From b784c20df8fcafc3a5c66f847b1af58b77eeb42b Mon Sep 17 00:00:00 2001 From: Michael Adam Date: Mon, 21 Jun 2010 12:32:57 +0200 Subject: s3:net rpc registry: make getsd succeed when key sd only gives access to SD not key contents You don't need the REG_KEY_READ permissions to access the SD of a key. And for instance, the key HKLM\security ususally has no specific bits set for builtin\administrators, but the READ_CONTROL_ACCESS. I.e. builtin\administrators can get the sd but not enumerate the key. --- source3/utils/net_rpc_registry.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/source3/utils/net_rpc_registry.c b/source3/utils/net_rpc_registry.c index 59971af3a3..fb1e14f0d5 100644 --- a/source3/utils/net_rpc_registry.c +++ b/source3/utils/net_rpc_registry.c @@ -1208,8 +1208,7 @@ static NTSTATUS rpc_registry_getsd_internal(struct net_context *c, uint32_t sec_info; DATA_BLOB blob; struct security_descriptor sec_desc; - uint32_t access_mask = REG_KEY_READ | - SEC_FLAG_MAXIMUM_ALLOWED | + uint32_t access_mask = SEC_FLAG_MAXIMUM_ALLOWED | SEC_FLAG_SYSTEM_SECURITY; if (argc <1 || argc > 2 || c->display_usage) { -- cgit