Ok, this patch removes the privilege stuff we had in, unused, for some time.

The code was nice, but put in the wrong place (group mapping) and not
supported by most of the code, thus useless.

We will put back most of the code when our infrastructure will be changed
so that privileges actually really make sense to be set.

This is a first patch of a set to enhance all our mapping code cleaness and
stability towards a sane next beta for 3.0 code base

Simo.
(This used to be commit e341e7c49f8c17a9ee30ca3fab3aa0397c1f0c7e)

1 files changed, 47 insertions, 510 deletions

diff --git a/source3/groupdb/mapping.c b/source3/groupdb/mapping.c
index e13730b141..ef243ecfc0 100644
--- a/source3/groupdb/mapping.c
+++ b/source3/groupdb/mapping.c
@@ -37,69 +37,7 @@ PRIVS privs[] = {
 	{SE_PRIV_PRINT_OPERATOR, "SaPrintOp",                 "Add or remove printers - Samba"  },
 	{SE_PRIV_ALL,            "SaAllPrivs",                "all privileges"                  }
 };
-/*
-PRIVS privs[] = {
-	{  2, "SeCreateTokenPrivilege" },
-	{  3, "SeAssignPrimaryTokenPrivilege" },
-	{  4, "SeLockMemoryPrivilege" },
-	{  5, "SeIncreaseQuotaPrivilege" },
-	{  6, "SeMachineAccountPrivilege" },
-	{  7, "SeTcbPrivilege" },
-	{  8, "SeSecurityPrivilege" },
-	{  9, "SeTakeOwnershipPrivilege" },
-	{ 10, "SeLoadDriverPrivilege" },
-	{ 11, "SeSystemProfilePrivilege" },
-	{ 12, "SeSystemtimePrivilege" },
-	{ 13, "SeProfileSingleProcessPrivilege" },
-	{ 14, "SeIncreaseBasePriorityPrivilege" },
-	{ 15, "SeCreatePagefilePrivilege" },
-	{ 16, "SeCreatePermanentPrivilege" },
-	{ 17, "SeBackupPrivilege" },
-	{ 18, "SeRestorePrivilege" },
-	{ 19, "SeShutdownPrivilege" },
-	{ 20, "SeDebugPrivilege" },
-	{ 21, "SeAuditPrivilege" },
-	{ 22, "SeSystemEnvironmentPrivilege" },
-	{ 23, "SeChangeNotifyPrivilege" },
-	{ 24, "SeRemoteShutdownPrivilege" },
-	{ 25, "SeUndockPrivilege" },
-	{ 26, "SeSyncAgentPrivilege" },
-	{ 27, "SeEnableDelegationPrivilege" },
-};
-*/
-
-	/*
-	 * Those are not really privileges like the other ones.
-	 * They are handled in a special case and called
-	 * system privileges.
-	 *
-	 * SeNetworkLogonRight
-	 * SeUnsolicitedInputPrivilege
-	 * SeBatchLogonRight
-	 * SeServiceLogonRight
-	 * SeInteractiveLogonRight
-	 * SeDenyInteractiveLogonRight
-	 * SeDenyNetworkLogonRight
-	 * SeDenyBatchLogonRight
-	 * SeDenyBatchLogonRight
-	 */
 
-#if 0
-/****************************************************************************
-check if the user has the required privilege.
-****************************************************************************/
-static BOOL se_priv_access_check(NT_USER_TOKEN *token, uint32 privilege)
-{
-	/* no token, no privilege */
-	if (token==NULL)
-		return False;
-	
-	if ((token->privilege & privilege)==privilege)
-		return True;
-	
-	return False;
-}
-#endif
 
 /****************************************************************************
 dump the mapping group mapping to a text file
@@ -151,57 +89,35 @@ static BOOL default_group_mapping(void)
 	fstring str_admins;
 	fstring str_users;
 	fstring str_guests;
-	LUID_ATTR set;
-
-	PRIVILEGE_SET privilege_none;
-	PRIVILEGE_SET privilege_all;
-	PRIVILEGE_SET privilege_print_op;
-
-	init_privilege(&privilege_none);
-	init_privilege(&privilege_all);
-	init_privilege(&privilege_print_op);
-
-	set.attr=0;
-	set.luid.high=0;
-	set.luid.low=SE_PRIV_PRINT_OPERATOR;
-	add_privilege(&privilege_print_op, set);
-
-	add_all_privilege(&privilege_all);
 
