LSA Functions

データ構造
struct	LsaOpenPolicy
struct	LsaGetNamesFromSids
struct	LsaGetSidsFromNames
struct	LsaFetchSid
struct	LsaQueryInfoPolicy
struct	LsaEnumSids
struct	LsaEnumAccountRights
struct	LsaEnumTrustedDomains
struct	LsaOpenTrustedDomain
struct	LsaQueryTrustedDomainInfo
struct	LsaEnumPrivileges
struct	LsaOpenAccount
struct	LsaAddPrivileges
struct	LsaRemovePrivileges
struct	LsaClearPrivileges
struct	LsaGetSecurityObject
関数
int	cac_LsaOpenPolicy (CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaOpenPolicy *op)
	Opens a policy handle on a remote machine.
int	cac_LsaClosePolicy (CacServerHandle *hnd, TALLOC_CTX *mem_ctx, POLICY_HND *pol)
	Closes an LSA policy handle (Retrieved using cac_LsaOpenPolicy).
int	cac_LsaGetNamesFromSids (CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaGetNamesFromSids *op)
	Looks up the names for a list of SIDS
int	cac_LsaGetSidsFromNames (CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaGetSidsFromNames *op)
	Looks up the SIDs for a list of names
int	cac_LsaFetchSid (CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaFetchSid *op)
	Looks up the domain or local sid of a machine with an open LSA policy handle
int	cac_LsaQueryInfoPolicy (CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaQueryInfoPolicy *op)
	Retrieves information about the LSA machine/domain
int	cac_LsaEnumSids (CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaEnumSids *op)
	Enumerates the SIDs in the LSA.
int	cac_LsaEnumAccountRights (CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaEnumAccountRights *op)
	Enumerates rights assigned to a given account.
int	cac_LsaEnumTrustedDomains (CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaEnumTrustedDomains *op)
	Enumerates the trusted domains in the LSA.
int	cac_LsaOpenTrustedDomain (CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaOpenTrustedDomain *op)
	Opens a trusted domain by SID.
int	cac_LsaQueryTrustedDomainInfo (CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaQueryTrustedDomainInfo *op)
	Retrieves information a trusted domain.
int	cac_LsaEnumPrivileges (CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaEnumPrivileges *op)
	Enumerates the Privileges supported by the LSA.
int	cac_LsaOpenAccount (CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaOpenAccount *op)
	Opens a handle to an account in the LSA
int	cac_LsaAddPrivileges (CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaAddPrivileges *op)
	Adds Privileges an account.
int	cac_LsaRemovePrivileges (CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaRemovePrivileges *op)
	Removes a _specific_ set of privileges from an account
int	cac_LsaClearPrivileges (CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaClearPrivileges *op)
	Removes ALL privileges from an account
int	cac_LsaSetPrivileges (CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaAddPrivileges *op)
	Sets an accounts priviliges.
int	cac_LsaGetSecurityObject (CacServerHandle *hnd, TALLOC_CTX *mem_ctx, struct LsaGetSecurityObject *op)
	Retrieves Security Descriptor information about the LSA

---

関数

int cac_LsaOpenPolicy	(	CacServerHandle *	hnd,
		TALLOC_CTX *	mem_ctx,
		struct LsaOpenPolicy *	op
	)

Opens a policy handle on a remote machine.

引数:

	hnd	fully initialized CacServerHandle for remote machine
	mem_ctx	Talloc context for memory allocation
	op	Initialized parameters

戻り値:

CAC_FAILURE if the policy could not be opened. hnd->status set with appropriate NTSTATUS

CAC_SUCCESS if the policy could be opened, the policy handle can be found

cac_lsarpc.c の 25 行で定義されています。

参照先 _CACSERVERHANDLE::_internal・LsaOpenPolicy::access・cac_GetPipe()・cac_GetServer()・_SMBCSRV::cli・cli_rpc_pipe_open_noauth()・CacServerHandleInternal::ctx・errno・LsaOpenPolicy::in・LsaOpenPolicy::out・CacServerHandleInternal::pipes・LsaOpenPolicy::pol・rpccli_lsa_open_policy()・rpccli_lsa_open_policy2()・LsaOpenPolicy::security_qos・CacServerHandleInternal::srv_level・_CACSERVERHANDLE::status.

参照元 cac_get_domain_sid().

{
        SMBCSRV *srv = NULL;
        POLICY_HND *policy = NULL;
        struct rpc_pipe_client *pipe_hnd = NULL;

        if ( !hnd )
                return CAC_FAILURE;

        if ( !hnd->_internal.ctx ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( !mem_ctx || !op ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        op->out.pol = NULL;

        srv = cac_GetServer( hnd );
        if ( !srv ) {
                hnd->status = NT_STATUS_INVALID_CONNECTION;
                return CAC_FAILURE;
        }

        /*see if there is already an active session on this pipe, if not then open one */
        if ( !hnd->_internal.pipes[PI_LSARPC] ) {
                pipe_hnd =
                        cli_rpc_pipe_open_noauth( srv->cli, PI_LSARPC,
                                                  &hnd->status );

                if ( !pipe_hnd ) {
                        hnd->status = NT_STATUS_UNSUCCESSFUL;
                        return CAC_FAILURE;
                }

                hnd->_internal.pipes[PI_LSARPC] = True;
        }

        pipe_hnd = cac_GetPipe( hnd, PI_LSARPC );
        if ( !pipe_hnd ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        policy = TALLOC_P( mem_ctx, POLICY_HND );
        if ( !policy ) {
                errno = ENOMEM;
                hnd->status = NT_STATUS_NO_MEMORY;
                return CAC_FAILURE;
        }

        /*need to make sure that our nt status is good otherwise check might fail below */
        hnd->status = NT_STATUS_OK;

        if ( hnd->_internal.srv_level >= SRV_WIN_2K ) {

                /*try using open_policy2, if this fails try again in next block using open_policy, if that works then adjust hnd->_internal.srv_level */

                /*we shouldn't need to modify the access mask to make it work here */
                hnd->status =
                        rpccli_lsa_open_policy2( pipe_hnd, mem_ctx,
                                                 op->in.security_qos,
                                                 op->in.access, policy );

        }

        if ( hnd->_internal.srv_level < SRV_WIN_2K
             || !NT_STATUS_IS_OK( hnd->status ) ) {
                hnd->status =
                        rpccli_lsa_open_policy( pipe_hnd, mem_ctx,
                                                op->in.security_qos,
                                                op->in.access, policy );

                if ( hnd->_internal.srv_level > SRV_WIN_NT4
                     && NT_STATUS_IS_OK( hnd->status ) ) {
                        /*change the server level to 1 */
                        hnd->_internal.srv_level = SRV_WIN_NT4;
                }

        }

        if ( !NT_STATUS_IS_OK( hnd->status ) ) {
                return CAC_FAILURE;
        }

        op->out.pol = policy;

        return CAC_SUCCESS;
}

int cac_LsaClosePolicy	(	CacServerHandle *	hnd,
		TALLOC_CTX *	mem_ctx,
		POLICY_HND *	pol
	)

Closes an LSA policy handle (Retrieved using cac_LsaOpenPolicy).

