source: vendor/current/source3/groupdb/mapping.c

Last change on this file was 988, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.3
File size: 20.1 KB
Line 
1/*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-2000,
5 * Copyright (C) Jean François Micouleau 1998-2001.
6 * Copyright (C) Volker Lendecke 2006.
7 * Copyright (C) Gerald Carter 2006.
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 3 of the License, or
12 * (at your option) any later version.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 */
22
23#include "includes.h"
24#include "system/passwd.h"
25#include "passdb.h"
26#include "groupdb/mapping.h"
27#include "../libcli/security/security.h"
28#include "lib/winbind_util.h"
29#include <tdb.h>
30#include "groupdb/mapping_tdb.h"
31
32static const struct mapping_backend *backend;
33
34/*
35 initialise a group mapping backend
36 */
37static bool init_group_mapping(void)
38{
39 if (backend != NULL) {
40 /* already initialised */
41 return True;
42 }
43
44 backend = groupdb_tdb_init();
45
46 return backend != NULL;
47}
48
49/****************************************************************************
50initialise first time the mapping list
51****************************************************************************/
52NTSTATUS add_initial_entry(gid_t gid, const char *sid, enum lsa_SidType sid_name_use, const char *nt_name, const char *comment)
53{
54 NTSTATUS status;
55 GROUP_MAP *map;
56
57 if(!init_group_mapping()) {
58 DEBUG(0,("failed to initialize group mapping\n"));
59 return NT_STATUS_UNSUCCESSFUL;
60 }
61
62 map = talloc_zero(NULL, GROUP_MAP);
63 if (!map) {
64 return NT_STATUS_NO_MEMORY;
65 }
66
67 map->gid=gid;
68 if (!string_to_sid(&map->sid, sid)) {
69 DEBUG(0, ("string_to_sid failed: %s", sid));
70 status = NT_STATUS_UNSUCCESSFUL;
71 goto done;
72 }
73
74 map->sid_name_use=sid_name_use;
75 map->nt_name = talloc_strdup(map, nt_name);
76 if (!map->nt_name) {
77 status = NT_STATUS_NO_MEMORY;
78 goto done;
79 }
80
81 if (comment) {
82 map->comment = talloc_strdup(map, comment);
83 } else {
84 map->comment = talloc_strdup(map, "");
85 }
86 if (!map->comment) {
87 status = NT_STATUS_NO_MEMORY;
88 goto done;
89 }
90
91 status = pdb_add_group_mapping_entry(map);
92
93done:
94 TALLOC_FREE(map);
95 return status;
96}
97
98static NTSTATUS alias_memberships(const struct dom_sid *members, size_t num_members,
99 struct dom_sid **sids, size_t *num)
100{
101 size_t i;
102
103 *num = 0;
104 *sids = NULL;
105
106 for (i=0; i<num_members; i++) {
107 NTSTATUS status = backend->one_alias_membership(&members[i], sids, num);
108 if (!NT_STATUS_IS_OK(status))
109 return status;
110 }
111 return NT_STATUS_OK;
112}
113
114struct aliasmem_closure {
115 const struct dom_sid *alias;
116 struct dom_sid **sids;
117 size_t *num;
118};
119
120
121
122/*
123 *
124 * High level functions
125 * better to use them than the lower ones.
126 *
127 * we are checking if the group is in the mapping file
128 * and if the group is an existing unix group
129 *
130 */
131
132/* get a domain group from it's SID */
133
134bool get_domain_group_from_sid(struct dom_sid sid, GROUP_MAP *map)
135{
136 struct group *grp;
137 bool ret;
138
139 if(!init_group_mapping()) {
140 DEBUG(0,("failed to initialize group mapping\n"));
141 return(False);
142 }
143
144 DEBUG(10, ("get_domain_group_from_sid\n"));
145
146 /* if the group is NOT in the database, it CAN NOT be a domain group */
147
148 become_root();
149 ret = pdb_getgrsid(map, sid);
150 unbecome_root();
151
152 /* special case check for rid 513 */
153
154 if ( !ret ) {
155 uint32_t rid;
156
157 sid_peek_rid( &sid, &rid );
158
159 if ( rid == DOMAIN_RID_USERS ) {
160 map->nt_name = talloc_strdup(map, "None");
161 if (!map->nt_name) {
162 return false;
163 }
164 map->comment = talloc_strdup(map, "Ordinary Users");
165 if (!map->comment) {
166 return false;
167 }
168 sid_copy( &map->sid, &sid );
169 map->sid_name_use = SID_NAME_DOM_GRP;
170 map->gid = (gid_t)-1;
171 return True;
172 }
173 return False;
174 }
175
176 DEBUG(10, ("get_domain_group_from_sid: SID found in passdb\n"));
177
178 /* if it's not a domain group, continue */
179 if (map->sid_name_use!=SID_NAME_DOM_GRP) {
180 return False;
181 }
182
183 DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
184
185 if (map->gid==-1) {
186 return False;
187 }
188
189 DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid));
190
191 grp = getgrgid(map->gid);
192 if ( !grp ) {
193 DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n"));
194 return False;
195 }
196
197 DEBUG(10, ("get_domain_group_from_sid: gid exists in UNIX security\n"));
198
199 return True;
