The branch, master has been updated
via 5adb3b884130d6d292a4e25e3b32c50bc884dbf9 (commit)
from 2b784738d7ce444fb63e2cac91ad2e220cc6e551 (commit)
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 5adb3b884130d6d292a4e25e3b32c50bc884dbf9
Author: Jeremy Allison <[email protected]>
Date: Fri May 15 13:36:43 2009 -0700
Add extra abilities for a user with SeAddUsers, so they
can manipulate groups and aliases.
Jeremy.
-----------------------------------------------------------------------
Summary of changes:
source3/rpc_server/srv_samr_nt.c | 17 +++++++++++++++--
1 files changed, 15 insertions(+), 2 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c
index 8b1a90a..f1725e2 100644
--- a/source3/rpc_server/srv_samr_nt.c
+++ b/source3/rpc_server/srv_samr_nt.c
@@ -537,6 +537,7 @@ NTSTATUS _samr_OpenDomain(pipes_struct *p,
uint32 des_access = r->in.access_mask;
NTSTATUS status;
size_t sd_size;
+ uint32_t extra_access = SAMR_DOMAIN_ACCESS_CREATE_USER;
SE_PRIV se_rights;
/* find the connection policy handle. */
@@ -555,13 +556,25 @@ NTSTATUS _samr_OpenDomain(pipes_struct *p,
/*
* Users with SeMachineAccount or SeAddUser get additional
- * SAMR_DOMAIN_ACCESS_CREATE_USER access, but no more.
+ * SAMR_DOMAIN_ACCESS_CREATE_USER access.
*/
se_priv_copy( &se_rights, &se_machine_account );
se_priv_add( &se_rights, &se_add_users );
+ /*
+ * Users with SeAddUser get the ability to manipulate groups
+ * and aliases.
+ */
+ if (user_has_any_privilege(p->server_info->ptok, &se_add_users)) {
+ extra_access |= (SAMR_DOMAIN_ACCESS_CREATE_GROUP |
+ SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS |
+ SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT |
+ SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS |
+ SAMR_DOMAIN_ACCESS_CREATE_ALIAS);
+ }
+
status = access_check_samr_object( psd, p->server_info->ptok,
- &se_rights, SAMR_DOMAIN_ACCESS_CREATE_USER, des_access,
+ &se_rights, extra_access, des_access,
&acc_granted, "_samr_OpenDomain" );
if ( !NT_STATUS_IS_OK(status) )
--
Samba Shared Repository
