Fix self granting privileges in security=ads.

[samba.git] / source3 / rpc_server / srv_lsa_nt.c

diff --git a/source3/rpc_server/srv_lsa_nt.c b/source3/rpc_server/srv_lsa_nt.c
index 986b12685a5ea6163a9001beb40d3592bc8f753b..b9ea2d2e94d596980aba3f55a87536ab6e60bfd1 100644 (file)
--- a/source3/rpc_server/srv_lsa_nt.c
+++ b/source3/rpc_server/srv_lsa_nt.c
@@ -29,6 +29,7 @@
 /* This is the implementation of the lsa server code. */
 
 #include "includes.h"
+#include "../librpc/gen_ndr/srv_lsa.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_RPC_SRV
@@ -41,8 +42,10 @@ enum lsa_handle_type { LSA_HANDLE_POLICY_TYPE = 1, LSA_HANDLE_ACCOUNT_TYPE };
 
 struct lsa_info {
        DOM_SID sid;
+       const char *name;
        uint32 access;
        enum lsa_handle_type type;
+       struct security_descriptor *sd;
 };
 
 const struct generic_mapping lsa_account_mapping = {
@@ -59,6 +62,20 @@ const struct generic_mapping lsa_policy_mapping = {
        LSA_POLICY_ALL_ACCESS
 };
 
+const struct generic_mapping lsa_secret_mapping = {
+       LSA_SECRET_READ,
+       LSA_SECRET_WRITE,
+       LSA_SECRET_EXECUTE,
+       LSA_SECRET_ALL_ACCESS
+};
+
+const struct generic_mapping lsa_trusted_domain_mapping = {
+       LSA_TRUSTED_DOMAIN_READ,
+       LSA_TRUSTED_DOMAIN_WRITE,
+       LSA_TRUSTED_DOMAIN_EXECUTE,
+       LSA_TRUSTED_DOMAIN_ALL_ACCESS
+};
+
 /***************************************************************************
  init_lsa_ref_domain_list - adds a domain if it's not already in, returns the index.
 ***************************************************************************/
@@ -561,6 +578,38 @@ NTSTATUS _lsa_QueryInfoPolicy(pipes_struct *p,
        }
 
        switch (r->in.level) {
+       /* according to MS-LSAD 3.1.4.4.3 */
+       case LSA_POLICY_INFO_MOD:
+       case LSA_POLICY_INFO_AUDIT_FULL_SET:
+       case LSA_POLICY_INFO_AUDIT_FULL_QUERY:
+               return NT_STATUS_INVALID_PARAMETER;
+       case LSA_POLICY_INFO_AUDIT_LOG:
+               info->audit_log.percent_full            = 0;
+               info->audit_log.maximum_log_size        = 0;
+               info->audit_log.retention_time          = 0;
+               info->audit_log.shutdown_in_progress    = 0;
+               info->audit_log.time_to_shutdown        = 0;
+               info->audit_log.next_audit_record       = 0;
+               status = NT_STATUS_OK;
+               break;
+       case LSA_POLICY_INFO_PD:
+               info->pd.name.string                    = NULL;
+               status = NT_STATUS_OK;
+               break;
+       case LSA_POLICY_INFO_REPLICA:
+               info->replica.source.string             = NULL;
+               info->replica.account.string            = NULL;
+               status = NT_STATUS_OK;
+               break;
+       case LSA_POLICY_INFO_QUOTA:
+               info->quota.paged_pool                  = 0;
+               info->quota.non_paged_pool              = 0;
+               info->quota.min_wss                     = 0;
+               info->quota.max_wss                     = 0;
+               info->quota.pagefile                    = 0;
+               info->quota.unknown                     = 0;
+               status = NT_STATUS_OK;
+               break;
        case LSA_POLICY_INFO_AUDIT_EVENTS:
                {
 