200}
201
202/****************************************************************************
203 Create a UNIX group on demand.
204****************************************************************************/
205
206int smb_create_group(const char *unix_group, gid_t *new_gid)
207{
208 char *add_script = NULL;
209 int ret = -1;
210 int fd = 0;
211
212 *new_gid = 0;
213
214 /* defer to scripts */
215
216 if ( *lp_add_group_script(talloc_tos()) ) {
217 TALLOC_CTX *ctx = talloc_tos();
218
219 add_script = talloc_strdup(ctx,
220 lp_add_group_script(ctx));
221 if (!add_script) {
222 return -1;
223 }
224 add_script = talloc_string_sub(ctx,
225 add_script, "%g", unix_group);
226 if (!add_script) {
227 return -1;
228 }
229
230 ret = smbrun(add_script, &fd);
231 DEBUG(ret ? 0 : 3,("smb_create_group: Running the command `%s' gave %d\n",add_script,ret));
232 if (ret == 0) {
233 smb_nscd_flush_group_cache();
234 }
235 if (ret != 0)
236 return ret;
237
238 if (fd != 0) {
239 fstring output;
240
241 *new_gid = 0;
242 if (read(fd, output, sizeof(output)) > 0) {
243 *new_gid = (gid_t)strtoul(output, NULL, 10);
244 }
245
246 close(fd);
247 }
248
249 }
250
251 if (*new_gid == 0) {
252 struct group *grp = getgrnam(unix_group);
253
254 if (grp != NULL)
255 *new_gid = grp->gr_gid;
256 }
257
258 return ret;
259}
260
261/****************************************************************************
262 Delete a UNIX group on demand.
263****************************************************************************/
264
265int smb_delete_group(const char *unix_group)
266{
267 char *del_script = NULL;
268 int ret = -1;
269
270 /* defer to scripts */
271
272 if ( *lp_delete_group_script(talloc_tos()) ) {
273 TALLOC_CTX *ctx = talloc_tos();
274
275 del_script = talloc_strdup(ctx,
276 lp_delete_group_script(ctx));
277 if (!del_script) {
278 return -1;
279 }
280 del_script = talloc_string_sub(ctx,
281 del_script, "%g", unix_group);
282 if (!del_script) {
283 return -1;
284 }
285 ret = smbrun(del_script,NULL);
286 DEBUG(ret ? 0 : 3,("smb_delete_group: Running the command `%s' gave %d\n",del_script,ret));
287 if (ret == 0) {
288 smb_nscd_flush_group_cache();
289 }
290 return ret;
291 }
292
293 return -1;
294}
295
296/****************************************************************************
297 Set a user's primary UNIX group.
298****************************************************************************/
299
300int smb_set_primary_group(const char *unix_group, const char* unix_user)
301{
302 char *add_script = NULL;
303 int ret = -1;
304
305 /* defer to scripts */
306
307 if ( *lp_set_primary_group_script(talloc_tos()) ) {
308 TALLOC_CTX *ctx = talloc_tos();
309
310 add_script = talloc_strdup(ctx,
311 lp_set_primary_group_script(ctx));
312 if (!add_script) {
313 return -1;
314 }
315 add_script = talloc_all_string_sub(ctx,
316 add_script, "%g", unix_group);
317 if (!add_script) {
318 return -1;
319 }
320 add_script = talloc_string_sub(ctx,
321 add_script, "%u", unix_user);
322 if (!add_script) {
323 return -1;
324 }
325 ret = smbrun(add_script,NULL);
326 flush_pwnam_cache();
327 DEBUG(ret ? 0 : 3,("smb_set_primary_group: "
328 "Running the command `%s' gave %d\n",add_script,ret));
329 if (ret == 0) {
330 smb_nscd_flush_group_cache();
331 }
332 return ret;
333 }
334
335 return -1;
