1 | /*
|
---|
2 | * Unix SMB/CIFS implementation.
|
---|
3 | * RPC Pipe client / server routines
|
---|
4 | * Copyright (C) Andrew Tridgell 1992-2000,
|
---|
5 | * Copyright (C) Jean François Micouleau 1998-2001.
|
---|
6 | * Copyright (C) Volker Lendecke 2006.
|
---|
7 | * Copyright (C) Gerald Carter 2006.
|
---|
8 | *
|
---|
9 | * This program is free software; you can redistribute it and/or modify
|
---|
10 | * it under the terms of the GNU General Public License as published by
|
---|
11 | * the Free Software Foundation; either version 2 of the License, or
|
---|
12 | * (at your option) any later version.
|
---|
13 | *
|
---|
14 | * This program is distributed in the hope that it will be useful,
|
---|
15 | * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
---|
16 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
---|
17 | * GNU General Public License for more details.
|
---|
18 | *
|
---|
19 | * You should have received a copy of the GNU General Public License
|
---|
20 | * along with this program; if not, write to the Free Software
|
---|
21 | * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
|
---|
22 | */
|
---|
23 |
|
---|
24 | #include "includes.h"
|
---|
25 | #include "groupdb/mapping.h"
|
---|
26 |
|
---|
27 | /****************************************************************************
|
---|
28 | initialise first time the mapping list
|
---|
29 | ****************************************************************************/
|
---|
30 | NTSTATUS add_initial_entry(gid_t gid, const char *sid, enum lsa_SidType sid_name_use, const char *nt_name, const char *comment)
|
---|
31 | {
|
---|
32 | GROUP_MAP map;
|
---|
33 |
|
---|
34 | if(!init_group_mapping()) {
|
---|
35 | DEBUG(0,("failed to initialize group mapping\n"));
|
---|
36 | return NT_STATUS_UNSUCCESSFUL;
|
---|
37 | }
|
---|
38 |
|
---|
39 | map.gid=gid;
|
---|
40 | if (!string_to_sid(&map.sid, sid)) {
|
---|
41 | DEBUG(0, ("string_to_sid failed: %s", sid));
|
---|
42 | return NT_STATUS_UNSUCCESSFUL;
|
---|
43 | }
|
---|
44 |
|
---|
45 | map.sid_name_use=sid_name_use;
|
---|
46 | fstrcpy(map.nt_name, nt_name);
|
---|
47 | fstrcpy(map.comment, comment);
|
---|
48 |
|
---|
49 | return pdb_add_group_mapping_entry(&map);
|
---|
50 | }
|
---|
51 |
|
---|
52 | /****************************************************************************
|
---|
53 | Map a unix group to a newly created mapping
|
---|
54 | ****************************************************************************/
|
---|
55 | NTSTATUS map_unix_group(const struct group *grp, GROUP_MAP *pmap)
|
---|
56 | {
|
---|
57 | NTSTATUS status;
|
---|
58 | GROUP_MAP map;
|
---|
59 | const char *grpname, *dom, *name;
|
---|
60 | uint32 rid;
|
---|
61 |
|
---|
62 | if (pdb_getgrgid(&map, grp->gr_gid)) {
|
---|
63 | return NT_STATUS_GROUP_EXISTS;
|
---|
64 | }
|
---|
65 |
|
---|
66 | map.gid = grp->gr_gid;
|
---|
67 | grpname = grp->gr_name;
|
---|
68 |
|
---|
69 | if (lookup_name(tmp_talloc_ctx(), grpname, LOOKUP_NAME_ISOLATED,
|
---|
70 | &dom, &name, NULL, NULL)) {
|
---|
71 |
|
---|
72 | const char *tmp = talloc_asprintf(
|
---|
73 | tmp_talloc_ctx(), "Unix Group %s", grp->gr_name);
|
---|
74 |
|
---|
75 | DEBUG(5, ("%s exists as %s\\%s, retrying as \"%s\"\n",
|
---|
76 | grpname, dom, name, tmp));
|
---|
77 | grpname = tmp;
|
---|
78 | }
|
---|
79 |
|
---|
80 | if (lookup_name(tmp_talloc_ctx(), grpname, LOOKUP_NAME_ISOLATED,
|
---|
81 | NULL, NULL, NULL, NULL)) {
|
---|
82 | DEBUG(3, ("\"%s\" exists, can't map it\n", grp->gr_name));
|
---|
83 | return NT_STATUS_GROUP_EXISTS;
|
---|
84 | }
|
---|
85 |
|
---|
86 | fstrcpy(map.nt_name, grpname);
|
---|
87 |
|
---|
88 | if (pdb_rid_algorithm()) {
|
---|
89 | rid = algorithmic_pdb_gid_to_group_rid( grp->gr_gid );
|
---|
90 | } else {
|
---|
91 | if (!pdb_new_rid(&rid)) {
|
---|
92 | DEBUG(3, ("Could not get a new RID for %s\n",
|
