  _svcctl_QueryServiceConfig2W
721 ********************************************************************/
722
723 WERROR _svcctl_QueryServiceConfig2W(pipes_struct *p,
724                                     struct svcctl_QueryServiceConfig2W *r)
725 {
726         SERVICE_INFO *info = find_service_info_by_hnd( p, r->in.handle );
727         uint32 buffer_size;
728
729         /* perform access checks */
730
731         if ( !info || (info->type != SVC_HANDLE_IS_SERVICE) )
732                 return WERR_BADFID;
733
734         if ( !(info->access_granted & SC_RIGHT_SVC_QUERY_CONFIG) )
735                 return WERR_ACCESS_DENIED;
736
737         /* we have to set the outgoing buffer size to the same as the
738            incoming buffer size (even in the case of failure */
739
740         *r->out.bytes_needed = r->in.buf_size;
741
742         switch ( r->in.info_level ) {
743         case SERVICE_CONFIG_DESCRIPTION:
744                 {
745                         struct SERVICE_DESCRIPTION desc_buf;
746                         const char *description;
747                         enum ndr_err_code ndr_err;
748                         DATA_BLOB blob;
749
750                         description = svcctl_lookup_description(
751                                 p->mem_ctx, info->name, p->server_info->ptok);
752
753                         desc_buf.description = description;
754
755                         ndr_err = ndr_push_struct_blob(&blob, p->mem_ctx, NULL,
756                                                        &desc_buf,
757                                                        (ndr_push_flags_fn_t)ndr_push_SERVICE_DESCRIPTION);
758                         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
759                                 return WERR_INVALID_PARAM;
760                         }
761
762                         buffer_size = ndr_size_SERVICE_DESCRIPTION(&desc_buf, NULL, 0);
763                         r->out.buffer = blob.data;
764
765                         break;
766                 }
767                 break;
768         case SERVICE_CONFIG_FAILURE_ACTIONS:
769                 {
770                         struct SERVICE_FAILURE_ACTIONS actions;
771                         enum ndr_err_code ndr_err;
772                         DATA_BLOB blob;
773
774                         /* nothing to say...just service the request */
775
776                         ZERO_STRUCT( actions );
777
778                         ndr_err = ndr_push_struct_blob(&blob, p->mem_ctx, NULL,
779                                                        &actions,
780                                                        (ndr_push_flags_fn_t)ndr_push_SERVICE_FAILURE_ACTIONS);
781                         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
782                                 return WERR_INVALID_PARAM;
783                         }
784
785                         buffer_size = ndr_size_SERVICE_FAILURE_ACTIONS(&actions, NULL, 0);
786                         r->out.buffer = blob.data;
787
788                         break;
789                 }
790                 break;
791
792         default:
793                 return WERR_UNKNOWN_LEVEL;
794         }
795
796         buffer_size += buffer_size % 4;
797         *r->out.bytes_needed = (buffer_size > r->in.buf_size) ? buffer_size : r->in.buf_size;
798
799         if (buffer_size > r->in.buf_size )
800                 return WERR_INSUFFICIENT_BUFFER;
801
802         return WERR_OK;
803 }
804
805 /********************************************************************
806  _svcctl_LockServiceDatabase
