WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=21507

Log:
Fix some "cannot access LDAP when no root" bugs.
The two culprits were

* pdb_get_account_policy()
* pdb_get_group_sid()

diff -rpu samba-3.0.24/source/passdb/pdb_interface.c samba-3.0.24.osstech/source/passdb/pdb_interface.c
--- samba-3.0.24/source/passdb/pdb_interface.c	2007-02-05 03:59:21.000000000 +0900
+++ samba-3.0.24.osstech/source/passdb/pdb_interface.c	2007-03-01 02:53:14.704628673 +0900
@@ -1006,13 +1006,25 @@ NTSTATUS pdb_lookup_names(const DOM_SID 
 BOOL pdb_get_account_policy(int policy_index, uint32 *value)
 {
 	struct pdb_methods *pdb = pdb_get_methods();
-	return NT_STATUS_IS_OK(pdb->get_account_policy(pdb, policy_index, value));
+	NTSTATUS status;
+	
+	become_root();
+	status = pdb->get_account_policy(pdb, policy_index, value);
+	unbecome_root();
+	
+	return NT_STATUS_IS_OK(status);	
 }
 
 BOOL pdb_set_account_policy(int policy_index, uint32 value)
 {
 	struct pdb_methods *pdb = pdb_get_methods();
-	return NT_STATUS_IS_OK(pdb->set_account_policy(pdb, policy_index, value));
+	NTSTATUS status;
+
+	become_root();
+	status = pdb->set_account_policy(pdb, policy_index, value);
+	unbecome_root();
+
+	return NT_STATUS_IS_OK(status);
 }
 
 BOOL pdb_get_seq_num(time_t *seq_num)
diff -rpu samba-3.0.24/source/rpc_parse/parse_samr.c samba-3.0.24.osstech/source/rpc_parse/parse_samr.c
--- samba-3.0.24/source/rpc_parse/parse_samr.c	2007-02-05 03:59:22.000000000 +0900
+++ samba-3.0.24.osstech/source/rpc_parse/parse_samr.c	2007-03-01 02:53:14.844639483 +0900
@@ -6264,8 +6264,10 @@ NTSTATUS init_sam_user_info21A(SAM_USER_
 		return NT_STATUS_UNSUCCESSFUL;
 	}
 
+	become_root();	
 	group_sid = pdb_get_group_sid(pw);
-	
+	unbecome_root();
+
 	if (!sid_peek_check_rid(domain_sid, group_sid, &group_rid)) {
 		fstring group_sid_string;
 		fstring domain_sid_string;
diff -rpu samba-3.0.24/source/rpc_server/srv_samr_nt.c samba-3.0.24.osstech/source/rpc_server/srv_samr_nt.c
--- samba-3.0.24/source/rpc_server/srv_samr_nt.c	2007-02-05 03:59:21.000000000 +0900
+++ samba-3.0.24.osstech/source/rpc_server/srv_samr_nt.c	2007-03-01 02:53:14.940646897 +0900
@@ -2077,6 +2077,7 @@ NTSTATUS _samr_query_usergroups(pipes_st
 	uint32 acc_granted;
 	BOOL ret;
 	NTSTATUS result;
+	BOOL success = False;
 
 	/*
 	 * from the SID in the request:
@@ -2121,9 +2122,15 @@ NTSTATUS _samr_query_usergroups(pipes_st
 
 	sids = NULL;
 
+	/* make both calls inside the root block */
 	become_root();
 	result = pdb_enum_group_memberships(p->mem_ctx, sam_pass,
 					    &sids, &unix_gids, &num_groups);
+	if ( NT_STATUS_IS_OK(result) ) {
+		success = sid_peek_check_rid(get_global_sam_sid(), 
+					     pdb_get_group_sid(sam_pass),
+					     &primary_group_rid);
+	}
 	unbecome_root();
 
 	if (!NT_STATUS_IS_OK(result)) {
@@ -2132,15 +2139,7 @@ NTSTATUS _samr_query_usergroups(pipes_st
 		return result;
 	}
 
-	gids = NULL;
-	num_gids = 0;
-
-	dom_gid.attr = (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|
-			SE_GROUP_ENABLED);
-
-	if (!sid_peek_check_rid(get_global_sam_sid(),
-				pdb_get_group_sid(sam_pass),
-				&primary_group_rid)) {
+	if ( !success ) {
 		DEBUG(5, ("Group sid %s for user %s not in our domain\n",
 			  sid_string_static(pdb_get_group_sid(sam_pass)),
 			  pdb_get_username(sam_pass)));
@@ -2148,8 +2147,12 @@ NTSTATUS _samr_query_usergroups(pipes_st
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
 
-	dom_gid.g_rid = primary_group_rid;
+	gids = NULL;
+	num_gids = 0;
 
+	dom_gid.attr = (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|
+			SE_GROUP_ENABLED);
+	dom_gid.g_rid = primary_group_rid;
 	ADD_TO_ARRAY(p->mem_ctx, DOM_GID, dom_gid, &gids, &num_gids);
 
 	for (i=0; i<num_groups; i++) {