s3-util_sid Tidy up global struct security_token

[abartlet/samba.git/.git] / source3 / lib / util_seaccess.c

diff --git a/source3/lib/util_seaccess.c b/source3/lib/util_seaccess.c
index 0da7442d1953748c3e594999748c5c2ce4aea198..6c16fea5857b1da37717c52df4f195974f7ba12a 100644 (file)
--- a/source3/lib/util_seaccess.c
+++ b/source3/lib/util_seaccess.c
@@ -22,8 +22,6 @@
 
 #include "includes.h"
 
-extern NT_USER_TOKEN anonymous_token;
-
 /* Map generic access rights to object specific rights.  This technique is
    used to give meaning to assigning read, write, execute and all access to
    objects.  Each type of object has its own mapping of generic to object
@@ -82,7 +80,7 @@ void security_acl_map_generic(struct security_acl *sa,
    objects.  Each type of object has its own mapping of standard to object
    specific access rights. */
 
-void se_map_standard(uint32 *access_mask, struct standard_mapping *mapping)
+void se_map_standard(uint32 *access_mask, const struct standard_mapping *mapping)
 {
        uint32 old_mask = *access_mask;
 
@@ -106,14 +104,14 @@ void se_map_standard(uint32 *access_mask, struct standard_mapping *mapping)
   perform a SEC_FLAG_MAXIMUM_ALLOWED access check
 */
 static uint32_t access_check_max_allowed(const struct security_descriptor *sd, 
-                                       const NT_USER_TOKEN *token)
+                                       const struct security_token *token)
 {
        uint32_t denied = 0, granted = 0;
        unsigned i;
 
        if (is_sid_in_token(token, sd->owner_sid)) {
                granted |= SEC_STD_WRITE_DAC | SEC_STD_READ_CONTROL | SEC_STD_DELETE;
-       } else if (user_has_privileges(token, &se_restore)) {
+       } else if (security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
                granted |= SEC_STD_DELETE;
        }
 
@@ -154,7 +152,7 @@ static uint32_t access_check_max_allowed(const struct security_descriptor *sd,
   to by the access_granted pointer.
 */
 NTSTATUS se_access_check(const struct security_descriptor *sd, 
-                         const NT_USER_TOKEN *token,
+                         const struct security_token *token,
                          uint32_t access_desired,
                          uint32_t *access_granted)
 {
@@ -203,7 +201,7 @@ NTSTATUS se_access_check(const struct security_descriptor *sd,
                bits_remaining &= ~(SEC_STD_WRITE_DAC|SEC_STD_READ_CONTROL|SEC_STD_DELETE);
        }
        if ((bits_remaining & SEC_STD_DELETE) &&
-           user_has_privileges(token, &se_restore)) {
+           (security_token_has_privilege(token, SEC_PRIV_RESTORE))) {
                bits_remaining &= ~SEC_STD_DELETE;
        }
 
@@ -246,43 +244,3 @@ done:
 
        return NT_STATUS_OK;
 }
-
-/*******************************************************************
- samr_make_sam_obj_sd
- ********************************************************************/
-
-NTSTATUS samr_make_sam_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size)
-{
-       DOM_SID adm_sid;
-       DOM_SID act_sid;
-
-       SEC_ACE ace[3];
-
-       SEC_ACL *psa = NULL;
-
-       sid_copy(&adm_sid, &global_sid_Builtin);
-       sid_append_rid(&adm_sid, BUILTIN_ALIAS_RID_ADMINS);
-
-       sid_copy(&act_sid, &global_sid_Builtin);
-       sid_append_rid(&act_sid, BUILTIN_ALIAS_RID_ACCOUNT_OPS);
-
-       /*basic access for every one*/
-       init_sec_ace(&ace[0], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED,
-               GENERIC_RIGHTS_SAM_EXECUTE | GENERIC_RIGHTS_SAM_READ, 0);
-
-       /*full access for builtin aliases Administrators and Account Operators*/
-       init_sec_ace(&ace[1], &adm_sid,
-               SEC_ACE_TYPE_ACCESS_ALLOWED, GENERIC_RIGHTS_SAM_ALL_ACCESS, 0);
-       init_sec_ace(&ace[2], &act_sid,
-               SEC_ACE_TYPE_ACCESS_ALLOWED, GENERIC_RIGHTS_SAM_ALL_ACCESS, 0);
-
-       if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) == NULL)
-               return NT_STATUS_NO_MEMORY;
-
-       if ((*psd = make_sec_desc(ctx, SECURITY_DESCRIPTOR_REVISION_1,
-                                 SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL,
-                                 psa, sd_size)) == NULL)
-               return NT_STATUS_NO_MEMORY;
-
-       return NT_STATUS_OK;
-}