807 ********************************************************************/
808
809 WERROR _svcctl_LockServiceDatabase(pipes_struct *p,
810                                    struct svcctl_LockServiceDatabase *r)
811 {
812         SERVICE_INFO *info = find_service_info_by_hnd( p, r->in.handle );
813
814         /* perform access checks */
815
816         if ( !info || (info->type != SVC_HANDLE_IS_SCM) )
817                 return WERR_BADFID;
818
819         if ( !(info->access_granted & SC_RIGHT_MGR_LOCK) )
820                 return WERR_ACCESS_DENIED;
821
822         /* Just open a handle.  Doesn't actually lock anything */
823
824         return create_open_service_handle( p, r->out.lock, SVC_HANDLE_IS_DBLOCK, NULL, 0 );
825 }
826
827 /********************************************************************
828  _svcctl_UnlockServiceDatabase
829 ********************************************************************/
830
831 WERROR _svcctl_UnlockServiceDatabase(pipes_struct *p,
832                                      struct svcctl_UnlockServiceDatabase *r)
833 {
834         SERVICE_INFO *info = find_service_info_by_hnd( p, r->in.lock );
835
836
837         if ( !info || (info->type != SVC_HANDLE_IS_DBLOCK) )
838                 return WERR_BADFID;
839
840         return close_policy_hnd( p, r->out.lock) ? WERR_OK : WERR_BADFID;
841 }
842
843 /********************************************************************
844  _svcctl_QueryServiceObjectSecurity
845 ********************************************************************/
846
847 WERROR _svcctl_QueryServiceObjectSecurity(pipes_struct *p,
848                                           struct svcctl_QueryServiceObjectSecurity *r)
849 {
850         SERVICE_INFO *info = find_service_info_by_hnd( p, r->in.handle );
851         SEC_DESC *sec_desc;
852         NTSTATUS status;
853         uint8_t *buffer = NULL;
854         size_t len = 0;
855
856
857         /* only support the SCM and individual services */
858
859         if ( !info || !(info->type & (SVC_HANDLE_IS_SERVICE|SVC_HANDLE_IS_SCM)) )
860                 return WERR_BADFID;
861
862         /* check access reights (according to MSDN) */
863
864         if ( !(info->access_granted & STD_RIGHT_READ_CONTROL_ACCESS) )
865                 return WERR_ACCESS_DENIED;
866
867         /* TODO: handle something besides DACL_SECURITY_INFORMATION */
868
869         if ( (r->in.security_flags & DACL_SECURITY_INFORMATION) != DACL_SECURITY_INFORMATION )
870                 return WERR_INVALID_PARAM;
871
872         /* lookup the security descriptor and marshall it up for a reply */
873
874         if ( !(sec_desc = svcctl_get_secdesc( p->mem_ctx, info->name, get_root_nt_token() )) )
875                 return WERR_NOMEM;
876
877         *r->out.needed = ndr_size_security_descriptor( sec_desc, NULL, 0 );
878
879         if ( *r->out.needed > r->in.buffer_size ) {
880                 ZERO_STRUCTP( &r->out.buffer );
881                 return WERR_INSUFFICIENT_BUFFER;
882         }
883
884         status = marshall_sec_desc(p->mem_ctx, sec_desc, &buffer, &len);
885         if (!NT_STATUS_IS_OK(status)) {
886                 return ntstatus_to_werror(status);
887         }
888
889         *r->out.needed = len;
890         r->out.buffer = buffer;
891
892         return WERR_OK;
893 }
894
895 /********************************************************************
896  _svcctl_SetServiceObjectSecurity
897 ********************************************************************/
898
899 WERROR _svcctl_SetServiceObjectSecurity(pipes_struct *p,
900                                         struct svcctl_SetServiceObjectSecurity *r)