---|
93 | grp->gr_name));
|
---|
94 | return NT_STATUS_ACCESS_DENIED;
|
---|
95 | }
|
---|
96 | }
|
---|
97 |
|
---|
98 | sid_compose(&map.sid, get_global_sam_sid(), rid);
|
---|
99 | map.sid_name_use = SID_NAME_DOM_GRP;
|
---|
100 | fstrcpy(map.comment, talloc_asprintf(tmp_talloc_ctx(), "Unix Group %s",
|
---|
101 | grp->gr_name));
|
---|
102 |
|
---|
103 | status = pdb_add_group_mapping_entry(&map);
|
---|
104 | if (NT_STATUS_IS_OK(status)) {
|
---|
105 | *pmap = map;
|
---|
106 | }
|
---|
107 | return status;
|
---|
108 | }
|
---|
109 |
|
---|
110 |
|
---|
111 |
|
---|
112 |
|
---|
113 |
|
---|
114 |
|
---|
115 |
|
---|
116 | static NTSTATUS alias_memberships(const DOM_SID *members, size_t num_members,
|
---|
117 | DOM_SID **sids, size_t *num)
|
---|
118 | {
|
---|
119 | size_t i;
|
---|
120 |
|
---|
121 | *num = 0;
|
---|
122 | *sids = NULL;
|
---|
123 |
|
---|
124 | for (i=0; i<num_members; i++) {
|
---|
125 | NTSTATUS status = one_alias_membership(&members[i], sids, num);
|
---|
126 | if (!NT_STATUS_IS_OK(status))
|
---|
127 | return status;
|
---|
128 | }
|
---|
129 | return NT_STATUS_OK;
|
---|
130 | }
|
---|
131 |
|
---|
132 | struct aliasmem_closure {
|
---|
133 | const DOM_SID *alias;
|
---|
134 | DOM_SID **sids;
|
---|
135 | size_t *num;
|
---|
136 | };
|
---|
137 |
|
---|
138 |
|
---|
139 |
|
---|
140 | /*
|
---|
141 | *
|
---|
142 | * High level functions
|
---|
143 | * better to use them than the lower ones.
|
---|
144 | *
|
---|
145 | * we are checking if the group is in the mapping file
|
---|
146 | * and if the group is an existing unix group
|
---|
147 | *
|
---|
148 | */
|
---|
149 |
|
---|
150 | /* get a domain group from it's SID */
|
---|
151 |
|
---|
152 | BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map)
|
---|
153 | {
|
---|
154 | struct group *grp;
|
---|
155 | BOOL ret;
|
---|
156 |
|
---|
157 | if(!init_group_mapping()) {
|
---|
158 | DEBUG(0,("failed to initialize group mapping\n"));
|
---|
159 | return(False);
|
---|
160 | }
|
---|
161 |
|
---|
162 | DEBUG(10, ("get_domain_group_from_sid\n"));
|
---|
163 |
|
---|
164 | /* if the group is NOT in the database, it CAN NOT be a domain group */
|
---|
165 |
|
---|
166 | become_root();
|
---|
167 | ret = pdb_getgrsid(map, sid);
|
---|
168 | unbecome_root();
|
---|
169 |
|
---|
170 | /* special case check for rid 513 */
|
---|
171 |
|
---|
172 | if ( !ret ) {
|
---|
173 | uint32 rid;
|
---|
174 |
|
---|
175 | sid_peek_rid( &sid, &rid );
|
---|
176 |
|
---|
177 | if ( rid == DOMAIN_GROUP_RID_USERS ) {
|
---|
178 | fstrcpy( map->nt_name, "None" );
|
---|
179 | fstrcpy( map->comment, "Ordinary Users" );
|
---|
180 | sid_copy( &map->sid, &sid );
|
---|
181 | map->sid_name_use = SID_NAME_DOM_GRP;
|
---|
182 | map->gid = (gid_t)-1;
|
---|
183 |
|
---|
184 | return True;
|
---|
185 | }
|
---|
186 |
|
---|
187 | return False;
|
---|
188 | }
|
---|
189 |
|
---|
190 | DEBUG(10, ("get_domain_group_from_sid: SID found in the TDB\n"));
|
---|
191 |
|
---|
192 | /* if it's not a domain group, continue */
|
---|
193 | if (map->sid_name_use!=SID_NAME_DOM_GRP) {
|
---|
194 | return False;
|
---|
195 | }
|
---|
196 |
|
---|
197 | DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
|
---|
198 |
|
---|
199 | if (map->gid==-1) {
|
---|
200 | return False;
|
---|
201 | }
|
---|
202 |
|
---|
203 | DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid));
|
---|
204 |
|
---|
205 | grp = getgrgid(map->gid);
|
---|
206 | if ( !grp ) {
|
---|
207 | DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n"));
|
---|
208 | return False;
|
---|
209 | }
|
---|
210 |
|
---|
211 | DEBUG(10, ("get_domain_group_from_sid: gid exists in UNIX security\n"));
|
---|
212 |
|
---|
213 | return True;
|
---|
214 | }
|
---|
215 |
|
---|
216 | /****************************************************************************
|
---|
217 | Create a UNIX group on demand.
