summaryrefslogtreecommitdiff
path: root/source3/rpc_server/srv_lsa.c
AgeCommit message (Collapse)AuthorFilesLines
2007-10-10r4746: add server support for lsa_enum_acct_rights(); last checkin for the nightGerald Carter1-0/+32
(This used to be commit ccdff4a998405544433aa32938963e4c37962fcc)
2007-10-10r4742: add server support for lsa_add/remove_account_rights() and fix some ↵Gerald Carter1-1/+65
parsing bugs related to that code (This used to be commit 7bf1312287cc1ec6b97917ba25fc60d6db09f26c)
2007-10-10r4724: Add support for Windows privileges in Samba 3.0Gerald Carter1-0/+32
(based on Simo's code in trunk). Rewritten with the following changes: * privilege set is based on a 32-bit mask instead of strings (plans are to extend this to a 64 or 128-bit mask before the next 3.0.11preX release). * Remove the privilege code from the passdb API (replication to come later) * Only support the minimum amount of privileges that make sense. * Rewrite the domain join checks to use the SeMachineAccountPrivilege instead of the 'is a member of "Domain Admins"?' check that started all this. Still todo: * Utilize the SePrintOperatorPrivilege in addition to the 'printer admin' parameter * Utilize the SeAddUserPrivilege for adding users and groups * Fix some of the hard coded _lsa_*() calls * Start work on enough of SAM replication to get privileges from one Samba DC to another. * Come up with some management tool for manipultaing privileges instead of user manager since it is buggy when run on a 2k client (haven't tried xp). Works ok on NT4. (This used to be commit 77c10ff9aa6414a31eece6dfec00793f190a9d6c)
2003-10-06split some security related functions in their own files.Simo Sorce1-1/+1
(no need to include all of smbd files to use some basic sec functions) also minor compile fixes couldn't compile to test these due to some kerberos problems wirh 3.0, but on HEAD they're working well, so I suppose it's ok to commit (This used to be commit c78f2d0bd15ecd2ba643bb141cc35a3405787aa1)
2003-08-14Attempt at fixing bug #283. There however is no solution.Gerald Carter1-14/+29
There is a workaround documented in the bug report. This patch does: * add server support for the LSA_DS UUID on the lsarpc pipe * store a list of context_ids/api_structs in the pipe_struct so that we don't have to lookup the function table for a pipe. We just match the context_id. Note that a dce/rpc alter_context does not destroy the previous context so it is possible to have multiple bindings active on the same pipe. Observed from standalone win2k sp4 client. * added server code for DsROleGetPrimaryDOmainInfo() but disabled it since it causes problems enumerating users and groups from a 2ksp4 domain member in a Samba domain. (This used to be commit 96bc2abfcb0dd0912696fad76e43cb217b33e061)
2003-08-01Update my copyrights according to my agreement with IBMJim McDonough1-1/+1
(This used to be commit a2bd8f0bfa12f2a1e33c96bc9dabcc0e2171700d)
2003-08-01Fix copyright statements for various pieces of Anthony Liguori's work.Jim McDonough1-2/+1
(This used to be commit 15d2bc47854df75f8b2644ccbc887d0357d9cd27)
2003-05-22fixes bugs 85 & 99 (XP domain logons); don't enable the lsa_query_info2 ↵Gerald Carter1-1/+13
unless we are trying to be an ADS DC (This used to be commit bf20976e5a993f4cfa05c1e0a9ecab2c7da99263)
2003-04-28Use NTSTATUS as return value for smb_register_*() functions and init_module()Jelmer Vernooij1-2/+2
function. Patch by metze with some minor modifications. (This used to be commit bc4b51bcb2daa7271c884cb83bf8bdba6d3a9b6d)
2003-04-15use the new modules system for the rpc modules (backport from HEAD)Jelmer Vernooij1-4/+0
(This used to be commit aca7319e8d45eb604f28b8bd490413b08e2c98f2)
2003-02-14merge from HEAD - enable dynamic RPC modulesJim McDonough1-10/+11
(This used to be commit d9c485b01017594d113502f9de2248d6c120cfa3)
2003-01-03Merge from HEAD - make Samba compile with -Wwrite-strings without additionalAndrew Bartlett1-1/+1