901 {
902         SERVICE_INFO *info = find_service_info_by_hnd( p, r->in.handle );
903         SEC_DESC *sec_desc = NULL;
904         uint32 required_access;
905         NTSTATUS status;
906
907         if ( !info || !(info->type & (SVC_HANDLE_IS_SERVICE|SVC_HANDLE_IS_SCM))  )
908                 return WERR_BADFID;
909
910         /* can't set the security de4scriptor on the ServiceControlManager */
911
912         if ( info->type == SVC_HANDLE_IS_SCM )
913                 return WERR_ACCESS_DENIED;
914
915         /* check the access on the open handle */
916
917         switch ( r->in.security_flags ) {
918                 case DACL_SECURITY_INFORMATION:
919                         required_access = STD_RIGHT_WRITE_DAC_ACCESS;
920                         break;
921
922                 case OWNER_SECURITY_INFORMATION:
923                 case GROUP_SECURITY_INFORMATION:
924                         required_access = STD_RIGHT_WRITE_OWNER_ACCESS;
925                         break;
926
927                 case SACL_SECURITY_INFORMATION:
928                         return WERR_INVALID_PARAM;
929                 default:
930                         return WERR_INVALID_PARAM;
931         }
932
933         if ( !(info->access_granted & required_access) )
934                 return WERR_ACCESS_DENIED;
935
936         /* read the security descfriptor */
937
938         status = unmarshall_sec_desc(p->mem_ctx,
939                                      r->in.buffer, r->in.buffer_size,
940                                      &sec_desc);
941         if (!NT_STATUS_IS_OK(status)) {
942                 return ntstatus_to_werror(status);
943         }
944
945         /* store the new SD */
946
947         if ( !svcctl_set_secdesc( p->mem_ctx, info->name, sec_desc,
948                                   p->server_info->ptok) )
949                 return WERR_ACCESS_DENIED;
950
951         return WERR_OK;
952 }
953
954
955 WERROR _svcctl_DeleteService(pipes_struct *p, struct svcctl_DeleteService *r)
956 {
957         p->rng_fault_state = True;
958         return WERR_NOT_SUPPORTED;
959 }
960
961 WERROR _svcctl_SetServiceStatus(pipes_struct *p, struct svcctl_SetServiceStatus *r)
962 {
963         p->rng_fault_state = True;
964         return WERR_NOT_SUPPORTED;
965 }
966
967 WERROR _svcctl_NotifyBootConfigStatus(pipes_struct *p, struct svcctl_NotifyBootConfigStatus *r)
968 {
969         p->rng_fault_state = True;
970         return WERR_NOT_SUPPORTED;
971 }
972
973 WERROR _svcctl_SCSetServiceBitsW(pipes_struct *p, struct svcctl_SCSetServiceBitsW *r)
974 {
975         p->rng_fault_state = True;
976         return WERR_NOT_SUPPORTED;
977 }
978
979 WERROR _svcctl_ChangeServiceConfigW(pipes_struct *p, struct svcctl_ChangeServiceConfigW *r)
980 {
981         p->rng_fault_state = True;
982         return WERR_NOT_SUPPORTED;
983 }
984
985 WERROR _svcctl_CreateServiceW(pipes_struct *p, struct svcctl_CreateServiceW *r)
986 {
987         p->rng_fault_state = True;
988         return WERR_NOT_SUPPORTED;
989 }
990
991 WERROR _svcctl_QueryServiceLockStatusW(pipes_struct *p, struct svcctl_QueryServiceLockStatusW *r)
992 {
993         p->rng_fault_state = True;
994         return WERR_NOT_SUPPORTED;
995 }
996
997 WERROR _svcctl_GetServiceKeyNameW(pipes_struct *p, struct svcctl_GetServiceKeyNameW *r)
998 {
999         p->rng_fault_state = True;
1000         return WERR_NOT_SUPPORTED;
1001 }
1002
1003 WERROR _svcctl_SCSetServiceBitsA(pipes_struct *p, struct svcctl_SCSetServiceBitsA *r)
1004 {
1005         p->rng_fault_state = True;
1006         return WERR_NOT_SUPPORTED;
1007 }
1008