If successful, the handle will be closed on the server, and memory for pol will be freed

引数:

	hnd	- An initialized and connected server handle
	mem_ctx	Talloc context for memory allocation
	pol	- the policy handle to close

戻り値:

CAC_FAILURE could not close the policy handle, hnd->status is set to the appropriate NTSTATUS error code

CAC_SUCCESS the policy handle was closed

cac_lsarpc.c の 119 行で定義されています。

参照先 _CACSERVERHANDLE::_internal・cac_GetPipe()・CacServerHandleInternal::ctx・CacServerHandleInternal::pipes・pol・rpccli_lsa_close()・_CACSERVERHANDLE::status.

参照元 cac_get_domain_sid().

{

        struct rpc_pipe_client *pipe_hnd = NULL;

        if ( !hnd )
                return CAC_FAILURE;

        if ( !pol )
                return CAC_SUCCESS;     /*if the policy handle doesnt exist then it's already closed */

        if ( !hnd->_internal.ctx || !hnd->_internal.pipes[PI_LSARPC] ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        pipe_hnd = cac_GetPipe( hnd, PI_LSARPC );
        if ( !pipe_hnd ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        hnd->status = rpccli_lsa_close( pipe_hnd, mem_ctx, pol );

        TALLOC_FREE( pol );

        if ( !NT_STATUS_IS_OK( hnd->status ) )
                return CAC_FAILURE;

        return CAC_SUCCESS;
}

int cac_LsaGetNamesFromSids	(	CacServerHandle *	hnd,
		TALLOC_CTX *	mem_ctx,
		struct LsaGetNamesFromSids *	op
	)

Looks up the names for a list of SIDS

引数:

	hnd	initialized and connected server handle
	mem_ctx	Talloc context for memory allocation
	op	input and output parameters

戻り値:

CAC_FAILURE none of the SIDs could be looked up hnd->status is set with appropriate NTSTATUS error code

CAC_SUCCESS all of the SIDs were translated and a list of names has been output

CAC_PARTIAL_SUCCESS not all of the SIDs were translated, as a result the number of returned names is less than the original list of SIDs

cac_lsarpc.c の 152 行で定義されています。

参照先 _CACSERVERHANDLE::_internal・cac_GetPipe()・CacServerHandleInternal::ctx・_CACSIDINFO::domain・errno・LsaGetNamesFromSids::in・_CACSIDINFO::name・LsaGetNamesFromSids::num_found・LsaGetNamesFromSids::num_sids・LsaGetNamesFromSids::out・CacServerHandleInternal::pipes・LsaGetNamesFromSids::pol・result・rpccli_lsa_lookup_sids()・LsaGetNamesFromSids::sids・_CACSERVERHANDLE::status・LsaGetNamesFromSids::unknown.

{
        struct rpc_pipe_client *pipe_hnd = NULL;

        int result = -1;

        int i;

        /*buffers for outputs */
        char **domains = NULL;
        char **names = NULL;
        enum lsa_SidType *types = NULL;

        CacSidInfo *sids_out = NULL;
        DOM_SID *unknown_out = NULL;
        int num_unknown = 0;

        int num_sids;

        int found_idx;
        int unknown_idx;

        if ( !hnd )
                return CAC_FAILURE;

        if ( !hnd->_internal.ctx || !hnd->_internal.pipes[PI_LSARPC] ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( !mem_ctx || !op || !op->in.pol || !op->in.sids ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        num_sids = op->in.num_sids;

        pipe_hnd = cac_GetPipe( hnd, PI_LSARPC );
        if ( !pipe_hnd ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }



        /*now actually lookup the names */
        hnd->status =
                rpccli_lsa_lookup_sids( pipe_hnd, mem_ctx, op->in.pol,
                                        op->in.num_sids, op->in.sids,
                                        &domains, &names, &types );

        if ( NT_STATUS_IS_OK( hnd->status ) ) {
                /*this is the easy part, just make the out.sids array */
                if (num_sids) {
                        sids_out = TALLOC_ARRAY( mem_ctx, CacSidInfo, num_sids );
                        if ( !sids_out ) {
                                errno = ENOMEM;
                                hnd->status = NT_STATUS_NO_MEMORY;
                                return CAC_FAILURE;
                        }
                } else {
                        sids_out = NULL;
                }

                for ( i = 0; i < num_sids; i++ ) {
                        sids_out[i].sid = op->in.sids[i];
                        sids_out[i].name = names[i];
                        sids_out[i].domain = domains[i];
                }

                result = CAC_SUCCESS;
        } else if ( NT_STATUS_V( hnd->status ) ==
                    NT_STATUS_V( STATUS_SOME_UNMAPPED ) ) {
                /*first find out how many couldn't be looked up */

                for ( i = 0; i < num_sids; i++ ) {
                        if ( names[i] == NULL ) {
                                num_unknown++;
                        }
                }

                if ( num_unknown >= num_sids ) {
                        hnd->status = NT_STATUS_UNSUCCESSFUL;
                        return CAC_FAILURE;
                }

                if ( num_sids - num_unknown) {
                        sids_out =
                                TALLOC_ARRAY( mem_ctx, CacSidInfo,
                                      ( num_sids - num_unknown ) );
                        if ( !sids_out ) {
                                errno = ENOMEM;
                                hnd->status = NT_STATUS_NO_MEMORY;
                                return CAC_FAILURE;
                        }
                } else {
                        sids_out = NULL;
                }

                if (num_unknown) {
                        unknown_out = TALLOC_ARRAY( mem_ctx, DOM_SID, num_unknown );
                        if ( !unknown_out ) {
                                errno = ENOMEM;
                                hnd->status = NT_STATUS_NO_MEMORY;
                                return CAC_FAILURE;
                        }
                } else {
                        unknown_out = NULL;
                }
                found_idx = unknown_idx = 0;

                /*now we can actually do the real work */
                for ( i = 0; i < num_sids; i++ ) {
                        if ( names[i] != NULL ) {
                                sids_out[found_idx].sid = op->in.sids[i];
                                sids_out[found_idx].name = names[i];
                                sids_out[found_idx].domain = domains[i];

                                found_idx++;
                        } else {        /*then this one didnt work out */
                                unknown_out[unknown_idx] = op->in.sids[i];

                                unknown_idx++;
                        }
                }

                result = CAC_PARTIAL_SUCCESS;
        } else {                /*then it failed for some reason */
                return CAC_FAILURE;
        }

        op->out.num_found = num_sids - num_unknown;
        op->out.sids = sids_out;
        op->out.unknown = unknown_out;

        return result;