warnings. (Adds a lot of const). Andrew Bartlett (This used to be commit 3a7458f9472432ef12c43008414925fd1ce8ea0c)
2002-08-17Sync 3.0 branch with HEADJelmer Vernooij1-2/+35
(This used to be commit e01596853e3eea533baa08c33f26ded75f33fdd4)
2002-07-15updated the 3.0 branch from the head branch - ready for alpha18Andrew Tridgell1-0/+5
(This used to be commit 03ac082dcb375b6f3ca3d810a6a6367542bc23ce)
2002-01-30Removed version number from file header.Tim Potter1-2/+1
Changed "SMB/Netbios" to "SMB/CIFS" in file header. (This used to be commit 6a58c9bd06d0d7502a24bf5ce5a2faf0a146edfa)
2001-12-14add lsa_query_secobj server code. level 4 is the ACL, level 1 is theJean-François Micouleau1-0/+31
owner. that's basic stuff. got the POLICY_ define from TNG but they are also in an include file in the NT SDK. J.F. (This used to be commit 84289a9bf42847981926e198ad36c050904fa9ed)
2001-11-29Changed again how the privilege list is handled in the group mapping code.Jean-François Micouleau1-14/+111
This time it's a PRIVILEGE_SET struct instead of a simple uint32 array. It makes much more sense. Also added a uint32 systemaccount to the GROUP_MAP struct as some privilege showing in USRMGR.EXE are not real privs but a bitmask flag. I guess it's an heritage from NT 3.0 ! I could setup an NT 3.1 box to verify, but I'm too lazy (yes I still have my CDs). Added 3 more LSA calls: SetSystemAccount, AddPrivileges and RemovePrivileges, we can manage all this privilege from UserManager. Time to change the NT_USER_TOKEN struct and add checks in all the rpc functions. Fun, fun, fun. J.F. (This used to be commit 3f0a9ef2b8c626cfa2878394bb7b642342342bf3)
2001-10-02Removed 'extern int DEBUGLEVEL' as it is now in the smb.h header.Tim Potter1-2/+0
(This used to be commit 2d0922b0eabfdc0aaf1d0797482fef47ed7fde8e)
2001-07-09implement:Jean-François Micouleau1-0/+190
LSA_ENUM_PRIVS LSA_PRIV_GET_DISPNAME LSA_ENUM_ACCOUNTS LSA_OPENACCOUNT LSA_ENUMPRIVSACCOUNT LSA_GETSYSTEMACCOUNT It's a work in progress. nobody should expect it to work J.F. (This used to be commit 3056357cd8d4b2460f73ba8a8931a143f07fa2a6)
2001-06-29Added LsaGetConnectedCredentials patch from Manoj Naik <manoj@almaden.ibm.com>.Jeremy Allison1-0/+32
Jeremy. (This used to be commit 7079300da6dbd950e55dc5871851250d5a3717ff)
2001-03-11Merge of new 2.2 code into HEAD (Gerald I hate you :-) :-). Allows new SAMRJeremy Allison1-3/+0
RPC code to merge with new passdb code. Currently rpcclient doesn't compile. I'm working on it... Jeremy. (This used to be commit 0be41d5158ea4e645e93e8cd30617c038416e549)
2001-02-26Separated lsa code into interface and implementation.Jeremy Allison1-515/+58
Jeremy. (This used to be commit 1cc96e0340b9e3ac343d6a28211bf0cc5bc6573b)
2001-02-26Started conversion of lsa server code to canonical format (as srv_reg andJeremy Allison1-58/+93
srv_samr have been). Jeremy. (This used to be commit f434cda9774b4864321b37b0f8f42e6e8dee8d5b)
2001-02-13It compiles for me now :-). rpc_server/srv_lsa.c - added fix to allow w2kJeremy Allison1-4/+13
clients to join a Samba domain - odd or even domain name length. Needs more testing. Jeremy. (This used to be commit 408672d38261e34cc3714200617b35464d88f931)
2001-01-25Fixed "object picker can't determine if object in domain" bug seen from W2KJeremy Allison1-17/+44
clients. Did this by importing Samba-TNG code that correctly handles LSA lookups. *MANY* thanks to Luke, Sander, Elrond and the rest of the TNG gang ! Jeremy (This used to be commit f76dc952f70862a6a390e9f35edd651867842a01)
2001-01-15Changes from APPLIANCE_HEAD:David O'Neill1-3/+3