|
---|
218 | ****************************************************************************/
|
---|
219 |
|
---|
220 | int smb_create_group(const char *unix_group, gid_t *new_gid)
|
---|
221 | {
|
---|
222 | pstring add_script;
|
---|
223 | int ret = -1;
|
---|
224 | int fd = 0;
|
---|
225 |
|
---|
226 | *new_gid = 0;
|
---|
227 |
|
---|
228 | /* defer to scripts */
|
---|
229 |
|
---|
230 | if ( *lp_addgroup_script() ) {
|
---|
231 | pstrcpy(add_script, lp_addgroup_script());
|
---|
232 | pstring_sub(add_script, "%g", unix_group);
|
---|
233 | ret = smbrun(add_script, &fd);
|
---|
234 | DEBUG(ret ? 0 : 3,("smb_create_group: Running the command `%s' gave %d\n",add_script,ret));
|
---|
235 | if (ret == 0) {
|
---|
236 | smb_nscd_flush_group_cache();
|
---|
237 | }
|
---|
238 | if (ret != 0)
|
---|
239 | return ret;
|
---|
240 |
|
---|
241 | if (fd != 0) {
|
---|
242 | fstring output;
|
---|
243 |
|
---|
244 | *new_gid = 0;
|
---|
245 | if (read(fd, output, sizeof(output)) > 0) {
|
---|
246 | *new_gid = (gid_t)strtoul(output, NULL, 10);
|
---|
247 | }
|
---|
248 |
|
---|
249 | close(fd);
|
---|
250 | }
|
---|
251 |
|
---|
252 | }
|
---|
253 |
|
---|
254 | if (*new_gid == 0) {
|
---|
255 | struct group *grp = getgrnam(unix_group);
|
---|
256 |
|
---|
257 | if (grp != NULL)
|
---|
258 | *new_gid = grp->gr_gid;
|
---|
259 | }
|
---|
260 |
|
---|
261 | return ret;
|
---|
262 | }
|
---|
263 |
|
---|
264 | /****************************************************************************
|
---|
265 | Delete a UNIX group on demand.
|
---|
266 | ****************************************************************************/
|
---|
267 |
|
---|
268 | int smb_delete_group(const char *unix_group)
|
---|
269 | {
|
---|
270 | pstring del_script;
|
---|
271 | int ret;
|
---|
272 |
|
---|
273 | /* defer to scripts */
|
---|
274 |
|
---|
275 | if ( *lp_delgroup_script() ) {
|
---|
276 | pstrcpy(del_script, lp_delgroup_script());
|
---|
277 | pstring_sub(del_script, "%g", unix_group);
|
---|
278 | ret = smbrun(del_script,NULL);
|
---|
279 | DEBUG(ret ? 0 : 3,("smb_delete_group: Running the command `%s' gave %d\n",del_script,ret));
|
---|
280 | if (ret == 0) {
|
---|
281 | smb_nscd_flush_group_cache();
|
---|
282 | }
|
---|
283 | return ret;
|
---|
284 | }
|
---|
285 |
|
---|
286 | return -1;
|
---|
287 | }
|
---|
288 |
|
---|
289 | /****************************************************************************
|
---|
290 | Set a user's primary UNIX group.