 	/* Add the Wellknown groups */
 
-	add_initial_entry(-1, "S-1-5-32-544", SID_NAME_WKN_GRP, "Administrators", "", privilege_all, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY);
-	add_initial_entry(-1, "S-1-5-32-545", SID_NAME_WKN_GRP, "Users", "", privilege_none, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY);
-	add_initial_entry(-1, "S-1-5-32-546", SID_NAME_WKN_GRP, "Guests", "", privilege_none, PR_ACCESS_FROM_NETWORK);
-	add_initial_entry(-1, "S-1-5-32-547", SID_NAME_WKN_GRP, "Power Users", "", privilege_none, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY);
-
-	add_initial_entry(-1, "S-1-5-32-548", SID_NAME_WKN_GRP, "Account Operators", "", privilege_none, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY);
-	add_initial_entry(-1, "S-1-5-32-549", SID_NAME_WKN_GRP, "System Operators", "", privilege_none, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY);
-	add_initial_entry(-1, "S-1-5-32-550", SID_NAME_WKN_GRP, "Print Operators", "", privilege_print_op, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY);
-	add_initial_entry(-1, "S-1-5-32-551", SID_NAME_WKN_GRP, "Backup Operators", "", privilege_none, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY);
-
-	add_initial_entry(-1, "S-1-5-32-552", SID_NAME_WKN_GRP, "Replicators", "", privilege_none, PR_ACCESS_FROM_NETWORK);
+	add_initial_entry(-1, "S-1-5-32-544", SID_NAME_WKN_GRP, "Administrators", "");
+	add_initial_entry(-1, "S-1-5-32-545", SID_NAME_WKN_GRP, "Users", "");
+	add_initial_entry(-1, "S-1-5-32-546", SID_NAME_WKN_GRP, "Guests", "");
+	add_initial_entry(-1, "S-1-5-32-547", SID_NAME_WKN_GRP, "Power Users", "");
+	add_initial_entry(-1, "S-1-5-32-548", SID_NAME_WKN_GRP, "Account Operators", "");
+	add_initial_entry(-1, "S-1-5-32-549", SID_NAME_WKN_GRP, "System Operators", "");
+	add_initial_entry(-1, "S-1-5-32-550", SID_NAME_WKN_GRP, "Print Operators", "");
+	add_initial_entry(-1, "S-1-5-32-551", SID_NAME_WKN_GRP, "Backup Operators", "");
+	add_initial_entry(-1, "S-1-5-32-552", SID_NAME_WKN_GRP, "Replicators", "");
 
 	/* Add the defaults domain groups */
 
 	sid_copy(&sid_admins, get_global_sam_sid());
 	sid_append_rid(&sid_admins, DOMAIN_GROUP_RID_ADMINS);
 	sid_to_string(str_admins, &sid_admins);
-	add_initial_entry(-1, str_admins, SID_NAME_DOM_GRP, "Domain Admins", "", privilege_all, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY);
+	add_initial_entry(-1, str_admins, SID_NAME_DOM_GRP, "Domain Admins", "");
 
 	sid_copy(&sid_users,  get_global_sam_sid());
 	sid_append_rid(&sid_users,  DOMAIN_GROUP_RID_USERS);
 	sid_to_string(str_users, &sid_users);
-	add_initial_entry(-1, str_users,  SID_NAME_DOM_GRP, "Domain Users",  "", privilege_none, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY);
+	add_initial_entry(-1, str_users,  SID_NAME_DOM_GRP, "Domain Users",  "");
 
 	sid_copy(&sid_guests, get_global_sam_sid());
 	sid_append_rid(&sid_guests, DOMAIN_GROUP_RID_GUESTS);
 	sid_to_string(str_guests, &sid_guests);
-	add_initial_entry(-1, str_guests, SID_NAME_DOM_GRP, "Domain Guests", "", privilege_none, PR_ACCESS_FROM_NETWORK);
-
-	free_privilege(&privilege_none);
-	free_privilege(&privilege_all);
-	free_privilege(&privilege_print_op);
+	add_initial_entry(-1, str_guests, SID_NAME_DOM_GRP, "Domain Guests", "");
 
 	return True;
 }
@@ -259,8 +175,6 @@ static BOOL add_mapping_entry(GROUP_MAP *map, int flag)
 	pstring key, buf;
 	fstring string_sid="";
 	int len;
-	int i;
-	PRIVILEGE_SET *set;
 
 	if(!init_group_mapping()) {
 		DEBUG(0,("failed to initialize group mapping"));
@@ -269,16 +183,8 @@ static BOOL add_mapping_entry(GROUP_MAP *map, int flag)
 	
 	sid_to_string(string_sid, &map->sid);
 
