Attachment 4335 Details for Bug 6481 – 7930f15f5dce0dd72b354f903a758b03988371b8 backported to 3.3

[patch] 7930f15f5dce0dd72b354f903a758b03988371b8 backported to 3.3

v3-3-test-Don-t-require-Modify-property-perms-to-unjoin-bug-64.patch (text/plain), 7.64 KB, created by Jim McDonough on 2009-06-20 13:01:18 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jim McDonough

Created: 2009-06-20 13:01:18 UTC

Size: 7.64 KB

patch

obsolete

>From 62d4b96c25c97992d6f5a829b02f05770722704b Mon Sep 17 00:00:00 2001
>From: Jim McDonough <jmcd@samba.org>
>Date: Sat, 20 Jun 2009 13:56:42 -0400
>Subject: [PATCH] Don't require "Modify property" perms to unjoin bug #6481)
> "net ads leave" stopped working when "modify properties"
> permissions were not granted (meaning you had to be allowed
> to disable the account that you were about to delete).
>
>Libnetapi should not delete machine accounts, as this does not
>happen on win32.  The WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE flag
>really means "disable" (both in practice and docs).
>
>However, to keep the functionality in "net ads leave", we
>will still try to do the delete.  If this fails, we try
>to do the disable.
>
>Additionally, it is possible in windows to not disable or
>delete the account, but just tell the local machine that it
>is no longer in the account.  libnet can now do this as well.
>---
> source/lib/netapi/joindomain.c          |    1 +
> source/libnet/libnet_join.c             |   49 ++++++++++++++++++++++---------
> source/librpc/gen_ndr/libnet_join.h     |    5 ++-
> source/librpc/gen_ndr/ndr_libnet_join.c |    1 +
> source/librpc/idl/libnet_join.idl       |    1 +
> source/utils/net_ads.c                  |   11 ++++++-
> 6 files changed, 50 insertions(+), 18 deletions(-)
>
>diff --git a/source/lib/netapi/joindomain.c b/source/lib/netapi/joindomain.c
>index d15e2e7..93c2eed 100644
>--- a/source/lib/netapi/joindomain.c
>+++ b/source/lib/netapi/joindomain.c
>@@ -207,6 +207,7 @@ WERROR NetUnjoinDomain_l(struct libnetapi_ctx *mem_ctx,
> 
> 	u->in.domain_name = domain;
> 	u->in.unjoin_flags = r->in.unjoin_flags;
>+	u->in.delete_machine_account = false;
> 	u->in.modify_config = true;
> 	u->in.debug = true;
> 
>diff --git a/source/libnet/libnet_join.c b/source/libnet/libnet_join.c
>index 1016e9c..95f247d 100644
>--- a/source/libnet/libnet_join.c
>+++ b/source/libnet/libnet_join.c
>@@ -1923,6 +1923,12 @@ static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
> 		W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
> 	}
> 
>+	if (!(r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) && 
>+	    !r->in.delete_machine_account) {
>+		libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
>+		return WERR_OK;
>+	}
>+
> 	if (!r->in.dc_name) {
> 		struct netr_DsRGetDCNameInfo *info;
> 		const char *dc;
>@@ -1948,21 +1954,12 @@ static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
> 		W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
> 	}
> 
>-	status = libnet_join_unjoindomain_rpc(mem_ctx, r);
>-	if (!NT_STATUS_IS_OK(status)) {
>-		libnet_unjoin_set_error_string(mem_ctx, r,
>-			"failed to disable machine account via rpc: %s",
>-			get_friendly_nt_error_msg(status));
>-		if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
>-			return WERR_SETUP_NOT_JOINED;
>-		}
>-		return ntstatus_to_werror(status);
>-	}
>-
>-	r->out.disabled_machine_account = true;
>-
> #ifdef WITH_ADS
>-	if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
>+	/* for net ads leave, try to delete the account.  If it works, 
>+	   no sense in disabling.  If it fails, we can still try to 
>+	   disable it. jmcd */
>+	   
>+	if (r->in.delete_machine_account) {
> 		ADS_STATUS ads_status;
> 		libnet_unjoin_connect_ads(mem_ctx, r);
> 		ads_status = libnet_unjoin_remove_machine_acct(mem_ctx, r);
>@@ -1976,10 +1973,34 @@ static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
> 			r->out.dns_domain_name = talloc_strdup(mem_ctx,
> 							       r->in.ads->server.realm);
> 			W_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
>+			libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
>+			return WERR_OK;
> 		}
> 	}
> #endif /* WITH_ADS */
> 
>+	/* The WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE flag really means 
>+	   "disable".  */
>+	if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