|
---|
291 | ****************************************************************************/
|
---|
292 | int smb_set_primary_group(const char *unix_group, const char* unix_user)
|
---|
293 | {
|
---|
294 | pstring add_script;
|
---|
295 | int ret;
|
---|
296 |
|
---|
297 | /* defer to scripts */
|
---|
298 |
|
---|
299 | if ( *lp_setprimarygroup_script() ) {
|
---|
300 | pstrcpy(add_script, lp_setprimarygroup_script());
|
---|
301 | all_string_sub(add_script, "%g", unix_group, sizeof(add_script));
|
---|
302 | all_string_sub(add_script, "%u", unix_user, sizeof(add_script));
|
---|
303 | ret = smbrun(add_script,NULL);
|
---|
304 | flush_pwnam_cache();
|
---|
305 | DEBUG(ret ? 0 : 3,("smb_set_primary_group: "
|
---|
306 | "Running the command `%s' gave %d\n",add_script,ret));
|
---|
307 | if (ret == 0) {
|
---|
308 | smb_nscd_flush_group_cache();
|
---|
309 | }
|
---|
310 | return ret;
|
---|
311 | }
|
---|
312 |
|
---|
313 | return -1;
|
---|
314 | }
|
---|
315 |
|
---|
316 | /****************************************************************************
|
---|
317 | Add a user to a UNIX group.
|
---|
318 | ****************************************************************************/
|
---|
319 |
|
---|
320 | int smb_add_user_group(const char *unix_group, const char *unix_user)
|
---|
321 | {
|
---|
322 | pstring add_script;
|
---|
323 | int ret;
|
---|
324 |
|
---|
325 | /* defer to scripts */
|
---|
326 |
|
---|
327 | if ( *lp_addusertogroup_script() ) {
|
---|
328 | pstrcpy(add_script, lp_addusertogroup_script());
|
---|
329 | pstring_sub(add_script, "%g", unix_group);
|
---|
330 | pstring_sub(add_script, "%u", unix_user);
|
---|
331 | ret = smbrun(add_script,NULL);
|
---|
332 | DEBUG(ret ? 0 : 3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script,ret));
|
---|
333 | if (ret == 0) {
|
---|
334 | smb_nscd_flush_group_cache();
|
---|
335 | }
|
---|
336 | return ret;
|
---|
337 | }
|
---|
338 |
|
---|
339 | return -1;
|
---|
340 | }
|
---|
341 |
|
---|
342 | /****************************************************************************
|
---|
343 | Delete a user from a UNIX group
|
---|
344 | ****************************************************************************/
|
---|
345 |
|
---|
346 | int smb_delete_user_group(const char *unix_group, const char *unix_user)
|
---|
347 | {
|
---|
348 | pstring del_script;
|
---|
349 | int ret;
|
---|
350 |
|
---|
351 | /* defer to scripts */
|
---|
352 |
|
---|
353 | if ( *lp_deluserfromgroup_script() ) {
|
---|
354 | pstrcpy(del_script, lp_deluserfromgroup_script());
|
---|
355 | pstring_sub(del_script, "%g", unix_group);
|
---|
356 | pstring_sub(del_script, "%u", unix_user);
|
---|
357 | ret = smbrun(del_script,NULL);
|
---|
358 | DEBUG(ret ? 0 : 3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script,ret));
|
---|
359 | if (ret == 0) {
|
---|
360 | smb_nscd_flush_group_cache();
|
---|
361 | }
|
---|
362 | return ret;
|
---|
363 | }
|
---|
364 |
|
---|
365 | return -1;
|
---|
366 | }
|
---|
367 |
|
---|
368 |
|
---|
369 | NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
|
---|
370 | DOM_SID sid)
|
---|
371 | {
|
---|
372 | return get_group_map_from_sid(sid, map) ?
|
---|
373 | NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
|
---|
374 | }
|
---|
375 |
|
---|
376 | NTSTATUS pdb_default_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
|
---|
377 | gid_t gid)
|
---|
378 | {
|
---|
379 | return get_group_map_from_gid(gid, map) ?
|
---|
380 | NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
|
---|
381 | }
|
---|
382 |
|
---|
383 | NTSTATUS pdb_default_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
|
---|
384 | const char *name)
|
---|
385 | {
|
---|
386 | return get_group_map_from_ntname(name, map) ?