-	len = tdb_pack(buf, sizeof(buf), "ddffd",
-			map->gid, map->sid_name_use, map->nt_name, map->comment, map->systemaccount);
-
-	/* write the privilege list in the TDB database */
-
-	set=&map->priv_set;
-	len += tdb_pack(buf+len, sizeof(buf)-len, "d", set->count);
-	for (i=0; i<set->count; i++)
-		len += tdb_pack(buf+len, sizeof(buf)-len, "ddd", 
-				set->set[i].luid.low, set->set[i].luid.high, set->set[i].attr);
+	len = tdb_pack(buf, sizeof(buf), "ddff",
+			map->gid, map->sid_name_use, map->nt_name, map->comment);
 
 	if (len > sizeof(buf))
 		return False;
@@ -297,8 +203,7 @@ static BOOL add_mapping_entry(GROUP_MAP *map, int flag)
 /****************************************************************************
 initialise first time the mapping list
 ****************************************************************************/
-BOOL add_initial_entry(gid_t gid, const char *sid, enum SID_NAME_USE sid_name_use,
-		       const char *nt_name, const char *comment, PRIVILEGE_SET priv_set, uint32 systemaccount)
+BOOL add_initial_entry(gid_t gid, const char *sid, enum SID_NAME_USE sid_name_use, const char *nt_name, const char *comment)
 {
 	GROUP_MAP map;
 
@@ -316,10 +221,6 @@ BOOL add_initial_entry(gid_t gid, const char *sid, enum SID_NAME_USE sid_name_us
 	map.sid_name_use=sid_name_use;
 	fstrcpy(map.nt_name, nt_name);
 	fstrcpy(map.comment, comment);
-	map.systemaccount=systemaccount;
-
-	map.priv_set.count=priv_set.count;
-	map.priv_set.set=priv_set.set;
 
 	pdb_add_group_mapping_entry(&map);
 
@@ -327,196 +228,15 @@ BOOL add_initial_entry(gid_t gid, const char *sid, enum SID_NAME_USE sid_name_us
 }
 