}

int cac_LsaGetSidsFromNames	(	CacServerHandle *	hnd,
		TALLOC_CTX *	mem_ctx,
		struct LsaGetSidsFromNames *	op
	)

Looks up the SIDs for a list of names

引数:

	hnd	initialized and connected server handle
	mem_ctx	Talloc context for memory allocation
	op	input and output parameters

戻り値:

CAC_FAILURE none of the SIDs could be looked up hnd->status is set with appropriate NTSTATUS error code

CAC_SUCCESS all of the SIDs were translated and a list of names has been output

CAC_PARTIAL_SUCCESS not all of the SIDs were translated, as a result the number of returned names is less than the original list of SIDs

cac_lsarpc.c の 292 行で定義されています。

参照先 _CACSERVERHANDLE::_internal・cac_GetPipe()・CacServerHandleInternal::ctx・_CACSIDINFO::domain・errno・LsaGetSidsFromNames::in・_CACSIDINFO::name・LsaGetSidsFromNames::names・LsaGetSidsFromNames::num_found・LsaGetSidsFromNames::num_names・LsaGetSidsFromNames::out・CacServerHandleInternal::pipes・LsaGetSidsFromNames::pol・result・rpccli_lsa_lookup_names()・SID_NAME_UNKNOWN・LsaGetSidsFromNames::sids・_CACSERVERHANDLE::status・talloc_strdup()・LsaGetSidsFromNames::unknown.

{
        struct rpc_pipe_client *pipe_hnd = NULL;
        int result = -1;

        int i;

        /*buffers for outputs */
        DOM_SID *sids = NULL;
        enum lsa_SidType *types = NULL;

        CacSidInfo *sids_out = NULL;
        char **unknown_out = NULL;
        int num_unknown = 0;

        int num_names;

        int found_idx = 0;
        int unknown_idx = 0;

        if ( !hnd )
                return CAC_FAILURE;

        if ( !hnd->_internal.ctx || !hnd->_internal.pipes[PI_LSARPC] ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( !mem_ctx || !op || !op->in.pol || !op->in.names ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        num_names = op->in.num_names;

        pipe_hnd = cac_GetPipe( hnd, PI_LSARPC );
        if ( !pipe_hnd ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }


        /*now actually lookup the names */
        hnd->status =
                rpccli_lsa_lookup_names( pipe_hnd, mem_ctx, op->in.pol,
                                         num_names,
                                         ( const char ** ) op->in.names, NULL,
                                         &sids, &types );

        if ( NT_STATUS_IS_OK( hnd->status ) ) {
                /*this is the easy part, just make the out.sids array */
                if (num_names) {
                        sids_out = TALLOC_ARRAY( mem_ctx, CacSidInfo, num_names );
                        if ( !sids_out ) {
                                errno = ENOMEM;
                                hnd->status = NT_STATUS_NO_MEMORY;
                                return CAC_FAILURE;
                        }
                } else {
                        sids_out = NULL;
                }

                for ( i = 0; i < num_names; i++ ) {
                        sids_out[i].sid = sids[i];
                        sids_out[i].name =
                                talloc_strdup( mem_ctx, op->in.names[i] );
                        sids_out[i].domain = NULL;
                }

                result = CAC_SUCCESS;
        } else if ( NT_STATUS_V( hnd->status ) ==
                    NT_STATUS_V( STATUS_SOME_UNMAPPED ) ) {
                /*first find out how many couldn't be looked up */

                for ( i = 0; i < num_names; i++ ) {
                        if ( types[i] == SID_NAME_UNKNOWN ) {
                                num_unknown++;
                        }
                }

                if ( num_unknown >= num_names ) {
                        hnd->status = NT_STATUS_UNSUCCESSFUL;
                        return CAC_FAILURE;
                }

                if (num_names - num_unknown) {
                        sids_out =
                                TALLOC_ARRAY( mem_ctx, CacSidInfo,
                                      ( num_names - num_unknown ) );
                        if ( !sids_out ) {
                                errno = ENOMEM;
                                hnd->status = NT_STATUS_NO_MEMORY;
                                return CAC_FAILURE;
                        }
                } else {
                        sids_out = NULL;
                }

                if (num_unknown) {
                        unknown_out = TALLOC_ARRAY( mem_ctx, char *, num_unknown );
                        if ( !unknown_out ) {
                                errno = ENOMEM;
                                hnd->status = NT_STATUS_NO_MEMORY;
                                return CAC_FAILURE;
                        }
                } else {
                        unknown_out = NULL;
                }

                unknown_idx = found_idx = 0;

                /*now we can actually do the real work */
                for ( i = 0; i < num_names; i++ ) {
                        if ( types[i] != SID_NAME_UNKNOWN ) {
                                sids_out[found_idx].sid = sids[i];
                                sids_out[found_idx].name =
                                        talloc_strdup( mem_ctx,
                                                       op->in.names[i] );
                                sids_out[found_idx].domain = NULL;

                                found_idx++;
                        } else {        /*then this one didnt work out */
                                unknown_out[unknown_idx] =
                                        talloc_strdup( mem_ctx,
                                                       op->in.names[i] );

                                unknown_idx++;
                        }
                }

                result = CAC_PARTIAL_SUCCESS;
        } else {                /*then it failed for some reason */
                return CAC_FAILURE;
        }

        op->out.num_found = num_names - num_unknown;
        op->out.sids = sids_out;
        op->out.unknown = unknown_out;

        return result;

}

int cac_LsaFetchSid	(	CacServerHandle *	hnd,
		TALLOC_CTX *	mem_ctx,
		struct LsaFetchSid *	op
	)

Looks up the domain or local sid of a machine with an open LSA policy handle

引数:

	hnd	initialized and connected server handle
	mem_ctx	Talloc context for memory allocation
	op	input and output parameters

戻り値:

CAC_FAILURE if the SID could not be fetched

CAC_SUCCESS if the SID was fetched

CAC_PARTIAL_SUCCESS if you asked for both local and domain sids but only one was returned

cac_lsarpc.c の 436 行で定義されています。

参照先 _CACSERVERHANDLE::_internal・cac_GetPipe()・CacServerHandleInternal::ctx・rpc_pipe_client::domain・_CACSIDINFO::domain・LsaFetchSid::domain_sid・domain_sid・LsaFetchSid::in・LsaFetchSid::info_class・LsaFetchSid::local_sid・LsaFetchSid::out・CacServerHandleInternal::pipes・LsaFetchSid::pol・result・rpccli_lsa_query_info_policy()・_CACSIDINFO::sid・sid_copy()・_CACSERVERHANDLE::status.

参照元 cac_get_domain_sid().

