Fix bug #6089 - Winbind samr_OpenDomain not possible with Samba 3.2.6+

What a difference a name makes... :-). Just because something is missnamed
SA_RIGHT_SAM_OPEN_DOMAIN, when it should actually be SA_RIGHT_SAM_LOOKUP_DOMAIN,
don't automatically use it for a security check in _samr_OpenDomain().
Jeremy.
(cherry picked from commit 8a985bcfe4aee7e602601fe78a94757dce645fcc)

3 files changed, 36 insertions, 37 deletions

diff --git a/source/lib/netapi/group.c b/source/lib/netapi/group.c
index b3bb14e6953..6dcf2e13f38 100644
--- a/source/lib/netapi/group.c
+++ b/source/lib/netapi/group.c
@@ -81,7 +81,7 @@ WERROR NetGroupAdd_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_CREATE_GROUP |
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					  &connect_handle,
@@ -258,7 +258,7 @@ WERROR NetGroupDel_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					  &connect_handle,
 					  &domain_handle,
@@ -429,7 +429,7 @@ WERROR NetGroupSetInfo_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					  &connect_handle,
 					  &domain_handle,
@@ -670,7 +670,7 @@ WERROR NetGroupGetInfo_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					  &connect_handle,
 					  &domain_handle,
@@ -792,7 +792,7 @@ WERROR NetGroupAddUser_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					  &connect_handle,
 					  &domain_handle,
@@ -919,7 +919,7 @@ WERROR NetGroupDelUser_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					  &connect_handle,
 					  &domain_handle,
@@ -1203,7 +1203,7 @@ WERROR NetGroupEnum_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2 |
 					  SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS |
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
@@ -1340,7 +1340,7 @@ WERROR NetGroupGetUsers_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					  &connect_handle,
 					  &domain_handle,
@@ -1498,7 +1498,7 @@ WERROR NetGroupSetUsers_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					  &connect_handle,
 					  &domain_handle,
diff --git a/source/lib/netapi/localgroup.c b/source/lib/netapi/localgroup.c
index 25a3427bc17..d571045e6c0 100644
--- a/source/lib/netapi/localgroup.c
+++ b/source/lib/netapi/localgroup.c
@@ -159,7 +159,7 @@ WERROR NetLocalGroupAdd_r(struct libnetapi_ctx *ctx,
 	}
 
 	werr = libnetapi_samr_open_builtin_domain(ctx, pipe_cli,
-						  SAMR_ACCESS_OPEN_DOMAIN |
+						  SAMR_ACCESS_LOOKUP_DOMAIN |
 						  SAMR_ACCESS_ENUM_DOMAINS,
 						  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 						  &connect_handle,
@@ -184,7 +184,7 @@ WERROR NetLocalGroupAdd_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_CREATE_ALIAS |
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					  &connect_handle,
@@ -285,7 +285,7 @@ WERROR NetLocalGroupDel_r(struct libnetapi_ctx *ctx,
 	}
 
 	werr = libnetapi_samr_open_builtin_domain(ctx, pipe_cli,
-						  SAMR_ACCESS_OPEN_DOMAIN |
+						  SAMR_ACCESS_LOOKUP_DOMAIN |
 						  SAMR_ACCESS_ENUM_DOMAINS,
 						  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 						  &connect_handle,
@@ -310,7 +310,7 @@ WERROR NetLocalGroupDel_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_CREATE_ALIAS |
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					  &connect_handle,
@@ -463,7 +463,7 @@ WERROR NetLocalGroupGetInfo_r(struct libnetapi_ctx *ctx,
 	}
 
 	werr = libnetapi_samr_open_builtin_domain(ctx, pipe_cli,
-						  SAMR_ACCESS_OPEN_DOMAIN |
+						  SAMR_ACCESS_LOOKUP_DOMAIN |
 						  SAMR_ACCESS_ENUM_DOMAINS,
 						  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 						  &connect_handle,
@@ -488,7 +488,7 @@ WERROR NetLocalGroupGetInfo_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_CREATE_ALIAS |
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					  &connect_handle,
@@ -640,7 +640,7 @@ WERROR NetLocalGroupSetInfo_r(struct libnetapi_ctx *ctx,
 	}
 
 	werr = libnetapi_samr_open_builtin_domain(ctx, pipe_cli,
-						  SAMR_ACCESS_OPEN_DOMAIN |
+						  SAMR_ACCESS_LOOKUP_DOMAIN |
 						  SAMR_ACCESS_ENUM_DOMAINS,
 						  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 						  &connect_handle,
@@ -667,7 +667,7 @@ WERROR NetLocalGroupSetInfo_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					  &connect_handle,
 					  &domain_handle,
@@ -788,7 +788,7 @@ WERROR NetLocalGroupEnum_r(struct libnetapi_ctx *ctx,
 	}
 