 /****************************************************************************
-initialise a privilege list
-****************************************************************************/
-void init_privilege(PRIVILEGE_SET *priv_set)
-{
-	priv_set->count=0;
-	priv_set->control=0;
-	priv_set->set=NULL;
-}
-
-/****************************************************************************
-free a privilege list
-****************************************************************************/
-BOOL free_privilege(PRIVILEGE_SET *priv_set)
-{
-	if (priv_set->count==0) {
-		DEBUG(100,("free_privilege: count=0, nothing to clear ?\n"));
-		return False;
-	}
-
-	if (priv_set->set==NULL) {
-		DEBUG(0,("free_privilege: list ptr is NULL, very strange !\n"));
-		return False;
-	}
-
-	safe_free(priv_set->set);
-	priv_set->count=0;
-	priv_set->control=0;
-	priv_set->set=NULL;
-
-	return True;
-}
-
-/****************************************************************************
-add a privilege to a privilege array
-****************************************************************************/
-BOOL add_privilege(PRIVILEGE_SET *priv_set, LUID_ATTR set)
-{
-	LUID_ATTR *new_set;
-
-	/* check if the privilege is not already in the list */
-	if (check_priv_in_privilege(priv_set, set))
-		return False;
-
-	/* we can allocate memory to add the new privilege */
-
-	new_set=(LUID_ATTR *)Realloc(priv_set->set, (priv_set->count+1)*(sizeof(LUID_ATTR)));
-	if (new_set==NULL) {
-		DEBUG(0,("add_privilege: could not Realloc memory to add a new privilege\n"));
-		return False;
-	}
-
-	new_set[priv_set->count].luid.high=set.luid.high;
-	new_set[priv_set->count].luid.low=set.luid.low;
-	new_set[priv_set->count].attr=set.attr;
-	
-	priv_set->count++;
-	priv_set->set=new_set;
-	
-	return True;	
-}
-
-/****************************************************************************
-add all the privileges to a privilege array
-****************************************************************************/
-BOOL add_all_privilege(PRIVILEGE_SET *priv_set)
-{
-	LUID_ATTR set;
-
-	set.attr=0;
-	set.luid.high=0;
-	
-	set.luid.low=SE_PRIV_ADD_USERS;
-	add_privilege(priv_set, set);
-
-	set.luid.low=SE_PRIV_ADD_MACHINES;
-	add_privilege(priv_set, set);
-
-	set.luid.low=SE_PRIV_PRINT_OPERATOR;
-	add_privilege(priv_set, set);
-	
-	return True;
-}
-
-/****************************************************************************
-check if the privilege list is empty
-****************************************************************************/
-BOOL check_empty_privilege(PRIVILEGE_SET *priv_set)
-{
-	return (priv_set->count == 0);
-}
-
-/****************************************************************************
-check if the privilege is in the privilege list
-****************************************************************************/
-BOOL check_priv_in_privilege(PRIVILEGE_SET *priv_set, LUID_ATTR set)
-{
-	int i;
-
-	/* if the list is empty, obviously we can't have it */
-	if (check_empty_privilege(priv_set))
-		return False;
-
-	for (i=0; i<priv_set->count; i++) {
-		LUID_ATTR *cur_set;
-
-		cur_set=&priv_set->set[i];
-		/* check only the low and high part. Checking the attr field has no meaning */
-		if( (cur_set->luid.low==set.luid.low) && (cur_set->luid.high==set.luid.high) )
-			return True;
-	}
-
-	return False;
-}
-
-/****************************************************************************
-remove a privilege from a privilege array
-****************************************************************************/
-BOOL remove_privilege(PRIVILEGE_SET *priv_set, LUID_ATTR set)
-{
-	LUID_ATTR *new_set;
-	LUID_ATTR *old_set;
-	int i,j;
-
-	/* check if the privilege is in the list */
-	if (!check_priv_in_privilege(priv_set, set))
-		return False;
-
-	/* special case if it's the only privilege in the list */
-	if (priv_set->count==1) {
-		free_privilege(priv_set);
-		init_privilege(priv_set);	
-	
-		return True;
-	}
-
-	/* 
-	 * the privilege is there, create a new list,
-	 * and copy the other privileges
-	 */
-
-	old_set=priv_set->set;
-
-	new_set=(LUID_ATTR *)malloc((priv_set->count-1)*(sizeof(LUID_ATTR)));
-	if (new_set==NULL) {
-		DEBUG(0,("remove_privilege: could not malloc memory for new privilege list\n"));
-		return False;
-	}
-
-	for (i=0, j=0; i<priv_set->count; i++) {
-		if ((old_set[i].luid.low==set.luid.low) && 
-		    (old_set[i].luid.high==set.luid.high)) {
-		    	continue;
-		}
-		
-		new_set[j].luid.low=old_set[i].luid.low;
-		new_set[j].luid.high=old_set[i].luid.high;
-		new_set[j].attr=old_set[i].attr;
-
-		j++;
-	}
-	
-	if (j!=priv_set->count-1) {
-		DEBUG(0,("remove_privilege: mismatch ! difference is not -1\n"));
-		DEBUGADD(0,("old count:%d, new count:%d\n", priv_set->count, j));
-		safe_free(new_set);
-		return False;
-	}
-		
-	/* ok everything is fine */
-	
-	priv_set->count--;
-	priv_set->set=new_set;
-	
-	safe_free(old_set);
-	
-	return True;	
-}
-
-/****************************************************************************
  Return the sid and the type of the unix group.
 ****************************************************************************/
 
-static BOOL get_group_map_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv)
+static BOOL get_group_map_from_sid(DOM_SID sid, GROUP_MAP *map)
 {
 	TDB_DATA kbuf, dbuf;
 	pstring key;
 	fstring string_sid;
 	int ret;
-	int i;
-	PRIVILEGE_SET *set;
 	
 	if(!init_group_mapping()) {
 		DEBUG(0,("failed to initialize group mapping"));
@@ -535,34 +255,10 @@ static BOOL get_group_map_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv)
 	if (!dbuf.dptr)
 		return False;
 