{
        struct rpc_pipe_client *pipe_hnd = NULL;
        int result = -1;

        if ( !hnd )
                return CAC_FAILURE;

        if ( !hnd->_internal.ctx || !hnd->_internal.pipes[PI_LSARPC] ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( !mem_ctx || !op || !op->in.pol ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        pipe_hnd = cac_GetPipe( hnd, PI_LSARPC );
        if ( !pipe_hnd ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        op->out.local_sid = NULL;
        op->out.domain_sid = NULL;

        if ( ( op->in.info_class & CAC_LOCAL_INFO ) == CAC_LOCAL_INFO ) {
                DOM_SID *local_sid = NULL;
                char *dom_name = NULL;

                hnd->status =
                        rpccli_lsa_query_info_policy( pipe_hnd, mem_ctx,
                                                      op->in.pol,
                                                      CAC_LOCAL_INFO,
                                                      &dom_name, &local_sid );

                if ( !NT_STATUS_IS_OK( hnd->status ) ) {
                        result = CAC_FAILURE;
                        goto domain;
                }

                op->out.local_sid = talloc( mem_ctx, CacSidInfo );
                if ( !op->out.local_sid ) {
                        hnd->status = NT_STATUS_NO_MEMORY;
                        result = CAC_FAILURE;
                        goto domain;
                }

                op->out.local_sid->domain = dom_name;

                sid_copy( &op->out.local_sid->sid, local_sid );
                TALLOC_FREE( local_sid );
        }

      domain:

        if ( ( op->in.info_class & CAC_DOMAIN_INFO ) == CAC_DOMAIN_INFO ) {
                DOM_SID *domain_sid;
                char *dom_name;

                hnd->status =
                        rpccli_lsa_query_info_policy( pipe_hnd, mem_ctx,
                                                      op->in.pol,
                                                      CAC_DOMAIN_INFO,
                                                      &dom_name,
                                                      &domain_sid );
                if ( !NT_STATUS_IS_OK( hnd->status ) ) {
                        /*if we succeeded above, report partial success */
                        result = CAC_FAILURE;
                        goto done;
                } else if ( result == CAC_FAILURE ) {
                        /*if we failed above but succeded here then report partial success */
                        result = CAC_PARTIAL_SUCCESS;
                }

                op->out.domain_sid = talloc( mem_ctx, CacSidInfo );
                if ( !op->out.domain_sid ) {
                        hnd->status = NT_STATUS_NO_MEMORY;
                        result = CAC_FAILURE;
                        goto done;
                }

                op->out.domain_sid->domain = dom_name;
                sid_copy( &op->out.domain_sid->sid, domain_sid );
                TALLOC_FREE( domain_sid );
        }

      done:
        return result;
}

int cac_LsaQueryInfoPolicy	(	CacServerHandle *	hnd,
		TALLOC_CTX *	mem_ctx,
		struct LsaQueryInfoPolicy *	op
	)

Retrieves information about the LSA machine/domain

引数:

	hnd	initialized and connected server handle
	mem_ctx	Talloc context for memory allocation
	op	input and output parameters Note: for pre-Windows 2000 machines, only op->out.SID and op->out.domain will be set.

参照:

cac_LsaFetchSid

戻り値:

- CAC_FAILURE if the operation was not successful. hnd->status will be set with an accurate NT_STATUS code

CAC_SUCCESS the operation was successful.

cac_lsarpc.c の 529 行で定義されています。

参照先 _CACSERVERHANDLE::_internal・cac_GetPipe()・CacServerHandleInternal::ctx・LsaQueryInfoPolicy::dns_name・LsaQueryInfoPolicy::domain_guid・domain_name・LsaQueryInfoPolicy::domain_name・domain_sid・LsaQueryInfoPolicy::domain_sid・LsaQueryInfoPolicy::forest_name・LsaQueryInfoPolicy::in・LsaQueryInfoPolicy::out・CacServerHandleInternal::pipes・LsaQueryInfoPolicy::pol・rpccli_lsa_query_info_policy2()・_CACSERVERHANDLE::status.

{
        struct rpc_pipe_client *pipe_hnd = NULL;

        char *domain_name = NULL;
        char *dns_name = NULL;
        char *forest_name = NULL;
        struct GUID *domain_guid = NULL;
        DOM_SID *domain_sid = NULL;

        if ( !hnd )
                return CAC_FAILURE;

        if ( !hnd->_internal.ctx || !hnd->_internal.pipes[PI_LSARPC] ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( !op || !op->in.pol ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        pipe_hnd = cac_GetPipe( hnd, PI_LSARPC );
        if ( !pipe_hnd ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        /*only works if info_class parm is 12 */
        hnd->status =
                rpccli_lsa_query_info_policy2( pipe_hnd, mem_ctx, op->in.pol,
                                               12, &domain_name, &dns_name,
                                               &forest_name, &domain_guid,
                                               &domain_sid );

        if ( !NT_STATUS_IS_OK( hnd->status ) ) {
                return CAC_FAILURE;
        }

        op->out.domain_name = domain_name;
        op->out.dns_name = dns_name;
        op->out.forest_name = forest_name;
        op->out.domain_guid = domain_guid;
        op->out.domain_sid = domain_sid;

        return CAC_SUCCESS;
}

int cac_LsaEnumSids	(	CacServerHandle *	hnd,
		TALLOC_CTX *	mem_ctx,
		struct LsaEnumSids *	op
	)

Enumerates the SIDs in the LSA.

Can be enumerated in blocks by calling the function multiple times. Example: while(cac_LsaEnumSids(hnd, mem_ctx, op) { ... }

引数:

	hnd	- An initialized and connected server handle
	mem_ctx	Talloc context for memory allocation
	op	Initialized parameters

戻り値:

CAC_FAILURE there was an error during operations OR there are no more results

CAC_SUCCESS the operation completed and results were returned

cac_lsarpc.c の 579 行で定義されています。

参照先 _CACSERVERHANDLE::_internal・cac_GetPipe()・CacServerHandleInternal::ctx・LsaEnumSids::in・LsaEnumSids::num_sids・LsaEnumSids::out・CacServerHandleInternal::pipes・LsaEnumSids::pol・LsaEnumSids::pref_max_sids・LsaEnumSids::resume_idx・rpccli_lsa_enum_sids()・LsaEnumSids::sids・_CACSERVERHANDLE::status.

