_lsa_QueryInfoPolicy: Use symbolic info level names

[metze/samba/wip.git] / source3 / rpc_server / srv_lsa_nt.c

diff --git a/source3/rpc_server/srv_lsa_nt.c b/source3/rpc_server/srv_lsa_nt.c
index f434cfa9a4d0084f4a2e966e33d0b20fd5b57f45..02ddbf76f3f86568232de10595f18d34570937dc 100644 (file)
--- a/source3/rpc_server/srv_lsa_nt.c
+++ b/source3/rpc_server/srv_lsa_nt.c
@@ -517,7 +517,7 @@ NTSTATUS _lsa_QueryInfoPolicy(pipes_struct *p,
        }
 
        switch (r->in.level) {
-       case 0x02:
+       case LSA_POLICY_INFO_AUDIT_EVENTS:
                {
 
                uint32 policy_def = LSA_AUDIT_POLICY_ALL;
@@ -549,7 +549,7 @@ NTSTATUS _lsa_QueryInfoPolicy(pipes_struct *p,
 
                break;
                }
-       case 0x03:
+       case LSA_POLICY_INFO_DOMAIN:
                /* check if the user has enough rights */
                if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
                        return NT_STATUS_ACCESS_DENIED;
@@ -585,7 +585,7 @@ NTSTATUS _lsa_QueryInfoPolicy(pipes_struct *p,
                }
                init_dom_query_3(&info->domain, name, sid);
                break;
-       case 0x05:
+       case LSA_POLICY_INFO_ACCOUNT_DOMAIN:
                /* check if the user has enough rights */
                if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
                        return NT_STATUS_ACCESS_DENIED;
@@ -596,7 +596,7 @@ NTSTATUS _lsa_QueryInfoPolicy(pipes_struct *p,
 
                init_dom_query_5(&info->account_domain, name, sid);
                break;
-       case 0x06:
+       case LSA_POLICY_INFO_ROLE:
                /* check if the user has enough rights */
                if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
                        return NT_STATUS_ACCESS_DENIED;
@@ -1672,23 +1672,22 @@ NTSTATUS _lsa_EnumPrivsAccount(pipes_struct *p,
        if (!(info->access & LSA_ACCOUNT_VIEW))
                return NT_STATUS_ACCESS_DENIED;
 
-       if ( !get_privileges_for_sids( &mask, &info->sid, 1 ) )
-               return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+       get_privileges_for_sids(&mask, &info->sid, 1);
 
        privilege_set_init( &privileges );
 
+       priv_set = TALLOC_ZERO_P(p->mem_ctx, struct lsa_PrivilegeSet);
+       if (!priv_set) {
+               status = NT_STATUS_NO_MEMORY;
+               goto done;
+       }
+
        if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
 
                DEBUG(10,("_lsa_EnumPrivsAccount: %s has %d privileges\n",
                          sid_string_dbg(&info->sid),
                          privileges.count));
 
-               priv_set = TALLOC_ZERO_P(p->mem_ctx, struct lsa_PrivilegeSet);
-               if (!priv_set) {
-                       status = NT_STATUS_NO_MEMORY;
-                       goto done;
-               }
-
                luid_attrs = TALLOC_ZERO_ARRAY(p->mem_ctx,
                                               struct lsa_LUIDAttribute,
                                               privileges.count);
@@ -1707,11 +1706,14 @@ NTSTATUS _lsa_EnumPrivsAccount(pipes_struct *p,
                priv_set->unknown = 0;
                priv_set->set = luid_attrs;
 
-               *r->out.privs = priv_set;
        } else {
-               status = NT_STATUS_NO_SUCH_PRIVILEGE;
+               priv_set->count = 0;
+               priv_set->unknown = 0;
+               priv_set->set = NULL;
        }
 
+       *r->out.privs = priv_set;
+
  done:
        privilege_set_free( &privileges );
 
@@ -2150,20 +2152,25 @@ NTSTATUS _lsa_EnumAccountRights(pipes_struct *p,
 
        sid_copy( &sid, r->in.sid );
 
-       if ( !get_privileges_for_sids( &mask, &sid, 1 ) )
+       /* according to MS-LSAD 3.1.4.5.10 it is required to return
+        * NT_STATUS_OBJECT_NAME_NOT_FOUND if the account sid was not found in
+        * the lsa database */
+
+       if (!get_privileges_for_sids(&mask, &sid, 1)) {
                return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+       }
 
-       privilege_set_init( &privileges );
+       status = privilege_set_init(&privileges);
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
 
-       if ( se_priv_to_privilege_set( &privileges, &mask ) ) {
+       se_priv_to_privilege_set(&privileges, &mask);
 
-               DEBUG(10,("_lsa_EnumAccountRights: %s has %d privileges\n",
-                         sid_string_dbg(&sid), privileges.count));
+       DEBUG(10,("_lsa_EnumAccountRights: %s has %d privileges\n",
+                 sid_string_dbg(&sid), privileges.count));
 
-               status = init_lsa_right_set(p->mem_ctx, r->out.rights, &privileges);
-       } else {
-               status = NT_STATUS_NO_SUCH_PRIVILEGE;
-       }
+       status = init_lsa_right_set(p->mem_ctx, r->out.rights, &privileges);
 
        privilege_set_free( &privileges );