s3-samr: remove duplicate copies of Domain Object specific access rights.

Guenther

diff --git a/source3/include/rpc_secdes.h b/source3/include/rpc_secdes.h
index 6b30c6d40a8b9a50fc2f70dc32687bb3ac344ece..776c9a676944cf47938ba7a483ecf119510d132a 100644 (file)
--- a/source3/include/rpc_secdes.h
+++ b/source3/include/rpc_secdes.h
@@ -214,46 +214,6 @@ struct standard_mapping {
                SA_RIGHT_FILE_WRITE_DATA        | \
                SA_RIGHT_FILE_READ_DATA)
 
-/* Domain Object specific access rights */
-
-#define SA_RIGHT_DOMAIN_LOOKUP_INFO_1          0x00000001
-#define SA_RIGHT_DOMAIN_SET_INFO_1             0x00000002
-#define SA_RIGHT_DOMAIN_LOOKUP_INFO_2          0x00000004
-#define SA_RIGHT_DOMAIN_SET_INFO_2             0x00000008
-#define SA_RIGHT_DOMAIN_CREATE_USER            0x00000010
-#define SA_RIGHT_DOMAIN_CREATE_GROUP           0x00000020
-#define SA_RIGHT_DOMAIN_CREATE_ALIAS           0x00000040
-#define SA_RIGHT_DOMAIN_LOOKUP_ALIAS_BY_MEM    0x00000080
-#define SA_RIGHT_DOMAIN_ENUM_ACCOUNTS          0x00000100
-#define SA_RIGHT_DOMAIN_OPEN_ACCOUNT           0x00000200
-#define SA_RIGHT_DOMAIN_SET_INFO_3             0x00000400
-
-#define SA_RIGHT_DOMAIN_ALL_ACCESS             0x000007FF
-
-#define GENERIC_RIGHTS_DOMAIN_ALL_ACCESS \
-               (STANDARD_RIGHTS_REQUIRED_ACCESS| \
-               SA_RIGHT_DOMAIN_ALL_ACCESS)
-
-#define GENERIC_RIGHTS_DOMAIN_READ \
-               (STANDARD_RIGHTS_READ_ACCESS            | \
-               SA_RIGHT_DOMAIN_LOOKUP_ALIAS_BY_MEM     | \
-               SA_RIGHT_DOMAIN_LOOKUP_INFO_2)
-
-#define GENERIC_RIGHTS_DOMAIN_WRITE \
-               (STANDARD_RIGHTS_WRITE_ACCESS   | \
-               SA_RIGHT_DOMAIN_SET_INFO_3      | \
-               SA_RIGHT_DOMAIN_CREATE_ALIAS    | \
-               SA_RIGHT_DOMAIN_CREATE_GROUP    | \
-               SA_RIGHT_DOMAIN_CREATE_USER     | \
-               SA_RIGHT_DOMAIN_SET_INFO_2      | \
-               SA_RIGHT_DOMAIN_SET_INFO_1)
-
-#define GENERIC_RIGHTS_DOMAIN_EXECUTE \
-               (STANDARD_RIGHTS_EXECUTE_ACCESS | \
-               SA_RIGHT_DOMAIN_OPEN_ACCOUNT    | \
-               SA_RIGHT_DOMAIN_ENUM_ACCOUNTS   | \
-               SA_RIGHT_DOMAIN_LOOKUP_INFO_1)            
-
 /* Group Object specific access rights */
 