|
---|
387 | NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
|
---|
388 | }
|
---|
389 |
|
---|
390 | NTSTATUS pdb_default_add_group_mapping_entry(struct pdb_methods *methods,
|
---|
391 | GROUP_MAP *map)
|
---|
392 | {
|
---|
393 | return add_mapping_entry(map, TDB_INSERT) ?
|
---|
394 | NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
|
---|
395 | }
|
---|
396 |
|
---|
397 | NTSTATUS pdb_default_update_group_mapping_entry(struct pdb_methods *methods,
|
---|
398 | GROUP_MAP *map)
|
---|
399 | {
|
---|
400 | return add_mapping_entry(map, TDB_REPLACE) ?
|
---|
401 | NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
|
---|
402 | }
|
---|
403 |
|
---|
404 | NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods,
|
---|
405 | DOM_SID sid)
|
---|
406 | {
|
---|
407 | return group_map_remove(&sid) ?
|
---|
408 | NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
|
---|
409 | }
|
---|
410 |
|
---|
411 | NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
|
---|
412 | const DOM_SID *sid, enum lsa_SidType sid_name_use,
|
---|
413 | GROUP_MAP **pp_rmap, size_t *p_num_entries,
|
---|
414 | BOOL unix_only)
|
---|
415 | {
|
---|
416 | return enum_group_mapping(sid, sid_name_use, pp_rmap, p_num_entries, unix_only) ?
|
---|
417 | NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
|
---|
418 | }
|
---|
419 |
|
---|
420 | NTSTATUS pdb_default_find_alias(struct pdb_methods *methods,
|
---|
421 | const char *name, DOM_SID *sid)
|
---|
422 | {
|
---|
423 | GROUP_MAP map;
|
---|
424 |
|
---|
425 | if (!pdb_getgrnam(&map, name))
|
---|
426 | return NT_STATUS_NO_SUCH_ALIAS;
|
---|
427 |
|
---|
428 | if ((map.sid_name_use != SID_NAME_WKN_GRP) &&
|
---|
429 | (map.sid_name_use != SID_NAME_ALIAS))
|
---|
430 | return NT_STATUS_OBJECT_TYPE_MISMATCH;
|
---|
431 |
|
---|
432 | sid_copy(sid, &map.sid);
|
---|
433 | return NT_STATUS_OK;
|
---|
434 | }
|
---|
435 |
|
---|
436 | NTSTATUS pdb_default_create_alias(struct pdb_methods *methods,
|
---|
437 | const char *name, uint32 *rid)
|
---|
438 | {
|
---|
439 | DOM_SID sid;
|
---|
440 | enum lsa_SidType type;
|
---|
441 | uint32 new_rid;
|
---|
442 | gid_t gid;
|
---|
443 | BOOL exists;
|
---|
444 | GROUP_MAP map;
|
---|
445 | TALLOC_CTX *mem_ctx;
|
---|
446 | NTSTATUS status;
|
---|
447 |
|
---|
448 | DEBUG(10, ("Trying to create alias %s\n", name));
|
---|
449 |
|
---|
450 | mem_ctx = talloc_new(NULL);
|
---|
451 | if (mem_ctx == NULL) {
|
---|
452 | return NT_STATUS_NO_MEMORY;
|
---|
453 | }
|
---|
454 |
|
---|
455 | exists = lookup_name(mem_ctx, name, LOOKUP_NAME_ISOLATED,
|
---|
456 | NULL, NULL, &sid, &type);
|
---|
457 | TALLOC_FREE(mem_ctx);
|
---|
458 |
|
---|
459 | if (exists) {
|
---|
460 | return NT_STATUS_ALIAS_EXISTS;
|
---|
461 | }
|
---|
462 |
|
---|
463 | if (!winbind_allocate_gid(&gid)) {
|
---|
464 | DEBUG(3, ("Could not get a gid out of winbind\n"));
|
---|
465 | return NT_STATUS_ACCESS_DENIED;
|
---|
466 | }
|
---|
467 |
|
---|
468 | if (!pdb_new_rid(&new_rid)) {
|
---|
469 | DEBUG(0, ("Could not allocate a RID -- wasted a gid :-(\n"));
|
---|
470 | return NT_STATUS_ACCESS_DENIED;
|
---|
471 | }
|
---|
472 |
|
---|
473 | DEBUG(10, ("Creating alias %s with gid %d and rid %d\n",