336}
337
338/****************************************************************************
339 Add a user to a UNIX group.
340****************************************************************************/
341
342int smb_add_user_group(const char *unix_group, const char *unix_user)
343{
344 char *add_script = NULL;
345 int ret = -1;
346
347 /* defer to scripts */
348
349 if ( *lp_add_user_to_group_script(talloc_tos()) ) {
350 TALLOC_CTX *ctx = talloc_tos();
351
352 add_script = talloc_strdup(ctx,
353 lp_add_user_to_group_script(ctx));
354 if (!add_script) {
355 return -1;
356 }
357 add_script = talloc_string_sub(ctx,
358 add_script, "%g", unix_group);
359 if (!add_script) {
360 return -1;
361 }
362 add_script = talloc_string_sub2(ctx,
363 add_script, "%u", unix_user, true, false, true);
364 if (!add_script) {
365 return -1;
366 }
367 ret = smbrun(add_script,NULL);
368 DEBUG(ret ? 0 : 3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script,ret));
369 if (ret == 0) {
370 smb_nscd_flush_group_cache();
371 }
372 return ret;
373 }
374
375 return -1;
376}
377
378/****************************************************************************
379 Delete a user from a UNIX group
380****************************************************************************/
381
382int smb_delete_user_group(const char *unix_group, const char *unix_user)
383{
384 char *del_script = NULL;
385 int ret = -1;
386
387 /* defer to scripts */
388
389 if ( *lp_delete_user_from_group_script(talloc_tos()) ) {
390 TALLOC_CTX *ctx = talloc_tos();
391
392 del_script = talloc_strdup(ctx,
393 lp_delete_user_from_group_script(ctx));
394 if (!del_script) {
395 return -1;
396 }
397 del_script = talloc_string_sub(ctx,
398 del_script, "%g", unix_group);
399 if (!del_script) {
400 return -1;
401 }
402 del_script = talloc_string_sub2(ctx,
403 del_script, "%u", unix_user, true, false, true);
404 if (!del_script) {
405 return -1;
406 }
407 ret = smbrun(del_script,NULL);
408 DEBUG(ret ? 0 : 3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script,ret));
409 if (ret == 0) {
410 smb_nscd_flush_group_cache();
411 }
412 return ret;
413 }
414
415 return -1;
416}
417
418
419NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
420 struct dom_sid sid)
421{
422 if (!init_group_mapping()) {
423 DEBUG(0,("failed to initialize group mapping\n"));
424 return NT_STATUS_UNSUCCESSFUL;
425 }
426 return backend->get_group_map_from_sid(sid, map) ?
427 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
428}
429
430NTSTATUS pdb_default_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
431 gid_t gid)
432{
433 if (!init_group_mapping()) {
434 DEBUG(0,("failed to initialize group mapping\n"));
435 return NT_STATUS_UNSUCCESSFUL;
436 }
437 return backend->get_group_map_from_gid(gid, map) ?
438 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
439}
440
441NTSTATUS pdb_default_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
442 const char *name)
443{
444 if (!init_group_mapping()) {
445 DEBUG(0,("failed to initialize group mapping\n"));
446 return NT_STATUS_UNSUCCESSFUL;
447 }
448 return backend->get_group_map_from_ntname(name, map) ?
449 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
450}
451
452NTSTATUS pdb_default_add_group_mapping_entry(struct pdb_methods *methods,
453 GROUP_MAP *map)
454{
455 if (!init_group_mapping()) {
456 DEBUG(0,("failed to initialize group mapping\n"));
457 return NT_STATUS_UNSUCCESSFUL;
458 }
459 return backend->add_mapping_entry(map, TDB_INSERT) ?
460 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
461}
462
463NTSTATUS pdb_default_update_group_mapping_entry(struct pdb_methods *methods,
464 GROUP_MAP *map)
465{
466 if (!init_group_mapping()) {
467 DEBUG(0,("failed to initialize group mapping\n"));
468 return NT_STATUS_UNSUCCESSFUL;
469 }
470 return backend->add_mapping_entry(map, TDB_REPLACE) ?