 	werr = libnetapi_samr_open_builtin_domain(ctx, pipe_cli,
-						  SAMR_ACCESS_OPEN_DOMAIN |
+						  SAMR_ACCESS_LOOKUP_DOMAIN |
 						  SAMR_ACCESS_ENUM_DOMAINS,
 						  SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2 |
 						  SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS |
@@ -800,7 +800,7 @@ WERROR NetLocalGroupEnum_r(struct libnetapi_ctx *ctx,
 	}
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
-					  SAMR_ACCESS_OPEN_DOMAIN |
+					  SAMR_ACCESS_LOOKUP_DOMAIN |
 					  SAMR_ACCESS_ENUM_DOMAINS,
 					  SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2 |
 					  SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS |
@@ -1101,7 +1101,7 @@ static WERROR NetLocalGroupModifyMembers_r(struct libnetapi_ctx *ctx,
 	}
 
 	werr = libnetapi_samr_open_builtin_domain(ctx, pipe_cli,
-						  SAMR_ACCESS_OPEN_DOMAIN |
+						  SAMR_ACCESS_LOOKUP_DOMAIN |
 						  SAMR_ACCESS_ENUM_DOMAINS,
 						  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 						  &connect_handle,
@@ -1131,7 +1131,7 @@ static WERROR NetLocalGroupModifyMembers_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					  &connect_handle,
 					  &domain_handle,
@@ -1355,4 +1355,3 @@ WERROR NetLocalGroupSetMembers_l(struct libnetapi_ctx *ctx,
 {
 	LIBNETAPI_REDIRECT_TO_LOCALHOST(ctx, r, NetLocalGroupSetMembers);
 }
-
diff --git a/source/lib/netapi/user.c b/source/lib/netapi/user.c
index 2c78f6f8ada..bddd16127f8 100644
--- a/source/lib/netapi/user.c
+++ b/source/lib/netapi/user.c
@@ -391,7 +391,7 @@ WERROR NetUserAdd_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1 |
 					  SAMR_DOMAIN_ACCESS_CREATE_USER |
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
@@ -519,7 +519,7 @@ WERROR NetUserDel_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					  &connect_handle,
 					  &domain_handle,
@@ -1231,7 +1231,7 @@ WERROR NetUserEnum_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_builtin_domain(ctx, pipe_cli,
 						  SAMR_ACCESS_ENUM_DOMAINS |
-						  SAMR_ACCESS_OPEN_DOMAIN,
+						  SAMR_ACCESS_LOOKUP_DOMAIN,
 						  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT |
 						  SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
 						  &connect_handle,
@@ -1242,7 +1242,7 @@ WERROR NetUserEnum_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2 |
 					  SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS |
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
@@ -1536,7 +1536,7 @@ WERROR NetQueryDisplayInformation_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2 |
 					  SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS |
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
@@ -1668,7 +1668,7 @@ WERROR NetUserGetInfo_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					  &connect_handle,
 					  &domain_handle,
@@ -1679,7 +1679,7 @@ WERROR NetUserGetInfo_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_builtin_domain(ctx, pipe_cli,
 						  SAMR_ACCESS_ENUM_DOMAINS |
-						  SAMR_ACCESS_OPEN_DOMAIN,
+						  SAMR_ACCESS_LOOKUP_DOMAIN,
 						  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT |
 						  SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
 						  &connect_handle,
@@ -1826,7 +1826,7 @@ WERROR NetUserSetInfo_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1 |
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					  &connect_handle,
@@ -1838,7 +1838,7 @@ WERROR NetUserSetInfo_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_builtin_domain(ctx, pipe_cli,
 						  SAMR_ACCESS_ENUM_DOMAINS |
-						  SAMR_ACCESS_OPEN_DOMAIN,
+						  SAMR_ACCESS_LOOKUP_DOMAIN,
 						  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT |
 						  SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
 						  &connect_handle,
@@ -2252,7 +2252,7 @@ WERROR NetUserModalsGet_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  access_mask,
 					  &connect_handle,
 					  &domain_handle,
@@ -2736,7 +2736,7 @@ WERROR NetUserModalsSet_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  access_mask,
 					  &connect_handle,
 					  &domain_handle,
@@ -2875,7 +2875,7 @@ WERROR NetUserGetGroups_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					  &connect_handle,
 					  &domain_handle,
@@ -3032,7 +3032,7 @@ WERROR NetUserSetGroups_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
 					  &connect_handle,
 					  &domain_handle,
@@ -3320,7 +3320,7 @@ WERROR NetUserGetLocalGroups_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_domain(ctx, pipe_cli,
 					  SAMR_ACCESS_ENUM_DOMAINS |
-					  SAMR_ACCESS_OPEN_DOMAIN,
+					  SAMR_ACCESS_LOOKUP_DOMAIN,
 					  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT |
 					  SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
 					  &connect_handle,
@@ -3332,7 +3332,7 @@ WERROR NetUserGetLocalGroups_r(struct libnetapi_ctx *ctx,
 
 	werr = libnetapi_samr_open_builtin_domain(ctx, pipe_cli,
 						  SAMR_ACCESS_ENUM_DOMAINS |
-						  SAMR_ACCESS_OPEN_DOMAIN,
+						  SAMR_ACCESS_LOOKUP_DOMAIN,
 						  SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT |
 						  SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
 						  &connect_handle,