source: branches/samba-3.3.x/source/utils/net_groupmap.c

Last change on this file was 274, checked in by Herwig Bauernfeind, 16 years ago

Update 3.3 branch to 3.3.5
File size: 22.6 KB
Line 
1/*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-2000,
5 * Copyright (C) Jean François Micouleau 1998-2001.
6 * Copyright (C) Gerald Carter 2003,
7 * Copyright (C) Volker Lendecke 2004
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 3 of the License, or
12 * (at your option) any later version.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 */
22
23
24#include "includes.h"
25#include "utils/net.h"
26
27/*********************************************************
28 Figure out if the input was an NT group or a SID string.
29 Return the SID.
30**********************************************************/
31static bool get_sid_from_input(DOM_SID *sid, char *input)
32{
33 GROUP_MAP map;
34
35 if (StrnCaseCmp( input, "S-", 2)) {
36 /* Perhaps its the NT group name? */
37 if (!pdb_getgrnam(&map, input)) {
38 printf("NT Group %s doesn't exist in mapping DB\n", input);
39 return false;
40 } else {
41 *sid = map.sid;
42 }
43 } else {
44 if (!string_to_sid(sid, input)) {
45 printf("converting sid %s from a string failed!\n", input);
46 return false;
47 }
48 }
49 return true;
50}
51
52/*********************************************************
53 Dump a GROUP_MAP entry to stdout (long or short listing)
54**********************************************************/
55
56static void print_map_entry ( GROUP_MAP map, bool long_list )
57{
58 if (!long_list)
59 d_printf("%s (%s) -> %s\n", map.nt_name,
60 sid_string_tos(&map.sid), gidtoname(map.gid));
61 else {
62 d_printf("%s\n", map.nt_name);
63 d_printf("\tSID : %s\n", sid_string_tos(&map.sid));
64 d_printf("\tUnix gid : %d\n", map.gid);
65 d_printf("\tUnix group: %s\n", gidtoname(map.gid));
66 d_printf("\tGroup type: %s\n",
67 sid_type_lookup(map.sid_name_use));
68 d_printf("\tComment : %s\n", map.comment);
69 }
70
71}
72/*********************************************************
73 List the groups.
74**********************************************************/
75static int net_groupmap_list(struct net_context *c, int argc, const char **argv)
76{
77 size_t entries;
78 bool long_list = false;
79 size_t i;
80 fstring ntgroup = "";
81 fstring sid_string = "";
82 const char list_usage_str[] = "net groupmap list [verbose] "
83 "[ntgroup=NT group] [sid=SID]\n"
84 " verbose\tPrint verbose list\n"
85 " ntgroup\tNT group to list\n"
86 " sid\tSID of group to list";
87
88 if (c->display_usage) {
89 d_printf("Usage:\n%s\n", list_usage_str);
90 return 0;
91 }
92
93 if (c->opt_verbose || c->opt_long_list_entries)
94 long_list = true;
95
96 /* get the options */
97 for ( i=0; i<argc; i++ ) {
98 if ( !StrCaseCmp(argv[i], "verbose")) {
99 long_list = true;
100 }
101 else if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
102 fstrcpy( ntgroup, get_string_param( argv[i] ) );
103 if ( !ntgroup[0] ) {
104 d_fprintf(stderr, "must supply a name\n");
105 return -1;
106 }
107 }
108 else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
109 fstrcpy( sid_string, get_string_param( argv[i] ) );
110 if ( !sid_string[0] ) {
111 d_fprintf(stderr, "must supply a SID\n");
112 return -1;
113 }
114 }
115 else {
116 d_fprintf(stderr, "Bad option: %s\n", argv[i]);