471 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
472}
473
474NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods,
475 struct dom_sid sid)
476{
477 if (!init_group_mapping()) {
478 DEBUG(0,("failed to initialize group mapping\n"));
479 return NT_STATUS_UNSUCCESSFUL;
480 }
481 return backend->group_map_remove(&sid) ?
482 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
483}
484
485NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
486 const struct dom_sid *sid,
487 enum lsa_SidType sid_name_use,
488 GROUP_MAP ***pp_rmap,
489 size_t *p_num_entries,
490 bool unix_only)
491{
492 if (!init_group_mapping()) {
493 DEBUG(0,("failed to initialize group mapping\n"));
494 return NT_STATUS_UNSUCCESSFUL;
495 }
496 return backend->enum_group_mapping(sid, sid_name_use, pp_rmap, p_num_entries, unix_only) ?
497 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
498}
499
500NTSTATUS pdb_default_create_alias(struct pdb_methods *methods,
501 const char *name, uint32_t *rid)
502{
503 struct dom_sid sid;
504 enum lsa_SidType type;
505 uint32_t new_rid;
506 gid_t gid;
507 bool exists;
508 GROUP_MAP *map;
509 TALLOC_CTX *mem_ctx;
510 NTSTATUS status;
511
512 DEBUG(10, ("Trying to create alias %s\n", name));
513
514 mem_ctx = talloc_new(NULL);
515 if (mem_ctx == NULL) {
516 return NT_STATUS_NO_MEMORY;
517 }
518
519 exists = lookup_name(mem_ctx, name, LOOKUP_NAME_LOCAL,
520 NULL, NULL, &sid, &type);
521
522 if (exists) {
523 status = NT_STATUS_ALIAS_EXISTS;
524 goto done;
525 }
526
527 if (!pdb_new_rid(&new_rid)) {
528 DEBUG(0, ("Could not allocate a RID.\n"));
529 status = NT_STATUS_ACCESS_DENIED;
530 goto done;
531 }
532
533 sid_compose(&sid, get_global_sam_sid(), new_rid);
534
535 if (!winbind_allocate_gid(&gid)) {
536 DEBUG(3, ("Could not get a gid out of winbind - "
537 "wasted a rid :-(\n"));
538 status = NT_STATUS_ACCESS_DENIED;
539 goto done;
540 }
541
542 DEBUG(10, ("Creating alias %s with gid %u and rid %u\n",
543 name, (unsigned int)gid, (unsigned int)new_rid));
544
545 map = talloc_zero(mem_ctx, GROUP_MAP);
546 if (!map) {
547 status = NT_STATUS_NO_MEMORY;
548 goto done;
549 }
550
551 map->gid = gid;
552 sid_copy(&map->sid, &sid);
553 map->sid_name_use = SID_NAME_ALIAS;
554 map->nt_name = talloc_strdup(map, name);
555 if (!map->nt_name) {
556 status = NT_STATUS_NO_MEMORY;
557 goto done;
558 }
559 map->comment = talloc_strdup(map, "");
560 if (!map->comment) {
561 status = NT_STATUS_NO_MEMORY;
562 goto done;
563 }
564
565 status = pdb_add_group_mapping_entry(map);
566
567 if (!NT_STATUS_IS_OK(status)) {
568 DEBUG(0, ("Could not add group mapping entry for alias %s "
569 "(%s)\n", name, nt_errstr(status)));
570 goto done;
571 }
572
573 *rid = new_rid;
574
575done:
576 TALLOC_FREE(mem_ctx);
577 return status;
578}
579
580NTSTATUS pdb_default_delete_alias(struct pdb_methods *methods,
581 const struct dom_sid *sid)
582{
583 return pdb_delete_group_mapping_entry(*sid);
584}
585
586NTSTATUS pdb_default_get_aliasinfo(struct pdb_methods *methods,
587 const struct dom_sid *sid,
588 struct acct_info *info)
589{
590 NTSTATUS status = NT_STATUS_OK;
591 GROUP_MAP *map;
592
593 map = talloc_zero(NULL, GROUP_MAP);
594 if (!map) {
595 return NT_STATUS_NO_MEMORY;
596 }
597
598 if (!pdb_getgrsid(map, *sid)) {
599 status = NT_STATUS_NO_SUCH_ALIAS;
600 goto done;
601 }
602
603 if ((map->sid_name_use != SID_NAME_ALIAS) &&