 #define SA_RIGHT_GROUP_LOOKUP_INFO     0x00000001

diff --git a/source3/librpc/gen_ndr/samr.h b/source3/librpc/gen_ndr/samr.h
index d2492d6d249e0be231ce3e6383335bb02780c3a9..f7d87193cd8595c711da88ea82098aec0800aa0c 100644 (file)
--- a/source3/librpc/gen_ndr/samr.h
+++ b/source3/librpc/gen_ndr/samr.h
@@ -18,6 +18,11 @@
 #define GENERIC_RIGHTS_USER_READ       ( (STANDARD_RIGHTS_READ_ACCESS|SAMR_USER_ACCESS_GET_GROUP_MEMBERSHIP|SAMR_USER_ACCESS_GET_GROUPS|SAMR_USER_ACCESS_GET_ATTRIBUTES|SAMR_USER_ACCESS_GET_LOGONINFO|SAMR_USER_ACCESS_GET_LOCALE) )
 #define GENERIC_RIGHTS_USER_WRITE      ( (STANDARD_RIGHTS_WRITE_ACCESS|SAMR_USER_ACCESS_CHANGE_PASSWORD|SAMR_USER_ACCESS_SET_LOC_COM|SAMR_USER_ACCESS_SET_ATTRIBUTES|SAMR_USER_ACCESS_SET_PASSWORD|SAMR_USER_ACCESS_CHANGE_GROUP_MEMBERSHIP) )
 #define GENERIC_RIGHTS_USER_EXECUTE    ( (STANDARD_RIGHTS_EXECUTE_ACCESS|SAMR_USER_ACCESS_CHANGE_PASSWORD|SAMR_USER_ACCESS_GET_NAME_ETC) )
+#define SAMR_DOMAIN_ACCESS_ALL_ACCESS  ( 0x000007FF )
+#define GENERIC_RIGHTS_DOMAIN_ALL_ACCESS       ( (STANDARD_RIGHTS_REQUIRED_ACCESS|SAMR_DOMAIN_ACCESS_ALL_ACCESS) )
+#define GENERIC_RIGHTS_DOMAIN_READ     ( (STANDARD_RIGHTS_READ_ACCESS|SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS|SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2) )
+#define GENERIC_RIGHTS_DOMAIN_WRITE    ( (STANDARD_RIGHTS_WRITE_ACCESS|SAMR_DOMAIN_ACCESS_SET_INFO_3|SAMR_DOMAIN_ACCESS_CREATE_ALIAS|SAMR_DOMAIN_ACCESS_CREATE_GROUP|SAMR_DOMAIN_ACCESS_CREATE_USER|SAMR_DOMAIN_ACCESS_SET_INFO_2|SAMR_DOMAIN_ACCESS_SET_INFO_1) )
+#define GENERIC_RIGHTS_DOMAIN_EXECUTE  ( (STANDARD_RIGHTS_EXECUTE_ACCESS|SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT|SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS|SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1) )
 #define MAX_SAM_ENTRIES_W2K    ( 0x400 )
 #define MAX_SAM_ENTRIES_W95    ( 50 )
 #define SAMR_ENUM_USERS_MULTIPLIER     ( 54 )

diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c
index 532392c88b712e10ea43100b03e7149e114e56d0..6e281ca3bb0d45489646d38eb646ffa1350a94f5 100644 (file)
--- a/source3/rpc_server/srv_samr_nt.c
+++ b/source3/rpc_server/srv_samr_nt.c
@@ -990,7 +990,7 @@ NTSTATUS _samr_EnumDomainUsers(pipes_struct *p,
                return NT_STATUS_INVALID_HANDLE;
 
        status = access_check_samr_function(info->acc_granted,
-                                           SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
+                                           SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
                                            "_samr_EnumDomainUsers");
        if (!NT_STATUS_IS_OK(status)) {
                return status;
@@ -1129,7 +1129,7 @@ NTSTATUS _samr_EnumDomainGroups(pipes_struct *p,
                return NT_STATUS_INVALID_HANDLE;
 
        status = access_check_samr_function(info->acc_granted,
-                                           SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
+                                           SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
                                            "_samr_EnumDomainGroups");
        if (!NT_STATUS_IS_OK(status)) {
                return status;
@@ -1209,7 +1209,7 @@ NTSTATUS _samr_EnumDomainAliases(pipes_struct *p,
                 sid_string_dbg(&info->sid)));
 
        status = access_check_samr_function(info->acc_granted,
-                                           SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
+                                           SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
                                            "_samr_EnumDomainAliases");
        if (!NT_STATUS_IS_OK(status)) {
                return status;
@@ -1482,7 +1482,7 @@ NTSTATUS _samr_QueryDisplayInfo(pipes_struct *p,
                return NT_STATUS_INVALID_HANDLE;
 
        status = access_check_samr_function(info->acc_granted,
-                                           SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
+                                           SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
                                            "_samr_QueryDisplayInfo");
        if (!NT_STATUS_IS_OK(status)) {
                return status;
@@ -2062,8 +2062,8 @@ NTSTATUS _samr_LookupRids(pipes_struct *p,
                return NT_STATUS_INVALID_HANDLE;
 
        status = access_check_samr_function(acc_granted,
-                                           SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
-                                           "_samr__LookupRids");
+                                           SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
+                                           "_samr_LookupRids");
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
@@ -2146,7 +2146,7 @@ NTSTATUS _samr_OpenUser(pipes_struct *p,
                return NT_STATUS_INVALID_HANDLE;
 
        nt_status = access_check_samr_function(acc_granted,
-                                              SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
+                                              SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
                                               "_samr_OpenUser" );
 
        if ( !NT_STATUS_IS_OK(nt_status) )
@@ -2641,7 +2641,7 @@ NTSTATUS _samr_QueryUserInfo(pipes_struct *p,
                return NT_STATUS_INVALID_HANDLE;
 
        status = access_check_samr_function(info->acc_granted,
-                                           SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
+                                           SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
                                            "_samr_QueryUserInfo");
        if (!NT_STATUS_IS_OK(status)) {
                return status;
@@ -3147,7 +3147,7 @@ NTSTATUS _samr_CreateUser2(pipes_struct *p,
                return NT_STATUS_INVALID_HANDLE;
 