-	ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddffd",
-				&map->gid, &map->sid_name_use, &map->nt_name, &map->comment, &map->systemaccount);
-
-	set=&map->priv_set;
-	init_privilege(set);
-	ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "d", &set->count);
-
-	DEBUG(10,("get_group_map_from_sid: %d privileges\n", map->priv_set.count));
-
-	set->set = NULL;
-	if (set->count) {
-		set->set=(LUID_ATTR *)smb_xmalloc(set->count*sizeof(LUID_ATTR));
-	}
-
-	for (i=0; i<set->count; i++)
-		ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "ddd", 
-				&(set->set[i].luid.low), &(set->set[i].luid.high), &(set->set[i].attr));
+	ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff",
+				&map->gid, &map->sid_name_use, &map->nt_name, &map->comment);
 
 	SAFE_FREE(dbuf.dptr);
-	if (ret != dbuf.dsize) {
-		DEBUG(0,("get_group_map_from_sid: group mapping TDB corrupted ?\n"));
-		free_privilege(set);
-		return False;
-	}
-
-	/* we don't want the privileges */
-	if (with_priv==MAPPING_WITHOUT_PRIV)
-		free_privilege(set);
 
 	sid_copy(&map->sid, &sid);
 	
@@ -573,13 +269,11 @@ static BOOL get_group_map_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv)
  Return the sid and the type of the unix group.
 ****************************************************************************/
 
-static BOOL get_group_map_from_gid(gid_t gid, GROUP_MAP *map, BOOL with_priv)
+static BOOL get_group_map_from_gid(gid_t gid, GROUP_MAP *map)
 {
 	TDB_DATA kbuf, dbuf, newkey;
 	fstring string_sid;
 	int ret;
-	int i;
-	PRIVILEGE_SET *set;
 
 	if(!init_group_mapping()) {
 		DEBUG(0,("failed to initialize group mapping"));
@@ -602,34 +296,15 @@ static BOOL get_group_map_from_gid(gid_t gid, GROUP_MAP *map, BOOL with_priv)
 
 		string_to_sid(&map->sid, string_sid);
 		
-		ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddffd",
-				 &map->gid, &map->sid_name_use, &map->nt_name, &map->comment, &map->systemaccount);
-
-		set=&map->priv_set;
-		ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "d", &set->count);
-		set->set = NULL;
-		if (set->count) {
-			set->set=(LUID_ATTR *)smb_xmalloc(set->count*sizeof(LUID_ATTR));
-		}
-
-		for (i=0; i<set->count; i++)
-			ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "ddd", 
-					&(set->set[i].luid.low), &(set->set[i].luid.high), &(set->set[i].attr));
+		ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff",
+				 &map->gid, &map->sid_name_use, &map->nt_name, &map->comment);
 
 		SAFE_FREE(dbuf.dptr);
-		if (ret != dbuf.dsize){
-			free_privilege(set);
-			continue;
-		}
 
 		if (gid==map->gid) {
-			if (!with_priv)
-				free_privilege(&map->priv_set);
 			SAFE_FREE(kbuf.dptr);
 			return True;
 		}
-		
-		free_privilege(set);
 	}
 
 	return False;
@@ -639,13 +314,11 @@ static BOOL get_group_map_from_gid(gid_t gid, GROUP_MAP *map, BOOL with_priv)
  Return the sid and the type of the unix group.
 ****************************************************************************/
 
-static BOOL get_group_map_from_ntname(char *name, GROUP_MAP *map, BOOL with_priv)
+static BOOL get_group_map_from_ntname(const char *name, GROUP_MAP *map)
 {
 	TDB_DATA kbuf, dbuf, newkey;
 	fstring string_sid;
 	int ret;
-	int i;
-	PRIVILEGE_SET *set;
 
 	if(!init_group_mapping()) {
 		DEBUG(0,("get_group_map_from_ntname:failed to initialize group mapping"));
@@ -668,36 +341,15 @@ static BOOL get_group_map_from_ntname(char *name, GROUP_MAP *map, BOOL with_priv
 
 		string_to_sid(&map->sid, string_sid);
 		
-		ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddffd",
-				 &map->gid, &map->sid_name_use, &map->nt_name, &map->comment, &map->systemaccount);
-
-		set=&map->priv_set;
-		ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "d", &set->count);
-	
-		set->set=(LUID_ATTR *)malloc(set->count*sizeof(LUID_ATTR));
-		if (set->set==NULL) {
-			DEBUG(0,("get_group_map_from_ntname: could not allocate memory for privileges\n"));
-			return False;
-		}
-
-		for (i=0; i<set->count; i++)
-			ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "ddd", 
-					&(set->set[i].luid.low), &(set->set[i].luid.high), &(set->set[i].attr));
+		ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff",
+				 &map->gid, &map->sid_name_use, &map->nt_name, &map->comment);
 