@@ -1642,6 +1691,10 @@ NTSTATUS _lsa_CreateAccount(pipes_struct *p,
        struct lsa_info *handle;
        struct lsa_info *info;
        uint32_t acc_granted;
+       uint32_t owner_access = (LSA_ACCOUNT_ALL_ACCESS &
+                       ~(LSA_ACCOUNT_ADJUST_PRIVILEGES|
+                       LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|
+                       STD_RIGHT_DELETE_ACCESS));
        struct security_descriptor *psd;
        size_t sd_size;
 
@@ -1669,7 +1722,7 @@ NTSTATUS _lsa_CreateAccount(pipes_struct *p,
 
        status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
                                    &lsa_account_mapping,
-                                   r->in.sid, LSA_POLICY_ALL_ACCESS);
+                                   r->in.sid, owner_access);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
@@ -1715,6 +1768,10 @@ NTSTATUS _lsa_OpenAccount(pipes_struct *p,
        size_t sd_size;
        uint32_t des_access = r->in.access_mask;
        uint32_t acc_granted;
+       uint32_t owner_access = (LSA_ACCOUNT_ALL_ACCESS &
+                       ~(LSA_ACCOUNT_ADJUST_PRIVILEGES|
+                       LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|
+                       STD_RIGHT_DELETE_ACCESS));
        NTSTATUS status;
 
        /* find the connection policy handle. */
@@ -1739,7 +1796,7 @@ NTSTATUS _lsa_OpenAccount(pipes_struct *p,
        /* get the generic lsa account SD until we store it */
        status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
                                &lsa_account_mapping,
-                               r->in.sid, LSA_ACCOUNT_ALL_ACCESS);
+                               r->in.sid, owner_access);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
@@ -2075,15 +2132,19 @@ NTSTATUS _lsa_QuerySecurity(pipes_struct *p,
        if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
                return NT_STATUS_INVALID_HANDLE;
 
-       if (handle->type == LSA_HANDLE_POLICY_TYPE) {
+       switch (handle->type) {
+       case LSA_HANDLE_POLICY_TYPE:
                status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
                                &lsa_policy_mapping, NULL, 0);
-       } else if (handle->type == LSA_HANDLE_ACCOUNT_TYPE) {
+               break;
+       case LSA_HANDLE_ACCOUNT_TYPE:
                status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
                                &lsa_account_mapping,
                                &handle->sid, LSA_ACCOUNT_ALL_ACCESS);
-       } else {
+               break;
+       default:
                status = NT_STATUS_INVALID_HANDLE;
+               break;
        }
 
        if (!NT_STATUS_IS_OK(status)) {
@@ -2121,10 +2182,10 @@ NTSTATUS _lsa_AddAccountRights(pipes_struct *p,
                return NT_STATUS_INVALID_HANDLE;
        }
 
-        /* get the generic lsa account SD for this SID until we store it */
+        /* get the generic lsa account SD until we store it */
         status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
                                 &lsa_account_mapping,
-                                r->in.sid, LSA_ACCOUNT_ALL_ACCESS);
+                                NULL, 0);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
         }
@@ -2192,10 +2253,10 @@ NTSTATUS _lsa_RemoveAccountRights(pipes_struct *p,
                return NT_STATUS_INVALID_HANDLE;
        }
 
-        /* get the generic lsa account SD for this SID until we store it */
+        /* get the generic lsa account SD until we store it */
         status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
                                 &lsa_account_mapping,
-                                r->in.sid, LSA_ACCOUNT_ALL_ACCESS);
+                                NULL, 0);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
         }
@@ -2210,7 +2271,7 @@ NTSTATUS _lsa_RemoveAccountRights(pipes_struct *p,
                                     NULL, 0,
                                     LSA_ACCOUNT_ADJUST_PRIVILEGES|LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|
                                     LSA_ACCOUNT_VIEW|STD_RIGHT_DELETE_ACCESS,
-                                    &acc_granted, "_lsa_AddAccountRights" );
+                                    &acc_granted, "_lsa_RemoveAccountRights");
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
         }