r5203: additional changes for BUG 2291 to restrict who can join a BDC and add domain...

diff --git a/source/include/privileges.h b/source/include/privileges.h
index 76cabf3ba905a1df1095e5fc0c6e8e681eb3fab8..5266e46e3a3fee2e53bb743d927061696985e8ce 100644 (file)
--- a/source/include/privileges.h
+++ b/source/include/privileges.h
@@ -1,3 +1,4 @@
+
 /* 
    Unix SMB/CIFS implementation.
    SMB parameters and setup
@@ -59,6 +60,7 @@ typedef struct {
 
 /* defined in lib/privilegs.c */
 
+extern const SE_PRIV se_priv_none;
 extern const SE_PRIV se_machine_account;
 extern const SE_PRIV se_print_operator;
 extern const SE_PRIV se_add_users;

diff --git a/source/include/smb.h b/source/include/smb.h
index b8891fe90be5074e6267dceb72508b4346b3108d..ff645134109ad57a3a1834c35138caf34abf6c2a 100644 (file)
--- a/source/include/smb.h
+++ b/source/include/smb.h
@@ -226,7 +226,7 @@ typedef struct nttime_info
 #define ACB_MNS        0x0020  /* 1 = MNS logon user account */
 #define ACB_DOMTRUST   0x0040  /* 1 = Interdomain trust account */
 #define ACB_WSTRUST    0x0080  /* 1 = Workstation trust account */
-#define ACB_SVRTRUST   0x0100  /* 1 = Server trust account */
+#define ACB_SVRTRUST   0x0100  /* 1 = Server trust account (BDC) */
 #define ACB_PWNOEXP    0x0200  /* 1 = User password does not expire */
 #define ACB_AUTOLOCK   0x0400  /* 1 = Account auto locked */
  

diff --git a/source/lib/privileges.c b/source/lib/privileges.c
index 4feb730feebaa8597433521f18788e9bdfba8393..3960faecaa9a420af6ca28a26da4d7b7192702bc 100644 (file)
--- a/source/lib/privileges.c
+++ b/source/lib/privileges.c
@@ -29,11 +29,11 @@
 
 static SE_PRIV se_priv_all  = SE_ALL_PRIVS;
 static SE_PRIV se_priv_end  = SE_END;
-static SE_PRIV se_priv_none = SE_NONE;
 
 /* Define variables for all privileges so we can use the
    SE_PRIV* in the various se_priv_XXX() functions */
 
+const SE_PRIV se_priv_none       = SE_NONE;
 const SE_PRIV se_machine_account = SE_MACHINE_ACCOUNT;
 const SE_PRIV se_print_operator  = SE_PRINT_OPERATOR;
 const SE_PRIV se_add_users       = SE_ADD_USERS;

diff --git a/source/rpc_server/srv_samr_nt.c b/source/rpc_server/srv_samr_nt.c
index b58111c1b7ae25bd9cc2053bd3f979171010f21f..83da81044465ed4f52f3aa7d51625ebd02fd1ec5 100644 (file)
--- a/source/rpc_server/srv_samr_nt.c
+++ b/source/rpc_server/srv_samr_nt.c
@@ -2259,17 +2259,27 @@ NTSTATUS _samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_CREA
        pw = Get_Pwnam(account);
 
        /* determine which user right we need to check based on the acb_info */
-       if ( acb_info & (ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)) {
-               se_priv_copy( &se_rights, &se_machine_account );
+       
+       if ( (acb_info & ACB_WSTRUST) == ACB_WSTRUST ) 
+       {
                pstrcpy(add_script, lp_addmachine_script());
-       }
-       else {
-               se_priv_copy( &se_rights, &se_add_users );
+               se_priv_copy( &se_rights, &se_machine_account );
+               can_add_account = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
+       } 
+       else if ( (acb_info & ACB_WSTRUST) == ACB_NORMAL ) 
+       {
                pstrcpy(add_script, lp_adduser_script());
+               se_priv_copy( &se_rights, &se_add_users );
+               can_add_account = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
+       } 
+       else if ( ((acb_info & ACB_SVRTRUST) == ACB_SVRTRUST) ||  ((acb_info & ACB_DOMTRUST) == ACB_DOMTRUST) ) 
+       {
+               pstrcpy(add_script, lp_addmachine_script());
+               /* only Domain Admins can add a BDC or domain trust */
+               se_priv_copy( &se_rights, &se_priv_none );
+               can_add_account = nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS );
        }
-               
-       can_add_account = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
-
+       
        DEBUG(5, ("_samr_create_user: %s can add this account : %s\n",
                p->pipe_user_name, can_add_account ? "True":"False" ));
                

diff --git a/source/utils/net_rpc_join.c b/source/utils/net_rpc_join.c
index f1a41c7c99c8c50698d15cf9649e6c19f11f2ea6..ed196de6c1feed7bc4190ec845744d28135765d1 100644 (file)
--- a/source/utils/net_rpc_join.c
+++ b/source/utils/net_rpc_join.c
@@ -212,7 +212,7 @@ int net_rpc_join_newstyle(int argc, const char **argv)
 
        if (!NT_STATUS_IS_OK(result) && 
            !NT_STATUS_EQUAL(result, NT_STATUS_USER_EXISTS)) {
-               d_printf("Create of workstation account failed\n");
+               d_printf("Creation of workstation account failed\n");
 
                /* If NT_STATUS_ACCESS_DENIED then we have a valid
                   username/password combo but the user does not have