604 (map->sid_name_use != SID_NAME_WKN_GRP)) {
605 DEBUG(2, ("%s is a %s, expected an alias\n",
606 sid_string_dbg(sid),
607 sid_type_lookup(map->sid_name_use)));
608 status = NT_STATUS_NO_SUCH_ALIAS;
609 goto done;
610 }
611
612 info->acct_name = talloc_move(info, &map->nt_name);
613 if (!info->acct_name) {
614 status = NT_STATUS_NO_MEMORY;
615 goto done;
616 }
617 info->acct_desc = talloc_move(info, &map->comment);
618 if (!info->acct_desc) {
619 status = NT_STATUS_NO_MEMORY;
620 goto done;
621 }
622 sid_peek_rid(&map->sid, &info->rid);
623
624done:
625 TALLOC_FREE(map);
626 return status;
627}
628
629NTSTATUS pdb_default_set_aliasinfo(struct pdb_methods *methods,
630 const struct dom_sid *sid,
631 struct acct_info *info)
632{
633 NTSTATUS status = NT_STATUS_OK;
634 GROUP_MAP *map;
635
636 map = talloc_zero(NULL, GROUP_MAP);
637 if (!map) {
638 return NT_STATUS_NO_MEMORY;
639 }
640
641 if (!pdb_getgrsid(map, *sid)) {
642 status = NT_STATUS_NO_SUCH_ALIAS;
643 goto done;
644 }
645
646 map->nt_name = talloc_strdup(map, info->acct_name);
647 if (!map->nt_name) {
648 status = NT_STATUS_NO_MEMORY;
649 goto done;
650 }
651 map->comment = talloc_strdup(map, info->acct_desc);
652 if (!map->comment) {
653 status = NT_STATUS_NO_MEMORY;
654 goto done;
655 }
656
657 status = pdb_update_group_mapping_entry(map);
658
659done:
660 TALLOC_FREE(map);
661 return status;
662}
663
664NTSTATUS pdb_default_add_aliasmem(struct pdb_methods *methods,
665 const struct dom_sid *alias, const struct dom_sid *member)
666{
667 if (!init_group_mapping()) {
668 DEBUG(0,("failed to initialize group mapping\n"));
669 return NT_STATUS_UNSUCCESSFUL;
670 }
671 return backend->add_aliasmem(alias, member);
672}
673
674NTSTATUS pdb_default_del_aliasmem(struct pdb_methods *methods,
675 const struct dom_sid *alias, const struct dom_sid *member)
676{
677 if (!init_group_mapping()) {
678 DEBUG(0,("failed to initialize group mapping\n"));
679 return NT_STATUS_UNSUCCESSFUL;
680 }
681 return backend->del_aliasmem(alias, member);
682}
683
684NTSTATUS pdb_default_enum_aliasmem(struct pdb_methods *methods,
685 const struct dom_sid *alias, TALLOC_CTX *mem_ctx,
686 struct dom_sid **pp_members, size_t *p_num_members)
687{
688 if (!init_group_mapping()) {
689 DEBUG(0,("failed to initialize group mapping\n"));
690 return NT_STATUS_UNSUCCESSFUL;
691 }
692 return backend->enum_aliasmem(alias, mem_ctx, pp_members,
693 p_num_members);
694}
695
696NTSTATUS pdb_default_alias_memberships(struct pdb_methods *methods,
697 TALLOC_CTX *mem_ctx,
698 const struct dom_sid *domain_sid,
699 const struct dom_sid *members,
700 size_t num_members,
701 uint32_t **pp_alias_rids,
702 size_t *p_num_alias_rids)
703{
704 struct dom_sid *alias_sids;
705 size_t i, num_alias_sids;
706 NTSTATUS result;
707
708 if (!init_group_mapping()) {
709 DEBUG(0,("failed to initialize group mapping\n"));
710 return NT_STATUS_UNSUCCESSFUL;
711 }
712
713 alias_sids = NULL;
714 num_alias_sids = 0;
715
716 result = alias_memberships(members, num_members,
717 &alias_sids, &num_alias_sids);
718
719 if (!NT_STATUS_IS_OK(result))
720 return result;
721
722 *p_num_alias_rids = 0;
723
724 if (num_alias_sids == 0) {
725 TALLOC_FREE(alias_sids);
726 return NT_STATUS_OK;
727 }
728
729 *pp_alias_rids = talloc_array(mem_ctx, uint32_t, num_alias_sids);
730 if (*pp_alias_rids == NULL)
731 return NT_STATUS_NO_MEMORY;
732
733 for (i=0; i<num_alias_sids; i++) {