117 d_printf("Usage:\n%s\n", list_usage_str);
118 return -1;
119 }
120 }
121
122 /* list a single group is given a name */
123 if ( ntgroup[0] || sid_string[0] ) {
124 DOM_SID sid;
125 GROUP_MAP map;
126
127 if ( sid_string[0] )
128 fstrcpy( ntgroup, sid_string);
129
130 if (!get_sid_from_input(&sid, ntgroup)) {
131 return -1;
132 }
133
134 /* Get the current mapping from the database */
135 if(!pdb_getgrsid(&map, sid)) {
136 d_fprintf(stderr, "Failure to local group SID in the database\n");
137 return -1;
138 }
139
140 print_map_entry( map, long_list );
141 }
142 else {
143 GROUP_MAP *map=NULL;
144 /* enumerate all group mappings */
145 if (!pdb_enum_group_mapping(NULL, SID_NAME_UNKNOWN, &map, &entries, ENUM_ALL_MAPPED))
146 return -1;
147
148 for (i=0; i<entries; i++) {
149 print_map_entry( map[i], long_list );
150 }
151
152 SAFE_FREE(map);
153 }
154
155 return 0;
156}
157
158/*********************************************************
159 Add a new group mapping entry
160**********************************************************/
161
162static int net_groupmap_add(struct net_context *c, int argc, const char **argv)
163{
164 DOM_SID sid;
165 fstring ntgroup = "";
166 fstring unixgrp = "";
167 fstring string_sid = "";
168 fstring type = "";
169 fstring ntcomment = "";
170 enum lsa_SidType sid_type = SID_NAME_DOM_GRP;
171 uint32 rid = 0;
172 gid_t gid;
173 int i;
174 GROUP_MAP map;
175
176 const char *name_type;
177 const char add_usage_str[] = "net groupmap add {rid=<int>|sid=<string>}"
178 " unixgroup=<string> "
179 "[type=<domain|local|builtin>] "
180 "[ntgroup=<string>] [comment=<string>]";
181
182 ZERO_STRUCT(map);
183
184 /* Default is domain group. */
185 map.sid_name_use = SID_NAME_DOM_GRP;
186 name_type = "domain group";
187
188 if (c->display_usage) {
189 d_printf("Usage\n%s\n", add_usage_str);
190 return 0;
191 }
192
193 /* get the options */
194 for ( i=0; i<argc; i++ ) {
195 if ( !StrnCaseCmp(argv[i], "rid", strlen("rid")) ) {
196 rid = get_int_param(argv[i]);
197 if ( rid < DOMAIN_GROUP_RID_ADMINS ) {
198 d_fprintf(stderr, "RID must be greater than %d\n", (uint32)DOMAIN_GROUP_RID_ADMINS-1);
199 return -1;
200 }
201 }
202 else if ( !StrnCaseCmp(argv[i], "unixgroup", strlen("unixgroup")) ) {
203 fstrcpy( unixgrp, get_string_param( argv[i] ) );
204 if ( !unixgrp[0] ) {
205 d_fprintf(stderr, "must supply a name\n");
206 return -1;
207 }
208 }
209 else if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
210 fstrcpy( ntgroup, get_string_param( argv[i] ) );
211 if ( !ntgroup[0] ) {
212 d_fprintf(stderr, "must supply a name\n");
213 return -1;
214 }
215 }
216 else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
217 fstrcpy( string_sid, get_string_param( argv[i] ) );
218 if ( !string_sid[0] ) {
219 d_fprintf(stderr, "must supply a SID\n");
220 return -1;
221 }
222 }
223 else if ( !StrnCaseCmp(argv[i], "comment", strlen("comment")) ) {
224 fstrcpy( ntcomment, get_string_param( argv[i] ) );
225 if ( !ntcomment[0] ) {
226 d_fprintf(stderr, "must supply a comment string\n");
227 return -1;
228 }
229 }
230 else if ( !StrnCaseCmp(argv[i], "type", strlen("type")) ) {
231 fstrcpy( type, get_string_param( argv[i] ) );
232 switch ( type[0] ) {
233 case 'b':
234 case 'B':
235 sid_type = SID_NAME_WKN_GRP;
236 name_type = "wellknown group";
237 break;
238 case 'd':
239 case 'D':
240 sid_type = SID_NAME_DOM_GRP;
