Changeset 228 for branches/samba-3.2.x/source/rpc_server/srv_lsa_nt.c

Timestamp:

May 26, 2009, 9:44:50 AM (17 years ago)

Author:

Herwig Bauernfeind

Message:

Update 3.2 branch to 3.2.6

File:

• branches/samba-3.2.x/source/rpc_server/srv_lsa_nt.c (modified) (8 diffs)

branches/samba-3.2.x/source/rpc_server/srv_lsa_nt.c

@@ -435 +435 @@
 
         if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status)) {
-                if (geteuid() != 0) {
+                if () {
                         return status;
                 }
@@ -1531 +1531 @@
            account_pol.tdb was already opened as root, this is all we have */
 
-        if ( !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
+        if ( p->pipe_user.ut.uid != sec_initial_uid()
+                && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
                 return NT_STATUS_ACCESS_DENIED;
 
@@ -1617 +1618 @@
                 return NT_STATUS_INVALID_HANDLE;
 
+
+
+
         if ( !get_privileges_for_sids( &mask, &info->sid, 1 ) )
                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
@@ -1677 +1681 @@
                 return NT_STATUS_INVALID_HANDLE;
 
+
+
+
         if (!lookup_sid(p->mem_ctx, &info->sid, NULL, NULL, NULL))
                 return NT_STATUS_ACCESS_DENIED;
@@ -1711 +1718 @@
            account_pol.tdb was already opened as root, this is all we have */
 
-        if ( !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
+        if ( p->pipe_user.ut.uid != sec_initial_uid()
+                && !nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS ) )
                 return NT_STATUS_ACCESS_DENIED;
 
@@ -1820 +1828 @@
         if (!(handle->access & LSA_POLICY_VIEW_LOCAL_INFORMATION))
                 return NT_STATUS_ACCESS_DENIED;
-
 
         switch (r->in.sec_info) {
@@ -2079 +2086 @@
                 return NT_STATUS_INVALID_HANDLE;
 
+
+
+
         /* according to an NT4 PDC, you can add privileges to SIDs even without
            call_lsa_create_account() first.  And you can use any arbitrary SID. */
@@ -2120 +2130 @@
         if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&info))
                 return NT_STATUS_INVALID_HANDLE;
+
+
+
 
         name = r->in.name->string;