734 if (!sid_peek_check_rid(domain_sid, &alias_sids[i],
735 &(*pp_alias_rids)[*p_num_alias_rids]))
736 continue;
737 *p_num_alias_rids += 1;
738 }
739
740 TALLOC_FREE(alias_sids);
741
742 return NT_STATUS_OK;
743}
744
745/**********************************************************************
746 no ops for passdb backends that don't implement group mapping
747 *********************************************************************/
748
749NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
750 struct dom_sid sid)
751{
752 return NT_STATUS_UNSUCCESSFUL;
753}
754
755NTSTATUS pdb_nop_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
756 gid_t gid)
757{
758 return NT_STATUS_UNSUCCESSFUL;
759}
760
761NTSTATUS pdb_nop_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
762 const char *name)
763{
764 return NT_STATUS_UNSUCCESSFUL;
765}
766
767NTSTATUS pdb_nop_add_group_mapping_entry(struct pdb_methods *methods,
768 GROUP_MAP *map)
769{
770 return NT_STATUS_UNSUCCESSFUL;
771}
772
773NTSTATUS pdb_nop_update_group_mapping_entry(struct pdb_methods *methods,
774 GROUP_MAP *map)
775{
776 return NT_STATUS_UNSUCCESSFUL;
777}
778
779NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods,
780 struct dom_sid sid)
781{
782 return NT_STATUS_UNSUCCESSFUL;
783}
784
785NTSTATUS pdb_nop_enum_group_mapping(struct pdb_methods *methods,
786 enum lsa_SidType sid_name_use,
787 GROUP_MAP **rmap, size_t *num_entries,
788 bool unix_only)
789{
790 return NT_STATUS_UNSUCCESSFUL;
791}
792
793/**
794* @brief Add a new group mapping
795*
796* @param[in] gid gid to use to store the mapping. If gid is 0,
797* new gid will be allocated from winbind
798*
799* @return Normal NTSTATUS return
800*/
801NTSTATUS pdb_create_builtin_alias(uint32_t rid, gid_t gid)
802{
803 struct dom_sid sid;
804 enum lsa_SidType type;
805 gid_t gidformap;
806 GROUP_MAP *map;
807 NTSTATUS status;
808 const char *name = NULL;
809
810 DEBUG(10, ("Trying to create builtin alias %d\n", rid));
811
812 if ( !sid_compose( &sid, &global_sid_Builtin, rid ) ) {
813 return NT_STATUS_NO_SUCH_ALIAS;
814 }
815
816 /* use map as overall temp mem context */
817 map = talloc_zero(NULL, GROUP_MAP);
818 if (!map) {
819 return NT_STATUS_NO_MEMORY;
820 }
821
822 if (!lookup_sid(map, &sid, NULL, &name, &type)) {
823 status = NT_STATUS_NO_SUCH_ALIAS;
824 goto done;
825 }
826
827 if (gid == 0) {
828 if (!winbind_allocate_gid(&gidformap)) {
829 DEBUG(3, ("pdb_create_builtin_alias: Could not get a "
830 "gid out of winbind\n"));
831 status = NT_STATUS_ACCESS_DENIED;
832 goto done;
833 }
834 } else {
835 gidformap = gid;
836 }
837
838 DEBUG(10, ("Creating alias %s with gid %u\n", name,
839 (unsigned) gidformap));
840
841 map->gid = gidformap;
842 sid_copy(&map->sid, &sid);
843 map->sid_name_use = SID_NAME_ALIAS;
844 map->nt_name = talloc_strdup(map, name);
845 if (!map->nt_name) {
846 status = NT_STATUS_NO_MEMORY;
847 goto done;
848 }
849 map->comment = talloc_strdup(map, "");
850 if (!map->comment) {
851 status = NT_STATUS_NO_MEMORY;
852 goto done;
853 }
854
855 status = pdb_add_group_mapping_entry(map);
856
857 if (!NT_STATUS_IS_OK(status)) {
858 DEBUG(0, ("pdb_create_builtin_alias: Could not add group mapping entry for alias %d "
859 "(%s)\n", rid, nt_errstr(status)));
860 }
861
862done:
863 TALLOC_FREE(map);
864 return status;
865}
866
867
Note: See TracBrowser for help on using the repository browser.