241 name_type = "domain group";
242 break;
243 case 'l':
244 case 'L':
245 sid_type = SID_NAME_ALIAS;
246 name_type = "alias (local) group";
247 break;
248 default:
249 d_fprintf(stderr, "unknown group type %s\n", type);
250 return -1;
251 }
252 }
253 else {
254 d_fprintf(stderr, "Bad option: %s\n", argv[i]);
255 return -1;
256 }
257 }
258
259 if ( !unixgrp[0] ) {
260 d_printf("Usage:\n%s\n", add_usage_str);
261 return -1;
262 }
263
264 if ( (gid = nametogid(unixgrp)) == (gid_t)-1 ) {
265 d_fprintf(stderr, "Can't lookup UNIX group %s\n", unixgrp);
266 return -1;
267 }
268
269 {
270 if (pdb_getgrgid(&map, gid)) {
271 d_printf("Unix group %s already mapped to SID %s\n",
272 unixgrp, sid_string_tos(&map.sid));
273 return -1;
274 }
275 }
276
277 if ( (rid == 0) && (string_sid[0] == '\0') ) {
278 d_printf("No rid or sid specified, choosing a RID\n");
279 if (pdb_rid_algorithm()) {
280 rid = algorithmic_pdb_gid_to_group_rid(gid);
281 } else {
282 if (!pdb_new_rid(&rid)) {
283 d_printf("Could not get new RID\n");
284 }
285 }
286 d_printf("Got RID %d\n", rid);
287 }
288
289 /* append the rid to our own domain/machine SID if we don't have a full SID */
290 if ( !string_sid[0] ) {
291 sid_copy(&sid, get_global_sam_sid());
292 sid_append_rid(&sid, rid);
293 sid_to_fstring(string_sid, &sid);
294 }
295
296 if (!ntcomment[0]) {
297 switch (sid_type) {
298 case SID_NAME_WKN_GRP:
299 fstrcpy(ntcomment, "Wellknown Unix group");
300 break;
301 case SID_NAME_DOM_GRP:
302 fstrcpy(ntcomment, "Domain Unix group");
303 break;
304 case SID_NAME_ALIAS:
305 fstrcpy(ntcomment, "Local Unix group");
306 break;
307 default:
308 fstrcpy(ntcomment, "Unix group");
309 break;
310 }
311 }
312
313 if (!ntgroup[0] )
314 fstrcpy( ntgroup, unixgrp );
315
316 if (!NT_STATUS_IS_OK(add_initial_entry(gid, string_sid, sid_type, ntgroup, ntcomment))) {
317 d_fprintf(stderr, "adding entry for group %s failed!\n", ntgroup);
318 return -1;
319 }
320
321 d_printf("Successfully added group %s to the mapping db as a %s\n",
322 ntgroup, name_type);
323 return 0;
324}
325
326static int net_groupmap_modify(struct net_context *c, int argc, const char **argv)
327{
328 DOM_SID sid;
329 GROUP_MAP map;
330 fstring ntcomment = "";
331 fstring type = "";
332 fstring ntgroup = "";
333 fstring unixgrp = "";
334 fstring sid_string = "";
335 enum lsa_SidType sid_type = SID_NAME_UNKNOWN;
336 int i;
337 gid_t gid;
338 const char modify_usage_str[] = "net groupmap modify "
339 "{ntgroup=<string>|sid=<SID>} "
340 "[comment=<string>] "
341 "[unixgroup=<string>] "
342 "[type=<domain|local>]";
343
344 if (c->display_usage) {
345 d_printf("Usage:\n%s\n", modify_usage_str);
346 return 0;
347 }
348
349 /* get the options */
350 for ( i=0; i<argc; i++ ) {
351 if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
352 fstrcpy( ntgroup, get_string_param( argv[i] ) );
353 if ( !ntgroup[0] ) {
354 d_fprintf(stderr, "must supply a name\n");
355 return -1;
356 }
357 }
358 else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
359 fstrcpy( sid_string, get_string_param( argv[i] ) );
360 if ( !sid_string[0] ) {
361 d_fprintf(stderr, "must supply a name\n");
362 return -1;
363 }
364 }
365 else if ( !StrnCaseCmp(argv[i], "comment", strlen("comment")) ) {
366 fstrcpy( ntcomment, get_string_param( argv[i] ) );
367 if ( !ntcomment[0] ) {
368 d_fprintf(stderr, "must supply a comment string\n");