|
---|
474 | name, gid, new_rid));
|
---|
475 |
|
---|
476 | sid_copy(&sid, get_global_sam_sid());
|
---|
477 | sid_append_rid(&sid, new_rid);
|
---|
478 |
|
---|
479 | map.gid = gid;
|
---|
480 | sid_copy(&map.sid, &sid);
|
---|
481 | map.sid_name_use = SID_NAME_ALIAS;
|
---|
482 | fstrcpy(map.nt_name, name);
|
---|
483 | fstrcpy(map.comment, "");
|
---|
484 |
|
---|
485 | status = pdb_add_group_mapping_entry(&map);
|
---|
486 |
|
---|
487 | if (!NT_STATUS_IS_OK(status)) {
|
---|
488 | DEBUG(0, ("Could not add group mapping entry for alias %s "
|
---|
489 | "(%s)\n", name, nt_errstr(status)));
|
---|
490 | return status;
|
---|
491 | }
|
---|
492 |
|
---|
493 | *rid = new_rid;
|
---|
494 |
|
---|
495 | return NT_STATUS_OK;
|
---|
496 | }
|
---|
497 |
|
---|
498 | NTSTATUS pdb_default_delete_alias(struct pdb_methods *methods,
|
---|
499 | const DOM_SID *sid)
|
---|
500 | {
|
---|
501 | return pdb_delete_group_mapping_entry(*sid);
|
---|
502 | }
|
---|
503 |
|
---|
504 | NTSTATUS pdb_default_get_aliasinfo(struct pdb_methods *methods,
|
---|
505 | const DOM_SID *sid,
|
---|
506 | struct acct_info *info)
|
---|
507 | {
|
---|
508 | GROUP_MAP map;
|
---|
509 |
|
---|
510 | if (!pdb_getgrsid(&map, *sid))
|
---|
511 | return NT_STATUS_NO_SUCH_ALIAS;
|
---|
512 |
|
---|
513 | if ((map.sid_name_use != SID_NAME_ALIAS) &&
|
---|
514 | (map.sid_name_use != SID_NAME_WKN_GRP)) {
|
---|
515 | DEBUG(2, ("%s is a %s, expected an alias\n",
|
---|
516 | sid_string_static(sid),
|
---|
517 | sid_type_lookup(map.sid_name_use)));
|
---|
518 | return NT_STATUS_NO_SUCH_ALIAS;
|
---|
519 | }
|
---|
520 |
|
---|
521 | fstrcpy(info->acct_name, map.nt_name);
|
---|
522 | fstrcpy(info->acct_desc, map.comment);
|
---|
523 | sid_peek_rid(&map.sid, &info->rid);
|
---|
524 | return NT_STATUS_OK;
|
---|
525 | }
|
---|
526 |
|
---|
527 | NTSTATUS pdb_default_set_aliasinfo(struct pdb_methods *methods,
|
---|
528 | const DOM_SID *sid,
|
---|
529 | struct acct_info *info)
|
---|
530 | {
|
---|
531 | GROUP_MAP map;
|
---|
532 |
|
---|
533 | if (!pdb_getgrsid(&map, *sid))
|
---|
534 | return NT_STATUS_NO_SUCH_ALIAS;
|
---|
535 |
|
---|
536 | fstrcpy(map.nt_name, info->acct_name);
|
---|
537 | fstrcpy(map.comment, info->acct_desc);
|
---|
538 |
|
---|
539 | return pdb_update_group_mapping_entry(&map);
|
---|
540 | }
|
---|
541 |
|
---|
542 | NTSTATUS pdb_default_add_aliasmem(struct pdb_methods *methods,
|
---|
543 | const DOM_SID *alias, const DOM_SID *member)
|
---|
544 | {
|
---|
545 | return add_aliasmem(alias, member);
|
---|
546 | }
|
---|
547 |
|
---|
548 | NTSTATUS pdb_default_del_aliasmem(struct pdb_methods *methods,
|
---|
549 | const DOM_SID *alias, const DOM_SID *member)
|
---|
550 | {
|
---|
551 | return del_aliasmem(alias, member);
|
---|
552 | }
|
---|
553 |
|
---|
554 | NTSTATUS pdb_default_enum_aliasmem(struct pdb_methods *methods,
|
---|
555 | const DOM_SID *alias, DOM_SID **pp_members,
|
---|
556 | size_t *p_num_members)
|
---|
557 | {
|
---|
558 | return enum_aliasmem(alias, pp_members, p_num_members);
|
---|
559 | }
|
---|
560 |
|
---|
561 | NTSTATUS pdb_default_alias_memberships(struct pdb_methods *methods,
|
---|
562 | TALLOC_CTX *mem_ctx,
|
---|
563 | const DOM_SID *domain_sid,