>+		status = libnet_join_unjoindomain_rpc(mem_ctx, r);
>+		if (!NT_STATUS_IS_OK(status)) {
>+			libnet_unjoin_set_error_string(mem_ctx, r,
>+				"failed to disable machine account via rpc: %s",
>+				get_friendly_nt_error_msg(status));
>+			if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
>+				return WERR_SETUP_NOT_JOINED;
>+			}
>+			return ntstatus_to_werror(status);
>+		}
>+		
>+		r->out.disabled_machine_account = true;
>+		r->out.dns_domain_name = talloc_strdup(mem_ctx,
>+						       r->in.ads->server.realm);
>+	}
>+
>+	/* If disable succeeded or was not requested at all, we 
>+	   should be getting rid of our end of things */
>+
> 	libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
> 
> 	return WERR_OK;
>diff --git a/source/librpc/gen_ndr/libnet_join.h b/source/librpc/gen_ndr/libnet_join.h
>index ed49062..cf915cb 100644
>--- a/source/librpc/gen_ndr/libnet_join.h
>+++ b/source/librpc/gen_ndr/libnet_join.h
>@@ -2,13 +2,13 @@
> 
> #include <stdint.h>
> 
>+#include "libcli/util/ntstatus.h"
>+
> #include "librpc/gen_ndr/wkssvc.h"
> #include "librpc/gen_ndr/security.h"
> #ifndef _HEADER_libnetjoin
> #define _HEADER_libnetjoin
> 
>-enum netr_SchannelType;
>-
> 
> struct libnet_JoinCtx {
> 	struct {
>@@ -58,6 +58,7 @@ struct libnet_UnjoinCtx {
> 		const char * admin_password;
> 		const char * machine_password;
> 		uint32_t unjoin_flags;
>+		uint8_t delete_machine_account;
> 		uint8_t modify_config;
> 		struct dom_sid *domain_sid;/* [ref] */
> 		struct ads_struct *ads;/* [ref] */
>diff --git a/source/librpc/gen_ndr/ndr_libnet_join.c b/source/librpc/gen_ndr/ndr_libnet_join.c
>index 79fcd16..ba31ea6 100644
>--- a/source/librpc/gen_ndr/ndr_libnet_join.c
>+++ b/source/librpc/gen_ndr/ndr_libnet_join.c
>@@ -89,6 +89,7 @@ _PUBLIC_ void ndr_print_libnet_UnjoinCtx(struct ndr_print *ndr, const char *name
> 		ndr_print_ptr(ndr, "machine_password", r->in.machine_password);
> #endif
> 		ndr_print_wkssvc_joinflags(ndr, "unjoin_flags", r->in.unjoin_flags);
>+		ndr_print_uint8(ndr, "delete_machine_account", r->in.delete_machine_account);
> 		ndr_print_uint8(ndr, "modify_config", r->in.modify_config);
> 		ndr_print_ptr(ndr, "domain_sid", r->in.domain_sid);
> 		ndr->depth++;
>diff --git a/source/librpc/idl/libnet_join.idl b/source/librpc/idl/libnet_join.idl
>index c600ea0..80429dc 100644
>--- a/source/librpc/idl/libnet_join.idl
>+++ b/source/librpc/idl/libnet_join.idl
>@@ -53,6 +53,7 @@ interface libnetjoin
> 		[in] string admin_password,
> 		[in] string machine_password,
> 		[in] wkssvc_joinflags unjoin_flags,
>+		[in] boolean8 delete_machine_account,
> 		[in] boolean8 modify_config,
> 		[in] dom_sid *domain_sid,
> 		[in] ads_struct *ads,
>diff --git a/source/utils/net_ads.c b/source/utils/net_ads.c
>index d0f7430..96ca486 100644
>--- a/source/utils/net_ads.c
>+++ b/source/utils/net_ads.c
>@@ -901,8 +901,12 @@ static int net_ads_leave(struct net_context *c, int argc, const char **argv)
> 	r->in.admin_account	= c->opt_user_name;
> 	r->in.admin_password	= net_prompt_pass(c, c->opt_user_name);
> 	r->in.modify_config	= lp_config_backend_is_registry();
>+
>+	/* Try to delete it, but if that fails, disable it.  The 
>+	   WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE really means "disable */
> 	r->in.unjoin_flags	= WKSSVC_JOIN_FLAGS_JOIN_TYPE |
> 				  WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
>+	r->in.delete_machine_account = true;
> 
> 	werr = libnet_Unjoin(ctx, r);
> 	if (!W_ERROR_IS_OK(werr)) {
>@@ -912,7 +916,7 @@ static int net_ads_leave(struct net_context *c, int argc, const char **argv)
> 		goto done;
> 	}
> 
>-	if (W_ERROR_IS_OK(werr)) {
>+	if (r->out.deleted_machine_account) {
> 		d_printf("Deleted account for '%s' in realm '%s'\n",
> 			r->in.machine_name, r->out.dns_domain_name);
> 		goto done;
>@@ -926,7 +930,10 @@ static int net_ads_leave(struct net_context *c, int argc, const char **argv)
> 		goto done;
> 	}
> 
>-	d_fprintf(stderr, "Failed to disable machine account for '%s' in realm '%s'\n",
>+	/* Based on what we requseted, we shouldn't get here, but if
>+	   we did, it means the secrets were removed, and therefore
>+	   we have left the domain */
>+	d_fprintf(stderr, "Machine '%s' Left domain '%s'\n",
> 		  r->in.machine_name, r->out.dns_domain_name);
> 
>  done:
>-- 
>1.6.3.2
>

Actions: View

Attachments on bug 6481: 4335 | 4338 | 4339 | 4361 | 4362 | 4363