static NTSTATUS dcesrv_lsa_QuerySecurity(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
					 struct lsa_QuerySecurity *r)
{
	struct auth_session_info *session_info =
		dcesrv_call_session_info(dce_call);
	struct dcesrv_handle *h;
	const struct security_descriptor *sd = NULL;
	uint32_t access_granted = 0;
	struct sec_desc_buf *sdbuf = NULL;
	NTSTATUS status;
	struct dom_sid *sid;

	DCESRV_PULL_HANDLE(h, r->in.handle, DCESRV_HANDLE_ANY);

	sid = &session_info->security_token->sids[PRIMARY_USER_SID_INDEX];

	if (h->wire_handle.handle_type == LSA_HANDLE_POLICY) {
		struct lsa_policy_state *pstate = h->data;

		sd = pstate->sd;
		access_granted = pstate->access_mask;

	} else if (h->wire_handle.handle_type == LSA_HANDLE_ACCOUNT) {
		struct lsa_account_state *astate = h->data;
		struct security_descriptor *_sd = NULL;

		status = dcesrv_build_lsa_sd(mem_ctx, &_sd, sid,
					     LSA_ACCOUNT_ALL_ACCESS);
		if (!NT_STATUS_IS_OK(status)) {
			return status;
		}
		sd = _sd;
		access_granted = astate->access_mask;
	} else {
		return NT_STATUS_INVALID_HANDLE;
	}

	sdbuf = talloc_zero(mem_ctx, struct sec_desc_buf);
	if (sdbuf == NULL) {
		return NT_STATUS_NO_MEMORY;
	}

	status = security_descriptor_for_client(sdbuf, sd, r->in.sec_info,
						access_granted, &sdbuf->sd);
	if (!NT_STATUS_IS_OK(status)) {
		return status;
	}

	*r->out.sdbuf = sdbuf;

	return NT_STATUS_OK;
}
static NTSTATUS dcesrv_lsa_QuerySecurity(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
					 struct lsa_QuerySecurity *r)
{
	struct auth_session_info *session_info =
		dcesrv_call_session_info(dce_call);
	struct dcesrv_handle *h;
	const struct security_descriptor *sd = NULL;
	uint32_t access_granted = 0;
	struct sec_desc_buf *sdbuf = NULL;
	NTSTATUS status;
	struct dom_sid *sid;

	DCESRV_PULL_HANDLE(h, r->in.handle, DCESRV_HANDLE_ANY);

	sid = &session_info->security_token->sids[PRIMARY_USER_SID_INDEX];

	if (h->wire_handle.handle_type == LSA_HANDLE_POLICY) {
		struct lsa_policy_state *pstate = h->data;

		sd = pstate->sd;
		access_granted = pstate->access_mask;

	} else if (h->wire_handle.handle_type == LSA_HANDLE_ACCOUNT) {
		struct lsa_account_state *astate = h->data;
		struct security_descriptor *_sd = NULL;

		status = dcesrv_build_lsa_sd(mem_ctx, &_sd, sid,
					     LSA_ACCOUNT_ALL_ACCESS);
		if (!NT_STATUS_IS_OK(status)) {
			return status;
		}
		sd = _sd;
		access_granted = astate->access_mask;
	} else {
		return NT_STATUS_INVALID_HANDLE;
	}

	sdbuf = talloc_zero(mem_ctx, struct sec_desc_buf);
	if (sdbuf == NULL) {
		return NT_STATUS_NO_MEMORY;
	}

	status = security_descriptor_for_client(sdbuf, sd, r->in.sec_info,
						access_granted, &sdbuf->sd);
	if (!NT_STATUS_IS_OK(status)) {
		return status;
	}

	*r->out.sdbuf = sdbuf;

	return NT_STATUS_OK;
}