|
---|
564 | const DOM_SID *members,
|
---|
565 | size_t num_members,
|
---|
566 | uint32 **pp_alias_rids,
|
---|
567 | size_t *p_num_alias_rids)
|
---|
568 | {
|
---|
569 | DOM_SID *alias_sids;
|
---|
570 | size_t i, num_alias_sids;
|
---|
571 | NTSTATUS result;
|
---|
572 |
|
---|
573 | alias_sids = NULL;
|
---|
574 | num_alias_sids = 0;
|
---|
575 |
|
---|
576 | result = alias_memberships(members, num_members,
|
---|
577 | &alias_sids, &num_alias_sids);
|
---|
578 |
|
---|
579 | if (!NT_STATUS_IS_OK(result))
|
---|
580 | return result;
|
---|
581 |
|
---|
582 | *p_num_alias_rids = 0;
|
---|
583 |
|
---|
584 | if (num_alias_sids == 0) {
|
---|
585 | TALLOC_FREE(alias_sids);
|
---|
586 | return NT_STATUS_OK;
|
---|
587 | }
|
---|
588 |
|
---|
589 | *pp_alias_rids = TALLOC_ARRAY(mem_ctx, uint32, num_alias_sids);
|
---|
590 | if (*pp_alias_rids == NULL)
|
---|
591 | return NT_STATUS_NO_MEMORY;
|
---|
592 |
|
---|
593 | for (i=0; i<num_alias_sids; i++) {
|
---|
594 | if (!sid_peek_check_rid(domain_sid, &alias_sids[i],
|
---|
595 | &(*pp_alias_rids)[*p_num_alias_rids]))
|
---|
596 | continue;
|
---|
597 | *p_num_alias_rids += 1;
|
---|
598 | }
|
---|
599 |
|
---|
600 | TALLOC_FREE(alias_sids);
|
---|
601 |
|
---|
602 | return NT_STATUS_OK;
|
---|
603 | }
|
---|
604 |
|
---|
605 | /**********************************************************************
|
---|
606 | no ops for passdb backends that don't implement group mapping
|
---|
607 | *********************************************************************/
|
---|
608 |
|
---|
609 | NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
|
---|
610 | DOM_SID sid)
|
---|
611 | {
|
---|
612 | return NT_STATUS_UNSUCCESSFUL;
|
---|
613 | }
|
---|
614 |
|
---|
615 | NTSTATUS pdb_nop_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
|
---|
616 | gid_t gid)
|
---|
617 | {
|
---|
618 | return NT_STATUS_UNSUCCESSFUL;
|
---|
619 | }
|
---|
620 |
|
---|
621 | NTSTATUS pdb_nop_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
|
---|
622 | const char *name)
|
---|
623 | {
|
---|
624 | return NT_STATUS_UNSUCCESSFUL;
|
---|
625 | }
|
---|
626 |
|
---|
627 | NTSTATUS pdb_nop_add_group_mapping_entry(struct pdb_methods *methods,
|
---|
628 | GROUP_MAP *map)
|
---|
629 | {
|
---|
630 | return NT_STATUS_UNSUCCESSFUL;
|
---|
631 | }
|
---|
632 |
|
---|
633 | NTSTATUS pdb_nop_update_group_mapping_entry(struct pdb_methods *methods,
|
---|
634 | GROUP_MAP *map)
|
---|
635 | {
|
---|
636 | return NT_STATUS_UNSUCCESSFUL;
|
---|
637 | }
|
---|
638 |
|
---|
639 | NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods,
|
---|
640 | DOM_SID sid)
|
---|
641 | {
|
---|
642 | return NT_STATUS_UNSUCCESSFUL;
|
---|
643 | }
|
---|
644 |
|
---|
645 | NTSTATUS pdb_nop_enum_group_mapping(struct pdb_methods *methods,
|
---|
646 | enum lsa_SidType sid_name_use,
|
---|
647 | GROUP_MAP **rmap, size_t *num_entries,
|
---|
648 | BOOL unix_only)
|
---|
649 | {
|
---|
650 | return NT_STATUS_UNSUCCESSFUL;
|
---|
651 | }
|
---|
652 |
|
---|
653 | /****************************************************************************
|
---|
654 | These need to be redirected through pdb_interface.c
|
---|