source/rpc_parse/parse_lsa.c - off by one unistr length bug in init_lsa_trans_name() source/lib/util_sid.c - resolve more BUILTIN sid values to names. source/nsswitch/wb_client.c - fix typo in debug message - set errno on error so we don't get bogus value from last failure. source/rpc_server/srv_spoolss_nt.c - add debug to track number of open printer handles for ease of tracking handle leaks in the future. source/rpc_server/srv_lsa.c - fix off-by-one string bug. This was preventing NT from displaying names for well-know SIDs in printer permissions dialog. (This used to be commit 59229b9025cff54cbdd05e374616ffbf9c6fee33)
2000-12-15Never free anything in the rpc_parse/prs_XXX functions. Do it in the enclosingJeremy Allison1-11/+16
function. lib/util_unistr.c: Check lengths *before* reading source - prevent uninitialised memory reads. Jeremy. (This used to be commit ce4f461965c872fbfc9fe5f6b98aed58bb3dd67a)
2000-12-15lib/util_unistr.c:Jean-François Micouleau1-1/+1
rewrote unistr2_to_ascii() to correct a bug seen on SGI boxes. rpc_parse/parse_misc.c: rpc_parse/parse_prs.c: rewrote of BUFFER5 handling to NOT byteswap when it was already in network byte order. rpc_parse/parse_samr.c: cleanup of samr_io_q_lookup_domain(), remove the over-parsing by 2 bytes. rpc_server/srv_lsa.c: UNISTR2 strings need to be NULL terminated to pleased W2K. rpc_server/srv_spoolss_nt.c: use snprintf instead of safe_strcpy as we want the string truncated at 32 chars. That should fix SUN and SGI box not able to act as printserver and the problem with joining from a W2K wks. J.F. (This used to be commit 69fe739303b105f2c488f266f13977da1b6b201d)
2000-12-15Fixed memory leaks in lsa_XX calls. Fixed memory leaks in smbcacls. MergedJeremy Allison1-19/+1
in fixes from appliance-head and 2.2. Fixed multiple connection.tdb open problem. Jeremy. (This used to be commit 0a40bc83e14c69a09948ec09bb6fc5026c4f4c14)
2000-12-13Server side changes for dynamic names in lsa_lookup_namesTim Potter1-5/+10
(This used to be commit 5c5c3a8a08efe8c2f36a55b1383e9d3dd9eca4a5)
2000-12-12Merged in Tim's changes : Removed static limit of MAX_LOOKUP_SIDS in rpc ↵Jeremy Allison1-7/+35
server and client lsa_lookup_names() and lsa_lookup_sids(). Jeremy. (This used to be commit 9e9c71c8b3194b7cd02fea0b6a000d4f2940d905)
2000-11-13Tims fixes for non-local lookup.Jeremy Allison1-23/+22
Jeremy. (This used to be commit 38e04c43cc2ce8479b8cc3ff0f87d3d150d9af83)
2000-10-25Removed erroneous +1's on length of unicode domain names for variousTim Potter1-2/+2
functions in the \\lsarpc pipe. (This used to be commit 30bb3f2df97662c6547c7994ce50efe9abf37968)
2000-10-13last part of W2K support.Jean-François Micouleau1-2/+2
the trust domain list reply on netlogon pipe was wrong, interim hack until we have full trust relationships. changed some unistr2 to parse the ending NULL char. added a prs_align_needed() function. much like a prs_align but with a condition. needed for the unistr2 parsing. J.F. (This used to be commit d8bf81553c17d9ee3419d8150b96119ebb0b8fa9)
2000-10-04Adding Herb's compile warning fixes to HEAD.Jeremy Allison1-1/+1
Jeremy. (This used to be commit d131ad1ce3f6e72e295f865a463f8dcbfa6f8d42)
2000-09-01Changes from APPLIANCE_HEAD (per Tim Potter):David O'Neill1-2/+2
- make proto - addition of function to convert from errno values to NT status codes (source/lib/error.c) - purge queue done without full access permission will purge only the jobs owned by that user, rather than failing. - unlock job database tdb before sending job to printer - in print_job_start(), ensure that we don't pick a jobid with an existing temporary file that may be owned by another user, as it causes silent failures. - fixes for printer permission checking for NT5 clients (source/include/rpc_spoolss.h, source/printing/nt_printing.c, source/printing/printing.c, source/rpc_server/srv_spoolss_nt.c) - change from uint8 to 'enum SID_NAME_USE' (source/rpc_server/srv_lsa.c) - fixed memory leaks for win95 driver download process (source/smbd/lanman.c) - properly free prs_structs and dacl in testsuite/printing/psec.c (This used to be commit 74af3e2caec7197e5d1ca389e2f78054a4197502)