369 return -1;
370 }
371 }
372 else if ( !StrnCaseCmp(argv[i], "unixgroup", strlen("unixgroup")) ) {
373 fstrcpy( unixgrp, get_string_param( argv[i] ) );
374 if ( !unixgrp[0] ) {
375 d_fprintf(stderr, "must supply a group name\n");
376 return -1;
377 }
378 }
379 else if ( !StrnCaseCmp(argv[i], "type", strlen("type")) ) {
380 fstrcpy( type, get_string_param( argv[i] ) );
381 switch ( type[0] ) {
382 case 'd':
383 case 'D':
384 sid_type = SID_NAME_DOM_GRP;
385 break;
386 case 'l':
387 case 'L':
388 sid_type = SID_NAME_ALIAS;
389 break;
390 }
391 }
392 else {
393 d_fprintf(stderr, "Bad option: %s\n", argv[i]);
394 return -1;
395 }
396 }
397
398 if ( !ntgroup[0] && !sid_string[0] ) {
399 d_printf("Usage:\n%s\n", modify_usage_str);
400 return -1;
401 }
402
403 /* give preference to the SID; if both the ntgroup name and SID
404 are defined, use the SID and assume that the group name could be a
405 new name */
406
407 if ( sid_string[0] ) {
408 if (!get_sid_from_input(&sid, sid_string)) {
409 return -1;
410 }
411 }
412 else {
413 if (!get_sid_from_input(&sid, ntgroup)) {
414 return -1;
415 }
416 }
417
418 /* Get the current mapping from the database */
419 if(!pdb_getgrsid(&map, sid)) {
420 d_fprintf(stderr, "Failure to local group SID in the database\n");
421 return -1;
422 }
423
424 /*
425 * Allow changing of group type only between domain and local
426 * We disallow changing Builtin groups !!! (SID problem)
427 */
428 if (sid_type == SID_NAME_UNKNOWN) {
429 d_fprintf(stderr, "Can't map to an unknown group type.\n");
430 return -1;
431 }
432
433 if (map.sid_name_use == SID_NAME_WKN_GRP) {
434 d_fprintf(stderr, "You can only change between domain and local groups.\n");
435 return -1;
436 }
437
438 map.sid_name_use=sid_type;
439
440 /* Change comment if new one */
441 if ( ntcomment[0] )
442 fstrcpy( map.comment, ntcomment );
443
444 if ( ntgroup[0] )
445 fstrcpy( map.nt_name, ntgroup );
446
447 if ( unixgrp[0] ) {
448 gid = nametogid( unixgrp );
449 if ( gid == -1 ) {
450 d_fprintf(stderr, "Unable to lookup UNIX group %s. Make sure the group exists.\n",
451 unixgrp);
452 return -1;
453 }
454
455 map.gid = gid;
456 }
457
458 if ( !NT_STATUS_IS_OK(pdb_update_group_mapping_entry(&map)) ) {
459 d_fprintf(stderr, "Could not update group database\n");
460 return -1;
461 }
462
463 d_printf("Updated mapping entry for %s\n", map.nt_name);
464
465 return 0;
466}
467
468static int net_groupmap_delete(struct net_context *c, int argc, const char **argv)
469{
470 DOM_SID sid;
471 fstring ntgroup = "";
472 fstring sid_string = "";
473 int i;
474 const char delete_usage_str[] = "net groupmap delete "
475 "{ntgroup=<string>|sid=<SID>}";
476
477 if (c->display_usage) {
478 d_printf("Usage:\n%s\n", delete_usage_str);
479 return 0;
480 }
481
482 /* get the options */
483 for ( i=0; i<argc; i++ ) {
484 if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
485 fstrcpy( ntgroup, get_string_param( argv[i] ) );
486 if ( !ntgroup[0] ) {
487 d_fprintf(stderr, "must supply a name\n");
488 return -1;
489 }
490 }
491 else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
492 fstrcpy( sid_string, get_string_param( argv[i] ) );
493 if ( !sid_string[0] ) {
494 d_fprintf(stderr, "must supply a SID\n");
495 return -1;
496 }
497 }
498 else {
499 d_fprintf(stderr, "Bad option: %s\n", argv[i]);
500 return -1;