655 | ****************************************************************************/
|
---|
656 | BOOL pdb_get_dom_grp_info(const DOM_SID *sid, struct acct_info *info)
|
---|
657 | {
|
---|
658 | GROUP_MAP map;
|
---|
659 | BOOL res;
|
---|
660 |
|
---|
661 | become_root();
|
---|
662 | res = get_domain_group_from_sid(*sid, &map);
|
---|
663 | unbecome_root();
|
---|
664 |
|
---|
665 | if (!res)
|
---|
666 | return False;
|
---|
667 |
|
---|
668 | fstrcpy(info->acct_name, map.nt_name);
|
---|
669 | fstrcpy(info->acct_desc, map.comment);
|
---|
670 | sid_peek_rid(sid, &info->rid);
|
---|
671 | return True;
|
---|
672 | }
|
---|
673 |
|
---|
674 | BOOL pdb_set_dom_grp_info(const DOM_SID *sid, const struct acct_info *info)
|
---|
675 | {
|
---|
676 | GROUP_MAP map;
|
---|
677 |
|
---|
678 | if (!get_domain_group_from_sid(*sid, &map))
|
---|
679 | return False;
|
---|
680 |
|
---|
681 | fstrcpy(map.nt_name, info->acct_name);
|
---|
682 | fstrcpy(map.comment, info->acct_desc);
|
---|
683 |
|
---|
684 | return NT_STATUS_IS_OK(pdb_update_group_mapping_entry(&map));
|
---|
685 | }
|
---|
686 |
|
---|
687 | /********************************************************************
|
---|
688 | Really just intended to be called by smbd
|
---|
689 | ********************************************************************/
|
---|
690 |
|
---|
691 | NTSTATUS pdb_create_builtin_alias(uint32 rid)
|
---|
692 | {
|
---|
693 | DOM_SID sid;
|
---|
694 | enum lsa_SidType type;
|
---|
695 | gid_t gid;
|
---|
696 | GROUP_MAP map;
|
---|
697 | TALLOC_CTX *mem_ctx;
|
---|
698 | NTSTATUS status;
|
---|
699 | const char *name = NULL;
|
---|
700 | fstring groupname;
|
---|
701 |
|
---|
702 | DEBUG(10, ("Trying to create builtin alias %d\n", rid));
|
---|
703 |
|
---|
704 | if ( !sid_compose( &sid, &global_sid_Builtin, rid ) ) {
|
---|
705 | return NT_STATUS_NO_SUCH_ALIAS;
|
---|
706 | }
|
---|
707 |
|
---|
708 | if ( (mem_ctx = talloc_new(NULL)) == NULL ) {
|
---|
709 | return NT_STATUS_NO_MEMORY;
|
---|
710 | }
|
---|
711 |
|
---|
712 | if ( !lookup_sid(mem_ctx, &sid, NULL, &name, &type) ) {
|
---|
713 | TALLOC_FREE( mem_ctx );
|
---|
714 | return NT_STATUS_NO_SUCH_ALIAS;
|
---|
715 | }
|
---|
716 |
|
---|
717 | /* validate RID so copy the name and move on */
|
---|
718 |
|
---|
719 | fstrcpy( groupname, name );
|
---|
720 | TALLOC_FREE( mem_ctx );
|
---|
721 |
|
---|
722 | if (!winbind_allocate_gid(&gid)) {
|
---|
723 | DEBUG(3, ("pdb_create_builtin_alias: Could not get a gid out of winbind\n"));
|
---|
724 | return NT_STATUS_ACCESS_DENIED;
|
---|
725 | }
|
---|
726 |
|
---|
727 | DEBUG(10,("Creating alias %s with gid %d\n", name, gid));
|
---|
728 |
|
---|
729 | map.gid = gid;
|
---|
730 | sid_copy(&map.sid, &sid);
|
---|
731 | map.sid_name_use = SID_NAME_ALIAS;
|
---|
732 | fstrcpy(map.nt_name, name);
|
---|
733 | fstrcpy(map.comment, "");
|
---|
734 |
|
---|
735 | status = pdb_add_group_mapping_entry(&map);
|
---|
736 |
|
---|
737 | if (!NT_STATUS_IS_OK(status)) {
|
---|
738 | DEBUG(0, ("pdb_create_builtin_alias: Could not add group mapping entry for alias %d "
|
---|
739 | "(%s)\n", rid, nt_errstr(status)));
|
---|
740 | }
|
---|
741 |
|
---|
742 | return status;
|
---|
743 | }
|
---|
744 |
|
---|
745 |
|
---|