 		SAFE_FREE(dbuf.dptr);
-		if (ret != dbuf.dsize) {
-			free_privilege(set);
-			continue;
-		}
 
 		if (StrCaseCmp(name, map->nt_name)==0) {
-			if (!with_priv)
-				free_privilege(&map->priv_set);
 			SAFE_FREE(kbuf.dptr);
 			return True;
 		}
-
-		free_privilege(set);
 	}
 
 	return False;
@@ -743,7 +395,7 @@ static BOOL group_map_remove(DOM_SID sid)
 ****************************************************************************/
 
 static BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap,
-			int *num_entries, BOOL unix_only, BOOL with_priv)
+			int *num_entries, BOOL unix_only)
 {
 	TDB_DATA kbuf, dbuf, newkey;
 	fstring string_sid;
@@ -752,8 +404,6 @@ static BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap,
 	GROUP_MAP *mapt;
 	int ret;
 	int entries=0;
-	int i;
-	PRIVILEGE_SET *set;
 
 	if(!init_group_mapping()) {
 		DEBUG(0,("failed to initialize group mapping"));
@@ -776,43 +426,19 @@ static BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap,
 
 		fstrcpy(string_sid, kbuf.dptr+strlen(GROUP_PREFIX));
 				
-		ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddffd",
-				 &map.gid, &map.sid_name_use, &map.nt_name, &map.comment, &map.systemaccount);
-
-		set=&map.priv_set;
-		init_privilege(set);
-		
-		ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "d", &set->count);
-	
-		if (set->count!=0) {
-			set->set=(LUID_ATTR *)malloc(set->count*sizeof(LUID_ATTR));
-			if (set->set==NULL) {
-				DEBUG(0,("enum_group_mapping: could not allocate memory for privileges\n"));
-				return False;
-			}
-		}
-
-		for (i=0; i<set->count; i++)
-			ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "ddd", 
-					&(set->set[i].luid.low), &(set->set[i].luid.high), &(set->set[i].attr));
+		ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff",
+				 &map.gid, &map.sid_name_use, &map.nt_name, &map.comment);
 
 		SAFE_FREE(dbuf.dptr);
-		if (ret != dbuf.dsize) {
-			DEBUG(11,("enum_group_mapping: error in memory size\n"));
-			free_privilege(set);
-			continue;
-		}
 
 		/* list only the type or everything if UNKNOWN */
 		if (sid_name_use!=SID_NAME_UNKNOWN  && sid_name_use!=map.sid_name_use) {
 			DEBUG(11,("enum_group_mapping: group %s is not of the requested type\n", map.nt_name));
-			free_privilege(set);
 			continue;
 		}
 
 		if (unix_only==ENUM_ONLY_MAPPED && map.gid==-1) {
 			DEBUG(11,("enum_group_mapping: group %s is non mapped\n", map.nt_name));
-			free_privilege(set);
 			continue;
 		}
 
@@ -825,7 +451,6 @@ static BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap,
 		if (!mapt) {
 			DEBUG(0,("enum_group_mapping: Unable to enlarge group map!\n"));
 			SAFE_FREE(*rmap);
-			free_privilege(set);
 			return False;
 		}
 		else
@@ -836,12 +461,6 @@ static BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap,
 		mapt[entries].sid_name_use = map.sid_name_use;
 		fstrcpy(mapt[entries].nt_name, map.nt_name);
 		fstrcpy(mapt[entries].comment, map.comment);
-		mapt[entries].systemaccount=map.systemaccount;
-		mapt[entries].priv_set.count=set->count;
-		mapt[entries].priv_set.control=set->control;
-		mapt[entries].priv_set.set=set->set;
-		if (!with_priv)
-			free_privilege(&(mapt[entries].priv_set));
 
 		entries++;
 
@@ -852,64 +471,6 @@ static BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap,
 	return True;
 }
 