501 }
502 }
503
504 if ( !ntgroup[0] && !sid_string[0]) {
505 d_printf("Usage:\n%s\n", delete_usage_str);
506 return -1;
507 }
508
509 /* give preference to the SID if we have that */
510
511 if ( sid_string[0] )
512 fstrcpy( ntgroup, sid_string );
513
514 if ( !get_sid_from_input(&sid, ntgroup) ) {
515 d_fprintf(stderr, "Unable to resolve group %s to a SID\n", ntgroup);
516 return -1;
517 }
518
519 if ( !NT_STATUS_IS_OK(pdb_delete_group_mapping_entry(sid)) ) {
520 d_fprintf(stderr, "Failed to removing group %s from the mapping db!\n", ntgroup);
521 return -1;
522 }
523
524 d_printf("Sucessfully removed %s from the mapping db\n", ntgroup);
525
526 return 0;
527}
528
529static int net_groupmap_set(struct net_context *c, int argc, const char **argv)
530{
531 const char *ntgroup = NULL;
532 struct group *grp = NULL;
533 GROUP_MAP map;
534 bool have_map = false;
535
536 if ((argc < 1) || (argc > 2) || c->display_usage) {
537 d_printf("Usage: net groupmap set \"NT Group\" "
538 "[\"unix group\"] [-C \"comment\"] [-L] [-D]\n");
539 return -1;
540 }
541
542 if ( c->opt_localgroup && c->opt_domaingroup ) {
543 d_printf("Can only specify -L or -D, not both\n");
544 return -1;
545 }
546
547 ntgroup = argv[0];
548
549 if (argc == 2) {
550 grp = getgrnam(argv[1]);
551
552 if (grp == NULL) {
553 d_fprintf(stderr, "Could not find unix group %s\n", argv[1]);
554 return -1;
555 }
556 }
557
558 have_map = pdb_getgrnam(&map, ntgroup);
559
560 if (!have_map) {
561 DOM_SID sid;
562 have_map = ( (strncmp(ntgroup, "S-", 2) == 0) &&
563 string_to_sid(&sid, ntgroup) &&
564 pdb_getgrsid(&map, sid) );
565 }
566
567 if (!have_map) {
568
569 /* Ok, add it */
570
571 if (grp == NULL) {
572 d_fprintf(stderr, "Could not find group mapping for %s\n",
573 ntgroup);
574 return -1;
575 }
576
577 map.gid = grp->gr_gid;
578
579 if (c->opt_rid == 0) {
580 if ( pdb_rid_algorithm() )
581 c->opt_rid = algorithmic_pdb_gid_to_group_rid(map.gid);
582 else {
583 if ( !pdb_new_rid((uint32*)&c->opt_rid) ) {
584 d_fprintf( stderr, "Could not allocate new RID\n");
585 return -1;
586 }
587 }
588 }
589
590 sid_copy(&map.sid, get_global_sam_sid());
591 sid_append_rid(&map.sid, c->opt_rid);
592
593 map.sid_name_use = SID_NAME_DOM_GRP;
594 fstrcpy(map.nt_name, ntgroup);
595 fstrcpy(map.comment, "");
596
597 if (!NT_STATUS_IS_OK(pdb_add_group_mapping_entry(&map))) {
598 d_fprintf(stderr, "Could not add mapping entry for %s\n",
599 ntgroup);
600 return -1;
601 }
602 }
603
604 /* Now we have a mapping entry, update that stuff */
605
606 if ( c->opt_localgroup || c->opt_domaingroup ) {
607 if (map.sid_name_use == SID_NAME_WKN_GRP) {
608 d_fprintf(stderr, "Can't change type of the BUILTIN group %s\n",
609 map.nt_name);
610 return -1;
611 }
612 }
613
614 if (c->opt_localgroup)
615 map.sid_name_use = SID_NAME_ALIAS;
616
617 if (c->opt_domaingroup)
618 map.sid_name_use = SID_NAME_DOM_GRP;
619
620 /* The case (opt_domaingroup && opt_localgroup) was tested for above */
621
622 if ((c->opt_comment != NULL) && (strlen(c->opt_comment) > 0)) {
623 fstrcpy(map.comment, c->opt_comment);
624 }
625
626 if ((c->opt_newntname != NULL) && (strlen(c->opt_newntname) > 0)) {
627 fstrcpy(map.nt_name, c->opt_newntname);
628 }
629
630 if (grp != NULL)
631 map.gid = grp->gr_gid;
632
633 if (!NT_STATUS_IS_OK(pdb_update_group_mapping_entry(&map))) {