2000-08-10Tidied up security rights definitions.Jeremy Allison1-2/+1
Jeremy. (This used to be commit e466c863f5540e13776f4477b6d58e3fbfe7276d)
2000-08-02Started to canonicalize our handling of uid -> sid code in order toJeremy Allison1-1/+1
get ready and fix se_access_check(). Added cannonical lookup_name(), lookup_sid(), uid_to_sid(), gid_to_sid() functions that look via winbind first the fall back on local lookup. All Samba should use these rather than trying to call winbindd code directly. Added NT_USER_TOKEN struct in user_struct, contains list of NT sids associated with this user. se_access_check() should use this (cached) value rather than attempting to do the same thing itself when given a uid/gid pair. More work needs to be done to preserve these things accross security context changes (especially with the tricky pipe problem) but I'm beginning to see how this will be done..... probably by registering a new vuid for an authenticated RPC pipe and not treating the pipe calls specially. More thoughts needed - but we're almost there... Jeremy. (This used to be commit 5e5cc6efe2e4687be59085f562caea1e2e05d0a8)
2000-07-10Moved winbind client functions from various odd locations toTim Potter1-59/+0
nsswitch/wb_client.c Merge of nsswitch/common.c rename to nsswitch/wb_common.c from TNG. (This used to be commit f866c18f6be65db67d9d2a6c0b42e1af3b421e6c)
2000-07-06Changed checking for WINBINDD_OK return value instead of NSS_STATUS_SUCCESSTim Potter1-3/+3
when looking up sids from winbindd. (This used to be commit 79fb877bf13ba462ad0a878d8975f8b5183e3ea3)
2000-07-03Renamed generic_request() to winbindd_request()Tim Potter1-1/+1
(This used to be commit d9041958558fc8e3c7b0491eb0f7e45bee9d19c5)
2000-06-26Fixed display of "Everyone" in SD's.Jeremy Allison1-1/+5
Jeremy. (This used to be commit 3c7fdaa576c09dab2e4de78ed353b1fa1d65a40d)
2000-06-24lib/util_sid.c: Uninitialized memory read.Jeremy Allison1-0/+5
rpc_parse/parse_spoolss.c: Added note about prs_align when marshalling a SEC_DESC... rpc_server/srv_lsa.c: Tim - your changes broke the display of the 'everyone' group when doing file access with no winbindd running. This is a partial fix - more when I have analysed this more. rpc_server/srv_spoolss_nt.c: Fix for the 'change driver' problem ! Hurrah ! Jeremy. (This used to be commit 151b131ee01ef916c072bcdaa9943a2e984a0f45)
2000-06-23Got a bit carried away deleting things.Tim Potter1-1/+1
(This used to be commit 211391d88e10d94edcc81b83fefcadb4a905ea56)
2000-06-23Removed unused variables.Tim Potter1-2/+0
(This used to be commit a75e738211e744adb966bcbc24371554c9642220)
2000-06-16Simplified server pipe implementation by changing arguments passed downTim Potter1-12/+32
through to the individual pipe api calls. Instead of passing two prs_struct pointers, we now pass the pipes_struct pointer which contains the former information as well as other useful stuff like the vuid. (This used to be commit 96addba216bad2189120d78f5531d5caa6f37880)
2000-06-15Removed some debugs.Tim Potter1-12/+0
(This used to be commit 6faa963b232b4c4d883c1b346c73b2f2b6da6370)
2000-06-14Changed server side lsa_lookup_sids function to look up SIDs that we areTim Potter1-28/+74
not authoritative for using winbindd. (This used to be commit a39cdffb141a8e4188b00dfb6eb3317f134cddda)
2000-05-29Fixed LsaQueryInformationPolicy level 3 to return primary domain info.Matthew Chapman1-19/+23
Domain SID is saved in secrets.tdb upon joining domain. Added "Authenticated Users" and "SYSTEM" well-known SIDs (under NT Authority). (This used to be commit 7710b4f48d3e8532df5e37f99a779758f750efdb)
2000-05-10more merging voodooAndrew Tridgell1-0/+3
this adds "#define OLD_NTDOMAIN 1" in lots of places. Don't panic - this isn't permanent, it should go after another few merge steps have been done (This used to be commit 92109d7b3c06f240452d39f669ecb8c9c86ab610)
generated by cgit (git 2.34.1) at 2024-12-15 12:11:58 +0000