{
        struct rpc_pipe_client *pipe_hnd = NULL;

        uint32 num_sids;
        DOM_SID *sids;

        if ( !hnd )
                return CAC_FAILURE;

        if ( !hnd->_internal.ctx || !hnd->_internal.pipes[PI_LSARPC] ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( !op || !op->in.pol ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        pipe_hnd = cac_GetPipe( hnd, PI_LSARPC );
        if ( !pipe_hnd ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        hnd->status =
                rpccli_lsa_enum_sids( pipe_hnd, mem_ctx, op->in.pol,
                                      &( op->out.resume_idx ),
                                      op->in.pref_max_sids, &num_sids,
                                      &sids );

        if ( !NT_STATUS_IS_OK( hnd->status ) ) {
                return CAC_FAILURE;
        }

        op->out.num_sids = num_sids;
        op->out.sids = sids;

        return CAC_SUCCESS;

}

int cac_LsaEnumAccountRights	(	CacServerHandle *	hnd,
		TALLOC_CTX *	mem_ctx,
		struct LsaEnumAccountRights *	op
	)

Enumerates rights assigned to a given account.

Takes a SID instead of account handle as input

引数:

	hnd	Initialized and connected server handle
	mem_ctx	Context for memory allocation
	op	Initialized Parameters

戻り値:

CAC_FAILURE the rights could not be retrieved. hnd->status is set with NT_STATUS code

CAC_SUCCESS the operation was successful.

cac_lsarpc.c の 623 行で定義されています。

参照先 _CACSERVERHANDLE::_internal・cac_GetPipe()・CacServerHandleInternal::ctx・LsaEnumAccountRights::in・LsaEnumAccountRights::name・name・LsaEnumAccountRights::num_privs・LsaEnumAccountRights::out・CacServerHandleInternal::pipes・LsaEnumAccountRights::pol・LsaEnumAccountRights::priv_names・privs・rpccli_lsa_enum_account_rights()・rpccli_lsa_lookup_names()・LsaEnumAccountRights::sid・_CACSERVERHANDLE::status・type.

{
        struct rpc_pipe_client *pipe_hnd = NULL;

        uint32 count = 0;
        char **privs = NULL;

        if ( !hnd )
                return CAC_FAILURE;

        if ( !hnd->_internal.ctx || !hnd->_internal.pipes[PI_LSARPC] ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( !op->in.pol ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        if ( !op->in.name && !op->in.sid ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        pipe_hnd = cac_GetPipe( hnd, PI_LSARPC );
        if ( !pipe_hnd ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( op->in.name && !op->in.sid ) {
                DOM_SID *user_sid = NULL;
                enum lsa_SidType *type;

                /*lookup the SID */
                hnd->status =
                        rpccli_lsa_lookup_names( pipe_hnd, mem_ctx,
                                                 op->in.pol, 1,
                                                 ( const char ** ) &( op->in.
                                                                      name ),
                                                 NULL, &user_sid, &type );

                if ( !NT_STATUS_IS_OK( hnd->status ) )
                        return CAC_FAILURE;

                op->in.sid = user_sid;
        }

        hnd->status =
                rpccli_lsa_enum_account_rights( pipe_hnd, mem_ctx, op->in.pol,
                                                op->in.sid, &count, &privs );

        if ( !NT_STATUS_IS_OK( hnd->status ) ) {
                return CAC_FAILURE;
        }

        op->out.num_privs = count;
        op->out.priv_names = privs;

        return CAC_SUCCESS;
}

int cac_LsaEnumTrustedDomains	(	CacServerHandle *	hnd,
		TALLOC_CTX *	mem_ctx,
		struct LsaEnumTrustedDomains *	op
	)

Enumerates the trusted domains in the LSA.

引数:

	hnd	- An initialized and connected server handle
	mem_ctx	Talloc context for memory allocation
	op	- initialized parameters

戻り値:

CAC_FAILURE there was an error during operations OR there are no more results

CAC_SUCCESS the operation completed and results were returned

cac_lsarpc.c の 687 行で定義されています。

参照先 _CACSERVERHANDLE::_internal・cac_GetPipe()・CacServerHandleInternal::ctx・LsaEnumTrustedDomains::domain_names・LsaEnumTrustedDomains::domain_sids・LsaEnumTrustedDomains::in・num_domains・LsaEnumTrustedDomains::num_domains・LsaEnumTrustedDomains::out・CacServerHandleInternal::pipes・LsaEnumTrustedDomains::pol・LsaEnumTrustedDomains::resume_idx・rpccli_lsa_enum_trust_dom()・_CACSERVERHANDLE::status.

{
        struct rpc_pipe_client *pipe_hnd;

        uint32 num_domains;
        char **domain_names;
        DOM_SID *domain_sids;

        if ( !hnd )
                return CAC_FAILURE;

        if ( !hnd->_internal.ctx || !hnd->_internal.pipes[PI_LSARPC] ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( !op->in.pol ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        pipe_hnd = cac_GetPipe( hnd, PI_LSARPC );
        if ( !pipe_hnd ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        hnd->status =
                rpccli_lsa_enum_trust_dom( pipe_hnd, mem_ctx, op->in.pol,
                                           &( op->out.resume_idx ),
                                           &num_domains, &domain_names,
                                           &domain_sids );

        if ( !NT_STATUS_IS_OK( hnd->status ) ) {
                return CAC_FAILURE;
        }

        op->out.num_domains = num_domains;
        op->out.domain_names = domain_names;
        op->out.domain_sids = domain_sids;

        return CAC_SUCCESS;
}

int cac_LsaOpenTrustedDomain	(	CacServerHandle *	hnd,
		TALLOC_CTX *	mem_ctx,
		struct LsaOpenTrustedDomain *	op
	)

Opens a trusted domain by SID.

引数:

	hnd	An initialized and connected server handle
	mem_ctx	Talloc context for memory allocation
	op	initialized I/O parameters

戻り値:

CAC_FAILURE a handle to the domain could not be opened. hnd->status is set with approriate NT_STATUS code

CAC_SUCCESS the domain was opened successfully

cac_lsarpc.c の 732 行で定義されています。

参照先 _CACSERVERHANDLE::_internal・LsaOpenTrustedDomain::access・cac_GetPipe()・CacServerHandleInternal::ctx・LsaOpenTrustedDomain::domain_pol・LsaOpenTrustedDomain::domain_sid・errno・LsaOpenTrustedDomain::in・LsaOpenTrustedDomain::out・CacServerHandleInternal::pipes・LsaOpenTrustedDomain::pol・rpccli_lsa_open_trusted_domain()・_CACSERVERHANDLE::status.

{
        struct rpc_pipe_client *pipe_hnd = NULL;

        POLICY_HND *dom_pol = NULL;

        if ( !hnd )
                return CAC_FAILURE;

        if ( !hnd->_internal.ctx || !hnd->_internal.pipes[PI_LSARPC] ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( !op->in.pol || !op->in.access || !op->in.domain_sid ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        pipe_hnd = cac_GetPipe( hnd, PI_LSARPC );
        if ( !pipe_hnd ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        dom_pol = talloc( mem_ctx, POLICY_HND );
        if ( !dom_pol ) {
                hnd->status = NT_STATUS_NO_MEMORY;
                errno = ENOMEM;
                return CAC_FAILURE;
        }

        hnd->status =
                rpccli_lsa_open_trusted_domain( pipe_hnd, mem_ctx, op->in.pol,
                                                op->in.domain_sid,
                                                op->in.access, dom_pol );

        if ( !NT_STATUS_IS_OK( hnd->status ) ) {
                return CAC_FAILURE;
        }

        op->out.domain_pol = dom_pol;

        return CAC_SUCCESS;
}

int cac_LsaQueryTrustedDomainInfo	(	CacServerHandle *	hnd,
		TALLOC_CTX *	mem_ctx,
		struct LsaQueryTrustedDomainInfo *	op
	)

Retrieves information a trusted domain.