634 d_fprintf(stderr, "Could not update group mapping for %s\n", ntgroup);
635 return -1;
636 }
637
638 return 0;
639}
640
641static int net_groupmap_cleanup(struct net_context *c, int argc, const char **argv)
642{
643 GROUP_MAP *map = NULL;
644 size_t i, entries;
645
646 if (c->display_usage) {
647 d_printf("Usage:\n"
648 "net groupmap cleanup\n"
649 " Delete all group mappings\n");
650 return 0;
651 }
652
653 if (!pdb_enum_group_mapping(NULL, SID_NAME_UNKNOWN, &map, &entries,
654 ENUM_ALL_MAPPED)) {
655 d_fprintf(stderr, "Could not list group mappings\n");
656 return -1;
657 }
658
659 for (i=0; i<entries; i++) {
660
661 if (map[i].gid == -1)
662 printf("Group %s is not mapped\n", map[i].nt_name);
663
664 if (!sid_check_is_in_our_domain(&map[i].sid)) {
665 printf("Deleting mapping for NT Group %s, sid %s\n",
666 map[i].nt_name,
667 sid_string_tos(&map[i].sid));
668 pdb_delete_group_mapping_entry(map[i].sid);
669 }
670 }
671
672 SAFE_FREE(map);
673
674 return 0;
675}
676
677static int net_groupmap_addmem(struct net_context *c, int argc, const char **argv)
678{
679 DOM_SID alias, member;
680
681 if ( (argc != 2) ||
682 c->display_usage ||
683 !string_to_sid(&alias, argv[0]) ||
684 !string_to_sid(&member, argv[1]) ) {
685 d_printf("Usage: net groupmap addmem alias-sid member-sid\n");
686 return -1;
687 }
688
689 if (!NT_STATUS_IS_OK(pdb_add_aliasmem(&alias, &member))) {
690 d_fprintf(stderr, "Could not add sid %s to alias %s\n",
691 argv[1], argv[0]);
692 return -1;
693 }
694
695 return 0;
696}
697
698static int net_groupmap_delmem(struct net_context *c, int argc, const char **argv)
699{
700 DOM_SID alias, member;
701
702 if ( (argc != 2) ||
703 c->display_usage ||
704 !string_to_sid(&alias, argv[0]) ||
705 !string_to_sid(&member, argv[1]) ) {
706 d_printf("Usage: net groupmap delmem alias-sid member-sid\n");
707 return -1;
708 }
709
710 if (!NT_STATUS_IS_OK(pdb_del_aliasmem(&alias, &member))) {
711 d_fprintf(stderr, "Could not delete sid %s from alias %s\n",
712 argv[1], argv[0]);
713 return -1;
714 }
715
716 return 0;
717}
718
719static int net_groupmap_listmem(struct net_context *c, int argc, const char **argv)
720{
721 DOM_SID alias;
722 DOM_SID *members;
723 size_t i, num;
724
725 if ( (argc != 1) ||
726 c->display_usage ||
727 !string_to_sid(&alias, argv[0]) ) {
728 d_printf("Usage: net groupmap listmem alias-sid\n");
729 return -1;
730 }
731
732 members = NULL;
733 num = 0;
734
735 if (!NT_STATUS_IS_OK(pdb_enum_aliasmem(&alias, &members, &num))) {
736 d_fprintf(stderr, "Could not list members for sid %s\n", argv[0]);
737 return -1;
738 }
739
740 for (i = 0; i < num; i++) {
741 printf("%s\n", sid_string_tos(&(members[i])));
742 }
743
744 TALLOC_FREE(members);
745
746 return 0;
747}
748
749static bool print_alias_memberships(TALLOC_CTX *mem_ctx,
750 const DOM_SID *domain_sid,
751 const DOM_SID *member)
752{
753 uint32 *alias_rids;
754 size_t i, num_alias_rids;
755
756 alias_rids = NULL;
757 num_alias_rids = 0;
758
759 if (!NT_STATUS_IS_OK(pdb_enum_alias_memberships(
760 mem_ctx, domain_sid, member, 1,
761 &alias_rids, &num_alias_rids))) {
762 d_fprintf(stderr, "Could not list memberships for sid %s\n",
763 sid_string_tos(member));
764 return false;
765 }
766
767 for (i = 0; i < num_alias_rids; i++) {
768 DOM_SID alias;
769 sid_copy(&alias, domain_sid);
770 sid_append_rid(&alias, alias_rids[i]);