        nt_status = access_check_samr_function(acc_granted,
-                                              SA_RIGHT_DOMAIN_CREATE_USER,
+                                              SAMR_DOMAIN_ACCESS_CREATE_USER,
                                               "_samr_CreateUser2");
        if (!NT_STATUS_IS_OK(nt_status)) {
                return nt_status;
@@ -3582,7 +3582,7 @@ NTSTATUS _samr_OpenAlias(pipes_struct *p,
                return NT_STATUS_INVALID_HANDLE;
 
        status = access_check_samr_function(acc_granted,
-                                           SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
+                                           SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
                                            "_samr_OpenAlias");
 
        if ( !NT_STATUS_IS_OK(status) )
@@ -4342,10 +4342,10 @@ NTSTATUS _samr_GetAliasMembership(pipes_struct *p,
                return NT_STATUS_INVALID_HANDLE;
 
        ntstatus1 = access_check_samr_function(info->acc_granted,
-                                              SA_RIGHT_DOMAIN_LOOKUP_ALIAS_BY_MEM,
+                                              SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
                                               "_samr_GetAliasMembership");
        ntstatus2 = access_check_samr_function(info->acc_granted,
-                                              SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
+                                              SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
                                               "_samr_GetAliasMembership");
 
        if (!NT_STATUS_IS_OK(ntstatus1) || !NT_STATUS_IS_OK(ntstatus2)) {
@@ -4985,7 +4985,7 @@ NTSTATUS _samr_CreateDomainGroup(pipes_struct *p,
                return NT_STATUS_INVALID_HANDLE;
 
        status = access_check_samr_function(acc_granted,
-                                           SA_RIGHT_DOMAIN_CREATE_GROUP,
+                                           SAMR_DOMAIN_ACCESS_CREATE_GROUP,
                                            "_samr_CreateDomainGroup");
        if (!NT_STATUS_IS_OK(status)) {
                return status;
@@ -5067,7 +5067,7 @@ NTSTATUS _samr_CreateDomAlias(pipes_struct *p,
                return NT_STATUS_INVALID_HANDLE;
 
        result = access_check_samr_function(acc_granted,
-                                           SA_RIGHT_DOMAIN_CREATE_ALIAS,
+                                           SAMR_DOMAIN_ACCESS_CREATE_ALIAS,
                                            "_samr_CreateDomAlias");
        if (!NT_STATUS_IS_OK(result)) {
                return result;
@@ -5474,7 +5474,7 @@ NTSTATUS _samr_OpenGroup(pipes_struct *p,
                return NT_STATUS_INVALID_HANDLE;
 
        status = access_check_samr_function(acc_granted,
-                                           SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
+                                           SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
                                            "_samr_OpenGroup");
 
        if ( !NT_STATUS_IS_OK(status) )
@@ -5628,11 +5628,11 @@ NTSTATUS _samr_SetDomainInfo(pipes_struct *p,
         * levels here, but we're really just looking for
         * GENERIC_RIGHTS_DOMAIN_WRITE access. Unfortunately
         * this maps to different specific bits. So
-        * assume if we have SA_RIGHT_DOMAIN_SET_INFO_1
+        * assume if we have SAMR_DOMAIN_ACCESS_SET_INFO_1
         * set we are ok. */
 
        result = access_check_samr_function(info->acc_granted,
-                                           SA_RIGHT_DOMAIN_SET_INFO_1,
+                                           SAMR_DOMAIN_ACCESS_SET_INFO_1,
                                            "_samr_SetDomainInfo");
 
        if (!NT_STATUS_IS_OK(result))
@@ -5705,7 +5705,7 @@ NTSTATUS _samr_GetDisplayEnumerationIndex(pipes_struct *p,
        }
 
        status = access_check_samr_function(info->acc_granted,
-                                           SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
+                                           SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
                                            "_samr_GetDisplayEnumerationIndex");
        if (!NT_STATUS_IS_OK(status)) {
                return status;

diff --git a/source3/utils/net_rpc.c b/source3/utils/net_rpc.c
index 9db755d30b1e0bf66d3315a325ccfe819072133f..d3b10019d48ba68da06018d5ea0eeee5791533f9 100644 (file)
--- a/source3/utils/net_rpc.c
+++ b/source3/utils/net_rpc.c
@@ -6127,7 +6127,7 @@ static int rpc_trustdom_list(struct net_context *c, int argc, const char **argv)
           able to enumerate accounts*/
        nt_status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
                                           &connect_hnd,
-                                          SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
+                                          SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
                                           queried_dom_sid,
                                           &domain_hnd);
        if (!NT_STATUS_IS_OK(nt_status)) {