引数:

	hnd	An initialized and connected server handle
	mem_ctx	Talloc context for memory allocation
	op	initialized I/O parameters

戻り値:

CAC_FAILURE a handle to the domain could not be opened. hnd->status is set with approriate NT_STATUS code

CAC_SUCCESS the domain was opened successfully

cac_lsarpc.c の 779 行で定義されています。

参照先 _CACSERVERHANDLE::_internal・cac_GetPipe()・CacServerHandleInternal::ctx・LsaQueryTrustedDomainInfo::domain_name・LsaQueryTrustedDomainInfo::domain_sid・domain_sid・LsaQueryTrustedDomainInfo::in・LsaQueryTrustedDomainInfo::info・LsaQueryTrustedDomainInfo::info_class・LsaQueryTrustedDomainInfo::out・CacServerHandleInternal::pipes・LsaQueryTrustedDomainInfo::pol・pol・rpccli_lsa_query_trusted_domain_info_by_name()・rpccli_lsa_query_trusted_domain_info_by_sid()・_CACSERVERHANDLE::status.

{
        struct rpc_pipe_client *pipe_hnd = NULL;

        LSA_TRUSTED_DOMAIN_INFO *dom_info;

        if ( !hnd )
                return CAC_FAILURE;

        if ( !hnd->_internal.ctx || !hnd->_internal.pipes[PI_LSARPC] ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( !op->in.pol || !op->in.info_class ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        if ( !op->in.domain_sid && !op->in.domain_name ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        pipe_hnd = cac_GetPipe( hnd, PI_LSARPC );
        if ( !pipe_hnd ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( op->in.domain_sid ) {
                hnd->status =
                        rpccli_lsa_query_trusted_domain_info_by_sid( pipe_hnd,
                                                                     mem_ctx,
                                                                     op->in.
                                                                     pol,
                                                                     op->in.
                                                                     info_class,
                                                                     op->in.
                                                                     domain_sid,
                                                                     &dom_info );
        } else if ( op->in.domain_name ) {
                hnd->status =
                        rpccli_lsa_query_trusted_domain_info_by_name
                        ( pipe_hnd, mem_ctx, op->in.pol, op->in.info_class,
                          op->in.domain_name, &dom_info );
        }

        if ( !NT_STATUS_IS_OK( hnd->status ) ) {
                return CAC_FAILURE;
        }

        op->out.info = dom_info;

        return CAC_SUCCESS;

}

int cac_LsaEnumPrivileges	(	CacServerHandle *	hnd,
		TALLOC_CTX *	mem_ctx,
		struct LsaEnumPrivileges *	op
	)

Enumerates the Privileges supported by the LSA.

Can be enumerated in blocks by calling the function multiple times. Example: while(cac_LsaEnumPrivileges(hnd, mem_ctx, op) { ... }

引数:

	hnd	An initialized and connected server handle
	mem_ctx	Talloc context for memory allocation
	op	Initialized parameters

戻り値:

CAC_FAILURE there was an error during operations OR there are no more results

CAC_SUCCESS the operation completed and results were returned

参照:

CAC_OP_FAILED()

cac_lsarpc.c の 839 行で定義されています。

参照先 _CACSERVERHANDLE::_internal・cac_GetPipe()・CacServerHandleInternal::ctx・LsaEnumPrivileges::high_bits・LsaEnumPrivileges::in・LsaEnumPrivileges::low_bits・LsaEnumPrivileges::num_privs・LsaEnumPrivileges::out・CacServerHandleInternal::pipes・LsaEnumPrivileges::pol・LsaEnumPrivileges::pref_max_privs・LsaEnumPrivileges::priv_names・LsaEnumPrivileges::resume_idx・rpccli_lsa_enum_privilege()・_CACSERVERHANDLE::status.

{
        struct rpc_pipe_client *pipe_hnd = NULL;

        uint32 num_privs;
        char **priv_names;
        uint32 *high_bits;
        uint32 *low_bits;

        if ( !hnd ) {
                return CAC_FAILURE;
        }

        if ( !hnd->_internal.ctx || !hnd->_internal.pipes[PI_LSARPC] ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( !op || !op->in.pol ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        pipe_hnd = cac_GetPipe( hnd, PI_LSARPC );
        if ( !pipe_hnd ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        hnd->status =
                rpccli_lsa_enum_privilege( pipe_hnd, mem_ctx, op->in.pol,
                                           &( op->out.resume_idx ),
                                           op->in.pref_max_privs, &num_privs,
                                           &priv_names, &high_bits,
                                           &low_bits );

        if ( !NT_STATUS_IS_OK( hnd->status ) ) {
                return CAC_FAILURE;
        }

        op->out.num_privs = num_privs;
        op->out.priv_names = priv_names;
        op->out.high_bits = high_bits;
        op->out.low_bits = low_bits;

        return CAC_SUCCESS;
}

int cac_LsaOpenAccount	(	CacServerHandle *	hnd,
		TALLOC_CTX *	mem_ctx,
		struct LsaOpenAccount *	op
	)

Opens a handle to an account in the LSA

引数:

	hnd	Initialized and connected server handle
	mem_ctx	Context for memory allocation
	op	Initialized Parameters

戻り値:

CAC_FAILURE the account could not be opened. hnd->status has appropriate NT_STATUS code

CAC_SUCCESS the account was opened

cac_lsarpc.c の 888 行で定義されています。

参照先 _CACSERVERHANDLE::_internal・LsaOpenAccount::access・cac_GetPipe()・CacServerHandleInternal::ctx・LsaOpenAccount::in・LsaOpenAccount::name・name・LsaOpenAccount::out・CacServerHandleInternal::pipes・LsaOpenAccount::pol・rpccli_lsa_lookup_names()・rpccli_lsa_open_account()・LsaOpenAccount::sid・_CACSERVERHANDLE::status・type・LsaOpenAccount::user.