771 printf("%s\n", sid_string_tos(&alias));
772 }
773
774 return true;
775}
776
777static int net_groupmap_memberships(struct net_context *c, int argc, const char **argv)
778{
779 TALLOC_CTX *mem_ctx;
780 DOM_SID *domain_sid, *builtin_sid, member;
781
782 if ( (argc != 1) ||
783 c->display_usage ||
784 !string_to_sid(&member, argv[0]) ) {
785 d_printf("Usage: net groupmap memberof sid\n");
786 return -1;
787 }
788
789 mem_ctx = talloc_init("net_groupmap_memberships");
790 if (mem_ctx == NULL) {
791 d_fprintf(stderr, "talloc_init failed\n");
792 return -1;
793 }
794
795 domain_sid = get_global_sam_sid();
796 builtin_sid = string_sid_talloc(mem_ctx, "S-1-5-32");
797 if ((domain_sid == NULL) || (builtin_sid == NULL)) {
798 d_fprintf(stderr, "Could not get domain sid\n");
799 return -1;
800 }
801
802 if (!print_alias_memberships(mem_ctx, domain_sid, &member) ||
803 !print_alias_memberships(mem_ctx, builtin_sid, &member))
804 return -1;
805
806 talloc_destroy(mem_ctx);
807
808 return 0;
809}
810
811/***********************************************************
812 migrated functionality from smbgroupedit
813 **********************************************************/
814int net_groupmap(struct net_context *c, int argc, const char **argv)
815{
816 struct functable func[] = {
817 {
818 "add",
819 net_groupmap_add,
820 NET_TRANSPORT_LOCAL,
821 "Create a new group mapping",
822 "net groupmap add\n"
823 " Create a new group mapping"
824 },
825 {
826 "modify",
827 net_groupmap_modify,
828 NET_TRANSPORT_LOCAL,
829 "Update a group mapping",
830 "net groupmap modify\n"
831 " Modify an existing group mapping"
832 },
833 {
834 "delete",
835 net_groupmap_delete,
836 NET_TRANSPORT_LOCAL,
837 "Remove a group mapping",
838 "net groupmap delete\n"
839 " Remove a group mapping"
840 },
841 {
842 "set",
843 net_groupmap_set,
844 NET_TRANSPORT_LOCAL,
845 "Set group mapping",
846 "net groupmap set\n"
847 " Set a group mapping"
848 },
849 {
850 "cleanup",
851 net_groupmap_cleanup,
852 NET_TRANSPORT_LOCAL,
853 "Remove foreign group mapping entries",
854 "net groupmap cleanup\n"
855 " Remove foreign group mapping entries"
856 },
857 {
858 "addmem",
859 net_groupmap_addmem,
860 NET_TRANSPORT_LOCAL,
861 "Add a foreign alias member",
862 "net groupmap addmem\n"
863 " Add a foreign alias member"
864 },
865 {
866 "delmem",
867 net_groupmap_delmem,
868 NET_TRANSPORT_LOCAL,
869 "Delete foreign alias member",
870 "net groupmap delmem\n"
871 " Delete foreign alias member"
872 },
873 {
874 "listmem",
875 net_groupmap_listmem,
876 NET_TRANSPORT_LOCAL,
877 "List foreign group members",
878 "net groupmap listmem\n"
879 " List foreign alias members"
880 },
881 {
882 "memberships",
883 net_groupmap_memberships,
884 NET_TRANSPORT_LOCAL,
885 "List foreign group memberships",
886 "net groupmap memberships\n"
887 " List foreign group memberships"
888 },
889 {
890 "list",
891 net_groupmap_list,
892 NET_TRANSPORT_LOCAL,
893 "List current group map",
894 "net groupmap list\n"
895 " List current group map"
896 },
897 {NULL, NULL, 0, NULL, NULL}
898 };
899
900 /* we shouldn't have silly checks like this */
901 if (getuid() != 0) {
902 d_fprintf(stderr, "You must be root to edit group mappings.\n");
903 return -1;
904 }
905
906 return net_run_function(c,argc, argv, "net groupmap", func);
907}
908
Note: See TracBrowser for help on using the repository browser.