1009 WERROR _svcctl_ChangeServiceConfigA(pipes_struct *p, struct svcctl_ChangeServiceConfigA *r)
1010 {
1011         p->rng_fault_state = True;
1012         return WERR_NOT_SUPPORTED;
1013 }
1014
1015 WERROR _svcctl_CreateServiceA(pipes_struct *p, struct svcctl_CreateServiceA *r)
1016 {
1017         p->rng_fault_state = True;
1018         return WERR_NOT_SUPPORTED;
1019 }
1020
1021 WERROR _svcctl_EnumDependentServicesA(pipes_struct *p, struct svcctl_EnumDependentServicesA *r)
1022 {
1023         p->rng_fault_state = True;
1024         return WERR_NOT_SUPPORTED;
1025 }
1026
1027 WERROR _svcctl_EnumServicesStatusA(pipes_struct *p, struct svcctl_EnumServicesStatusA *r)
1028 {
1029         p->rng_fault_state = True;
1030         return WERR_NOT_SUPPORTED;
1031 }
1032
1033 WERROR _svcctl_OpenSCManagerA(pipes_struct *p, struct svcctl_OpenSCManagerA *r)
1034 {
1035         p->rng_fault_state = True;
1036         return WERR_NOT_SUPPORTED;
1037 }
1038
1039 WERROR _svcctl_OpenServiceA(pipes_struct *p, struct svcctl_OpenServiceA *r)
1040 {
1041         p->rng_fault_state = True;
1042         return WERR_NOT_SUPPORTED;
1043 }
1044
1045 WERROR _svcctl_QueryServiceConfigA(pipes_struct *p, struct svcctl_QueryServiceConfigA *r)
1046 {
1047         p->rng_fault_state = True;
1048         return WERR_NOT_SUPPORTED;
1049 }
1050
1051 WERROR _svcctl_QueryServiceLockStatusA(pipes_struct *p, struct svcctl_QueryServiceLockStatusA *r)
1052 {
1053         p->rng_fault_state = True;
1054         return WERR_NOT_SUPPORTED;
1055 }
1056
1057 WERROR _svcctl_StartServiceA(pipes_struct *p, struct svcctl_StartServiceA *r)
1058 {
1059         p->rng_fault_state = True;
1060         return WERR_NOT_SUPPORTED;
1061 }
1062
1063 WERROR _svcctl_GetServiceDisplayNameA(pipes_struct *p, struct svcctl_GetServiceDisplayNameA *r)
1064 {
1065         p->rng_fault_state = True;
1066         return WERR_NOT_SUPPORTED;
1067 }
1068
1069 WERROR _svcctl_GetServiceKeyNameA(pipes_struct *p, struct svcctl_GetServiceKeyNameA *r)
1070 {
1071         p->rng_fault_state = True;
1072         return WERR_NOT_SUPPORTED;
1073 }
1074
1075 WERROR _svcctl_GetCurrentGroupeStateW(pipes_struct *p, struct svcctl_GetCurrentGroupeStateW *r)
1076 {
1077         p->rng_fault_state = True;
1078         return WERR_NOT_SUPPORTED;
1079 }
1080
1081 WERROR _svcctl_EnumServiceGroupW(pipes_struct *p, struct svcctl_EnumServiceGroupW *r)
1082 {
1083         p->rng_fault_state = True;
1084         return WERR_NOT_SUPPORTED;
1085 }
1086
1087 WERROR _svcctl_ChangeServiceConfig2A(pipes_struct *p, struct svcctl_ChangeServiceConfig2A *r)
1088 {
1089         p->rng_fault_state = True;
1090         return WERR_NOT_SUPPORTED;
1091 }
1092
1093 WERROR _svcctl_ChangeServiceConfig2W(pipes_struct *p, struct svcctl_ChangeServiceConfig2W *r)
1094 {
1095         p->rng_fault_state = True;
1096         return WERR_NOT_SUPPORTED;
1097 }
1098
1099 WERROR _svcctl_QueryServiceConfig2A(pipes_struct *p, struct svcctl_QueryServiceConfig2A *r)
1100 {
1101         p->rng_fault_state = True;
1102         return WERR_NOT_SUPPORTED;
1103 }
1104
1105 WERROR _EnumServicesStatusExA(pipes_struct *p, struct EnumServicesStatusExA *r)
1106 {
1107         p->rng_fault_state = True;
1108         return WERR_NOT_SUPPORTED;
1109 }
1110
1111 WERROR _EnumServicesStatusExW(pipes_struct *p, struct EnumServicesStatusExW *r)
1112 {
1113         p->rng_fault_state = True;
1114         return WERR_NOT_SUPPORTED;
1115 }
1116
1117 WERROR _svcctl_SCSendTSMessage(pipes_struct *p, struct svcctl_SCSendTSMessage *r)
1118 {
1119         p->rng_fault_state = True;
1120         return WERR_NOT_SUPPORTED;
1121 }
1122