{
        struct rpc_pipe_client *pipe_hnd = NULL;

        POLICY_HND *user_pol = NULL;

        if ( !hnd ) {
                return CAC_FAILURE;
        }

        if ( !hnd->_internal.ctx || !hnd->_internal.pipes[PI_LSARPC] ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( !op || !op->in.pol ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        if ( !op->in.sid && !op->in.name ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        pipe_hnd = cac_GetPipe( hnd, PI_LSARPC );
        if ( !pipe_hnd ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        /*look up the user's SID if we have to */
        if ( op->in.name && !op->in.sid ) {
                DOM_SID *user_sid = NULL;
                enum lsa_SidType *type;

                /*lookup the SID */
                hnd->status =
                        rpccli_lsa_lookup_names( pipe_hnd, mem_ctx,
                                                 op->in.pol, 1,
                                                 ( const char ** ) &( op->in.
                                                                      name ),
                                                 NULL, &user_sid, &type );

                if ( !NT_STATUS_IS_OK( hnd->status ) )
                        return CAC_FAILURE;

                op->in.sid = user_sid;
        }

        user_pol = talloc( mem_ctx, POLICY_HND );
        if ( !user_pol ) {
                hnd->status = NT_STATUS_NO_MEMORY;
                return CAC_FAILURE;
        }

        hnd->status =
                rpccli_lsa_open_account( pipe_hnd, mem_ctx, op->in.pol,
                                         op->in.sid, op->in.access,
                                         user_pol );

        if ( !NT_STATUS_IS_OK( hnd->status ) ) {
                TALLOC_FREE( user_pol );
                return CAC_FAILURE;
        }

        op->out.user = user_pol;

        return CAC_SUCCESS;
}

int cac_LsaAddPrivileges	(	CacServerHandle *	hnd,
		TALLOC_CTX *	mem_ctx,
		struct LsaAddPrivileges *	op
	)

Adds Privileges an account.

引数:

	hnd	Initialized and connected server handle
	mem_ctx	Context for memory allocation
	op	Initialized Parameters

戻り値:

CAC_FAILURE the privileges could not be set. hnd->status has appropriate NT_STATUS code

CAC_SUCCESS the privileges were set.

cac_lsarpc.c の 961 行で定義されています。

参照先 _CACSERVERHANDLE::_internal・cac_GetPipe()・CacServerHandleInternal::ctx・LsaAddPrivileges::in・LsaAddPrivileges::name・name・LsaAddPrivileges::num_privs・CacServerHandleInternal::pipes・LsaAddPrivileges::pol・LsaAddPrivileges::priv_names・rpccli_lsa_add_account_rights()・rpccli_lsa_lookup_names()・LsaAddPrivileges::sid・_CACSERVERHANDLE::status・type.

{
        struct rpc_pipe_client *pipe_hnd = NULL;

        DOM_SID *user_sid = NULL;
        enum lsa_SidType *type = NULL;

        if ( !hnd ) {
                return CAC_FAILURE;
        }

        if ( !hnd->_internal.ctx || !hnd->_internal.pipes[PI_LSARPC] ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( !op || !op->in.pol || !op->in.priv_names ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        if ( !op->in.sid && !op->in.name ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        pipe_hnd = cac_GetPipe( hnd, PI_LSARPC );
        if ( !pipe_hnd ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( op->in.name && !op->in.sid ) {
                /*lookup the SID */
                hnd->status =
                        rpccli_lsa_lookup_names( pipe_hnd, mem_ctx,
                                                 op->in.pol, 1,
                                                 ( const char ** ) &( op->in.
                                                                      name ),
                                                 NULL, &user_sid, &type );

                if ( !NT_STATUS_IS_OK( hnd->status ) )
                        return CAC_FAILURE;

                op->in.sid = user_sid;
        }

        hnd->status =
                rpccli_lsa_add_account_rights( pipe_hnd, mem_ctx, op->in.pol,
                                               *( op->in.sid ),
                                               op->in.num_privs,
                                               ( const char ** ) op->in.
                                               priv_names );

        if ( !NT_STATUS_IS_OK( hnd->status ) ) {
                return CAC_FAILURE;
        }

        return CAC_SUCCESS;
}

int cac_LsaRemovePrivileges	(	CacServerHandle *	hnd,
		TALLOC_CTX *	mem_ctx,
		struct LsaRemovePrivileges *	op
	)

Removes a _specific_ set of privileges from an account

引数:

	hnd	Initialized and connected server handle
	mem_ctx	Context for memory allocation
	op	Initialized Parameters

戻り値:

CAC_FAILURE the privileges could not be removed. hnd->status is set with NT_STATUS code

CAC_SUCCESS the privileges were removed

cac_lsarpc.c の 1023 行で定義されています。

参照先 _CACSERVERHANDLE::_internal・cac_GetPipe()・CacServerHandleInternal::ctx・LsaRemovePrivileges::in・LsaRemovePrivileges::name・name・LsaRemovePrivileges::num_privs・CacServerHandleInternal::pipes・LsaRemovePrivileges::pol・LsaRemovePrivileges::priv_names・rpccli_lsa_lookup_names()・rpccli_lsa_remove_account_rights()・LsaRemovePrivileges::sid・_CACSERVERHANDLE::status・type.

{
        struct rpc_pipe_client *pipe_hnd = NULL;

        DOM_SID *user_sid = NULL;
        enum lsa_SidType *type = NULL;

        if ( !hnd ) {
                return CAC_FAILURE;
        }

        if ( !hnd->_internal.ctx || !hnd->_internal.pipes[PI_LSARPC] ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( !op || !op->in.pol || !op->in.priv_names ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        if ( !op->in.sid && !op->in.name ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        pipe_hnd = cac_GetPipe( hnd, PI_LSARPC );
        if ( !pipe_hnd ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( op->in.name && !op->in.sid ) {
                /*lookup the SID */
                hnd->status =
                        rpccli_lsa_lookup_names( pipe_hnd, mem_ctx,
                                                 op->in.pol, 1,
                                                 ( const char ** ) &( op->in.
                                                                      name ),
                                                 NULL, &user_sid, &type );

                if ( !NT_STATUS_IS_OK( hnd->status ) )
                        return CAC_FAILURE;

                op->in.sid = user_sid;
        }

        hnd->status =
                rpccli_lsa_remove_account_rights( pipe_hnd, mem_ctx,
                                                  op->in.pol, *( op->in.sid ),
                                                  False, op->in.num_privs,
                                                  ( const char ** ) op->in.
                                                  priv_names );

        if ( !NT_STATUS_IS_OK( hnd->status ) ) {
                return CAC_FAILURE;
        }

        return CAC_SUCCESS;
}

int cac_LsaClearPrivileges	(	CacServerHandle *	hnd,
		TALLOC_CTX *	mem_ctx,
		struct LsaClearPrivileges *	op
	)

Removes ALL privileges from an account

引数:

	hnd	Initialized and connected server handle
	mem_ctx	Context for memory allocation
	op	Initialized Parameters

戻り値:

CAC_FAILURE the operation was not successful, hnd->status set with NT_STATUS code

CAC_SUCCESS the opeartion was successful.

cac_lsarpc.c の 1085 行で定義されています。

参照先 _CACSERVERHANDLE::_internal・cac_GetPipe()・CacServerHandleInternal::ctx・LsaClearPrivileges::in・LsaClearPrivileges::name・name・CacServerHandleInternal::pipes・LsaClearPrivileges::pol・rpccli_lsa_lookup_names()・rpccli_lsa_remove_account_rights()・LsaClearPrivileges::sid・_CACSERVERHANDLE::status・type.

