diff options
| -rw-r--r-- | source3/include/rpc_lsa.h | 2 | ||||
| -rw-r--r-- | source3/include/rpc_secdes.h | 5 | ||||
| -rw-r--r-- | source3/include/smb.h | 2 | ||||
| -rw-r--r-- | source3/rpc_server/srv_lsa_nt.c | 22 | ||||
| -rw-r--r-- | source3/rpc_server/srv_samr_nt.c | 8 |
5 files changed, 26 insertions, 13 deletions
diff --git a/source3/include/rpc_lsa.h b/source3/include/rpc_lsa.h index a2bc72d2b2..c0425271b3 100644 --- a/source3/include/rpc_lsa.h +++ b/source3/include/rpc_lsa.h @@ -207,7 +207,7 @@ typedef struct lsa_r_open_pol2_info POLICY_VIEW_AUDIT_INFORMATION |\ POLICY_GET_PRIVATE_INFORMATION) -#define POLICY_WRITE ( STANDARD_RIGHTS_WRITE_ACCESS |\ +#define POLICY_WRITE ( STD_RIGHT_READ_CONTROL_ACCESS |\ POLICY_TRUST_ADMIN |\ POLICY_CREATE_ACCOUNT |\ POLICY_CREATE_SECRET |\ diff --git a/source3/include/rpc_secdes.h b/source3/include/rpc_secdes.h index 1279007220..3e4c47dce9 100644 --- a/source3/include/rpc_secdes.h +++ b/source3/include/rpc_secdes.h @@ -251,7 +251,10 @@ typedef struct standard_mapping { #define STANDARD_RIGHTS_ALL_ACCESS STD_RIGHT_ALL_ACCESS /* 0x001f0000 */ #define STANDARD_RIGHTS_EXECUTE_ACCESS STD_RIGHT_READ_CONTROL_ACCESS /* 0x00020000 */ #define STANDARD_RIGHTS_READ_ACCESS STD_RIGHT_READ_CONTROL_ACCESS /* 0x00020000 */ -#define STANDARD_RIGHTS_WRITE_ACCESS STD_RIGHT_READ_CONTROL_ACCESS /* 0x00020000 */ +#define STANDARD_RIGHTS_WRITE_ACCESS \ + (STD_RIGHT_WRITE_OWNER_ACCESS | \ + STD_RIGHT_WRITE_DAC_ACCESS | \ + STD_RIGHT_DELETE_ACCESS) /* 0x000d0000 */ #define STANDARD_RIGHTS_REQUIRED_ACCESS \ (STD_RIGHT_DELETE_ACCESS | \ STD_RIGHT_READ_CONTROL_ACCESS | \ diff --git a/source3/include/smb.h b/source3/include/smb.h index 913061014d..c894695378 100644 --- a/source3/include/smb.h +++ b/source3/include/smb.h @@ -1069,7 +1069,7 @@ struct bitmap { #define FILE_GENERIC_READ (STANDARD_RIGHTS_READ_ACCESS|FILE_READ_DATA|FILE_READ_ATTRIBUTES|\ FILE_READ_EA|SYNCHRONIZE_ACCESS) -#define FILE_GENERIC_WRITE (STANDARD_RIGHTS_WRITE_ACCESS|FILE_WRITE_DATA|FILE_WRITE_ATTRIBUTES|\ +#define FILE_GENERIC_WRITE (STD_RIGHT_READ_CONTROL_ACCESS|FILE_WRITE_DATA|FILE_WRITE_ATTRIBUTES|\ FILE_WRITE_EA|FILE_APPEND_DATA|SYNCHRONIZE_ACCESS) #define FILE_GENERIC_EXECUTE (STANDARD_RIGHTS_EXECUTE_ACCESS|\ diff --git a/source3/rpc_server/srv_lsa_nt.c b/source3/rpc_server/srv_lsa_nt.c index 13053d9877..da00d2d6c4 100644 --- a/source3/rpc_server/srv_lsa_nt.c +++ b/source3/rpc_server/srv_lsa_nt.c @@ -1134,16 +1134,21 @@ NTSTATUS _lsa_addprivs(pipes_struct *p, LSA_Q_ADDPRIVS *q_u, LSA_R_ADDPRIVS *r_u struct lsa_info *info = NULL; SE_PRIV mask; PRIVILEGE_SET *set = NULL; + struct current_user user; /* find the connection policy handle. */ if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info)) return NT_STATUS_INVALID_HANDLE; - /* check to see if the pipe_user is a Domain Admin since + /* check to see if the pipe_user is root or a Domain Admin since account_pol.tdb was already opened as root, this is all we have */ - - if ( !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) ) + + get_current_user( &user, p ); + if ( user.uid != sec_initial_uid() + && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) ) + { return NT_STATUS_ACCESS_DENIED; + } set = &q_u->set; @@ -1170,16 +1175,21 @@ NTSTATUS _lsa_removeprivs(pipes_struct *p, LSA_Q_REMOVEPRIVS *q_u, LSA_R_REMOVEP struct lsa_info *info = NULL; SE_PRIV mask; PRIVILEGE_SET *set = NULL; + struct current_user user; /* find the connection policy handle. */ if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info)) return NT_STATUS_INVALID_HANDLE; - /* check to see if the pipe_user is a Domain Admin since + /* check to see if the pipe_user is root or a Domain Admin since account_pol.tdb was already opened as root, this is all we have */ - - if ( !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) ) + + get_current_user( &user, p ); + if ( user.uid != sec_initial_uid() + && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) ) + { return NT_STATUS_ACCESS_DENIED; + } set = &q_u->set; diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c index 43abfdaafa..4d8e2b51cc 100644 --- a/source3/rpc_server/srv_samr_nt.c +++ b/source3/rpc_server/srv_samr_nt.c @@ -270,8 +270,8 @@ static NTSTATUS access_check_samr_object( SEC_DESC *psd, NT_USER_TOKEN *token, saved_mask = (des_access & rights_mask); des_access &= ~saved_mask; - DEBUG(4,("access_check_samr_object: user rights saved access mask [0x%x]\n", - saved_mask)); + DEBUG(4,("access_check_samr_object: user rights access mask [0x%x]\n", + rights_mask)); } @@ -296,9 +296,9 @@ static NTSTATUS access_check_samr_object( SEC_DESC *psd, NT_USER_TOKEN *token, done: /* add in any bits saved during the privilege check (only - matters is syayus is ok) */ + matters is status is ok) */ - *acc_granted |= saved_mask; + *acc_granted |= rights_mask; DEBUG(4,("%s: access %s (requested: 0x%08x, granted: 0x%08x)\n", debug, NT_STATUS_IS_OK(status) ? "GRANTED" : "DENIED", |