-
-/****************************************************************************
-convert a privilege string to a privilege array
-****************************************************************************/
-void convert_priv_from_text(PRIVILEGE_SET *se_priv, char *privilege)
-{
-	pstring tok;
-	const char *p = privilege;
-	int i;
-	LUID_ATTR set;
-
-	/* By default no privilege */
-	init_privilege(se_priv);
-	
-	if (privilege==NULL)
-		return;
-
-	while(next_token(&p, tok, " ", sizeof(tok)) ) {
-		for (i=0; i<=PRIV_ALL_INDEX; i++) {
-			if (StrCaseCmp(privs[i].priv, tok)==0) {
-				set.attr=0;
-				set.luid.high=0;
-				set.luid.low=privs[i].se_priv;
-				add_privilege(se_priv, set);
-			}
-		}		
-	}
-}
-
-/****************************************************************************
-convert a privilege array to a privilege string
-****************************************************************************/
-void convert_priv_to_text(PRIVILEGE_SET *se_priv, char *privilege)
-{
-	int i,j;
-
-	if (privilege==NULL)
-		return;
-
-	ZERO_STRUCTP(privilege);
-
-	if (check_empty_privilege(se_priv)) {
-		fstrcat(privilege, "No privilege");
-		return;
-	}
-
-	for(i=0; i<se_priv->count; i++) {
-		j=1;
-		while (privs[j].se_priv!=se_priv->set[i].luid.low && j<=PRIV_ALL_INDEX) {
-			j++;
-		}
-
-		fstrcat(privilege, privs[j].priv);
-		fstrcat(privilege, " ");
-	}
-}
-
-
 /*
  *
  * High level functions
@@ -922,7 +483,7 @@ void convert_priv_to_text(PRIVILEGE_SET *se_priv, char *privilege)
 
 /* get a domain group from it's SID */
 
-BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv)
+BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map)
 {
 	struct group *grp;
 
@@ -934,23 +495,19 @@ BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv)
 	DEBUG(10, ("get_domain_group_from_sid\n"));
 
 	/* if the group is NOT in the database, it CAN NOT be a domain group */
-	if(!pdb_getgrsid(map, sid, with_priv))
+	if(!pdb_getgrsid(map, sid))
 		return False;
 
 	DEBUG(10, ("get_domain_group_from_sid: SID found in the TDB\n"));
 
 	/* if it's not a domain group, continue */
 	if (map->sid_name_use!=SID_NAME_DOM_GRP) {
-		if (with_priv)
-			free_privilege(&map->priv_set);
 		return False;
 	}
 
 	DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
  	
 	if (map->gid==-1) {
-		if (with_priv)
-			free_privilege(&map->priv_set);
 		return False;
 	}
 
@@ -958,8 +515,6 @@ BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv)
 
 	if ( (grp=getgrgid(map->gid)) == NULL) {
 		DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n"));
-		if (with_priv)
-			free_privilege(&map->priv_set);
 		return False;
 	}
 
@@ -971,7 +526,7 @@ BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv)
 
 /* get a local (alias) group from it's SID */
 
-BOOL get_local_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv)
+BOOL get_local_group_from_sid(DOM_SID sid, GROUP_MAP *map)
 {
 	struct group *grp;
 
@@ -981,22 +536,16 @@ BOOL get_local_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv)
 	}
 
 	/* The group is in the mapping table */
-	if(pdb_getgrsid(map, sid, with_priv)) {
+	if(pdb_getgrsid(map, sid)) {
 		if (map->sid_name_use!=SID_NAME_ALIAS) {
-			if (with_priv)
-				free_privilege(&map->priv_set);
 			return False;
  		}
 		
 		if (map->gid==-1) {
-			if (with_priv)
-				free_privilege(&map->priv_set);
 			return False;
 		}
 
 		if ( (grp=getgrgid(map->gid)) == NULL) {
-			if (with_priv)
-				free_privilege(&map->priv_set);
 			return False;
 		}
 	} else {
@@ -1011,13 +560,10 @@ BOOL get_local_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv)
 			return False;
 
 		map->sid_name_use=SID_NAME_ALIAS;
-		map->systemaccount=PR_ACCESS_FROM_NETWORK;
 
 		fstrcpy(map->nt_name, grp->gr_name);
 		fstrcpy(map->comment, "Local Unix Group");
 
-		init_privilege(&map->priv_set);
-
 		sid_copy(&map->sid, &sid);
 	}
 
@@ -1026,7 +572,7 @@ BOOL get_local_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv)
 