{
        struct rpc_pipe_client *pipe_hnd = NULL;

        DOM_SID *user_sid = NULL;
        enum lsa_SidType *type = NULL;

        if ( !hnd ) {
                return CAC_FAILURE;
        }

        if ( !hnd->_internal.ctx || !hnd->_internal.pipes[PI_LSARPC] ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( !op || !op->in.pol ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        if ( !op->in.sid && !op->in.name ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        pipe_hnd = cac_GetPipe( hnd, PI_LSARPC );
        if ( !pipe_hnd ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( op->in.name && !op->in.sid ) {
                /*lookup the SID */
                hnd->status =
                        rpccli_lsa_lookup_names( pipe_hnd, mem_ctx,
                                                 op->in.pol, 1,
                                                 ( const char ** ) &( op->in.
                                                                      name ),
                                                 NULL, &user_sid, &type );

                if ( !NT_STATUS_IS_OK( hnd->status ) )
                        return CAC_FAILURE;

                op->in.sid = user_sid;
        }

        hnd->status =
                rpccli_lsa_remove_account_rights( pipe_hnd, mem_ctx,
                                                  op->in.pol, *( op->in.sid ),
                                                  True, 0, NULL );

        if ( !NT_STATUS_IS_OK( hnd->status ) ) {
                return CAC_FAILURE;
        }

        return CAC_SUCCESS;
}

int cac_LsaSetPrivileges	(	CacServerHandle *	hnd,
		TALLOC_CTX *	mem_ctx,
		struct LsaAddPrivileges *	op
	)

Sets an accounts priviliges.

Removes all privileges and then adds specified privileges.

引数:

	hnd	Initialized and connected server handle
	mem_ctx	Context for memory allocation
	op	Initialized Parameters

戻り値:

CAC_FAILURE The operation could not complete successfully

CAC_SUCCESS The operation completed successfully

cac_lsarpc.c の 1145 行で定義されています。

参照先 _CACSERVERHANDLE::_internal・cac_GetPipe()・CacServerHandleInternal::ctx・LsaAddPrivileges::in・LsaAddPrivileges::name・name・LsaAddPrivileges::num_privs・CacServerHandleInternal::pipes・LsaAddPrivileges::pol・LsaAddPrivileges::priv_names・rpccli_lsa_add_account_rights()・rpccli_lsa_lookup_names()・rpccli_lsa_remove_account_rights()・LsaAddPrivileges::sid・_CACSERVERHANDLE::status・type.

{
        struct rpc_pipe_client *pipe_hnd = NULL;

        DOM_SID *user_sid = NULL;
        enum lsa_SidType *type = NULL;

        if ( !hnd ) {
                return CAC_FAILURE;
        }

        if ( !hnd->_internal.ctx || !hnd->_internal.pipes[PI_LSARPC] ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( !op || !op->in.pol || !op->in.priv_names ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        if ( !op->in.sid && !op->in.name ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        pipe_hnd = cac_GetPipe( hnd, PI_LSARPC );
        if ( !pipe_hnd ) {
                return CAC_FAILURE;
        }

        if ( op->in.name && !op->in.sid ) {
                /*lookup the SID */
                hnd->status =
                        rpccli_lsa_lookup_names( pipe_hnd, mem_ctx,
                                                 op->in.pol, 1,
                                                 ( const char ** ) &( op->in.
                                                                      name ),
                                                 NULL, &user_sid, &type );

                if ( !NT_STATUS_IS_OK( hnd->status ) )
                        return CAC_FAILURE;

                op->in.sid = user_sid;
        }

        /*first remove all privileges */
        hnd->status =
                rpccli_lsa_remove_account_rights( pipe_hnd, mem_ctx,
                                                  op->in.pol, *( op->in.sid ),
                                                  True, 0, NULL );

        if ( !NT_STATUS_IS_OK( hnd->status ) ) {
                return CAC_FAILURE;
        }

        hnd->status =
                rpccli_lsa_add_account_rights( pipe_hnd, mem_ctx, op->in.pol,
                                               *( op->in.sid ),
                                               op->in.num_privs,
                                               ( const char ** ) op->in.
                                               priv_names );

        if ( !NT_STATUS_IS_OK( hnd->status ) ) {
                return CAC_FAILURE;
        }

        return CAC_SUCCESS;
}

int cac_LsaGetSecurityObject	(	CacServerHandle *	hnd,
		TALLOC_CTX *	mem_ctx,
		struct LsaGetSecurityObject *	op
	)

Retrieves Security Descriptor information about the LSA

引数:

	hnd	Initialized and connected server handle
	mem_ctx	Context for memory allocation
	op	Initialized Parameters

戻り値:

CAC_FAILURE The operation could not complete successfully

CAC_SUCCESS The operation completed successfully

cac_lsarpc.c の 1216 行で定義されています。

参照先 _CACSERVERHANDLE::_internal・cac_GetPipe()・CacServerHandleInternal::ctx・LsaGetSecurityObject::in・LsaGetSecurityObject::out・CacServerHandleInternal::pipes・LsaGetSecurityObject::pol・rpccli_lsa_query_secobj()・LsaGetSecurityObject::sec・_CACSERVERHANDLE::status.

{
        struct rpc_pipe_client *pipe_hnd = NULL;

        /*this is taken from rpcclient/cmd_lsarpc.c */
        uint16 info_level = 4;

        SEC_DESC_BUF *sec_out = NULL;

        if ( !hnd ) {
                return CAC_FAILURE;
        }

        if ( !hnd->_internal.ctx || !hnd->_internal.pipes[PI_LSARPC] ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        if ( !op || !op->in.pol ) {
                hnd->status = NT_STATUS_INVALID_PARAMETER;
                return CAC_FAILURE;
        }

        pipe_hnd = cac_GetPipe( hnd, PI_LSARPC );
        if ( !pipe_hnd ) {
                hnd->status = NT_STATUS_INVALID_HANDLE;
                return CAC_FAILURE;
        }

        hnd->status =
                rpccli_lsa_query_secobj( pipe_hnd, mem_ctx, op->in.pol,
                                         info_level, &sec_out );

        if ( !NT_STATUS_IS_OK( hnd->status ) )
                return CAC_FAILURE;

        op->out.sec = sec_out;

        return CAC_FAILURE;
}

---