 /* get a builtin group from it's SID */
 
-BOOL get_builtin_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv)
+BOOL get_builtin_group_from_sid(DOM_SID sid, GROUP_MAP *map)
 {
 	struct group *grp;
 
@@ -1035,24 +581,18 @@ BOOL get_builtin_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv)
 		return(False);
 	}
 
-	if(!pdb_getgrsid(map, sid, with_priv))
+	if(!pdb_getgrsid(map, sid))
 		return False;
 
 	if (map->sid_name_use!=SID_NAME_WKN_GRP) {
-		if (with_priv)
-			free_privilege(&map->priv_set);
 		return False;
 	}
 
 	if (map->gid==-1) {
-		if (with_priv)
-			free_privilege(&map->priv_set);
 		return False;
 	}
 
 	if ( (grp=getgrgid(map->gid)) == NULL) {
-		if (with_priv)
-			free_privilege(&map->priv_set);
 		return False;
 	}
 
@@ -1064,7 +604,7 @@ BOOL get_builtin_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv)
 /****************************************************************************
 Returns a GROUP_MAP struct based on the gid.
 ****************************************************************************/
-BOOL get_group_from_gid(gid_t gid, GROUP_MAP *map, BOOL with_priv)
+BOOL get_group_from_gid(gid_t gid, GROUP_MAP *map)
 {
 	struct group *grp;
 
@@ -1079,11 +619,9 @@ BOOL get_group_from_gid(gid_t gid, GROUP_MAP *map, BOOL with_priv)
 	/*
 	 * make a group map from scratch if doesn't exist.
 	 */
-	if (!pdb_getgrgid(map, gid, with_priv)) {
+	if (!pdb_getgrgid(map, gid)) {
 		map->gid=gid;
 		map->sid_name_use=SID_NAME_ALIAS;
-		map->systemaccount=PR_ACCESS_FROM_NETWORK;
-		init_privilege(&map->priv_set);
 
 		/* interim solution until we have a last RID allocated */
 
@@ -1287,23 +825,23 @@ int smb_delete_user_group(const char *unix_group, const char *unix_user)
 
 
 NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
-				 DOM_SID sid, BOOL with_priv)
+				 DOM_SID sid)
 {
-	return get_group_map_from_sid(sid, map, with_priv) ?
+	return get_group_map_from_sid(sid, map) ?
 		NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 }
 
 NTSTATUS pdb_default_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
-				 gid_t gid, BOOL with_priv)
+				 gid_t gid)
 {
-	return get_group_map_from_gid(gid, map, with_priv) ?
+	return get_group_map_from_gid(gid, map) ?
 		NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 }
 
 NTSTATUS pdb_default_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
-				 char *name, BOOL with_priv)
+				 const char *name)
 {
-	return get_group_map_from_ntname(name, map, with_priv) ?
+	return get_group_map_from_ntname(name, map) ?
 		NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 }
 
@@ -1331,10 +869,9 @@ NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods,
 NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
 					   enum SID_NAME_USE sid_name_use,
 					   GROUP_MAP **rmap, int *num_entries,
-					   BOOL unix_only, BOOL with_priv)
+					   BOOL unix_only)
 {
-	return enum_group_mapping(sid_name_use, rmap, num_entries, unix_only,
-				  with_priv) ?
+	return enum_group_mapping(sid_name_use, rmap, num_entries, unix_only) ?
 		NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 }
 
@@ -1343,19 +880,19 @@ NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
  *********************************************************************/
 
 NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
-				 DOM_SID sid, BOOL with_priv)
+				 DOM_SID sid)
 {
 	return NT_STATUS_UNSUCCESSFUL;
 }
 
 NTSTATUS pdb_nop_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
-				 gid_t gid, BOOL with_priv)
+				 gid_t gid)
 {
 	return NT_STATUS_UNSUCCESSFUL;
 }
 
 NTSTATUS pdb_nop_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
-				 char *name, BOOL with_priv)
+				 const char *name)
 {
 	return NT_STATUS_UNSUCCESSFUL;
 }
@@ -1381,7 +918,7 @@ NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods,
 NTSTATUS pdb_nop_enum_group_mapping(struct pdb_methods *methods,
 					   enum SID_NAME_USE sid_name_use,
 					   GROUP_MAP **rmap, int *num_entries,
-					   BOOL unix_only, BOOL with_priv)
+					   BOOL unix_only)
 {
 	return NT_STATUS_UNSUCCESSFUL;
 }