source: vendor/current/source3/passdb/pdb_util.c

Last change on this file was 988, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.3
File size: 5.1 KB
Line 
1/*
2 * Unix SMB/CIFS implementation.
3 * Authentication utility functions
4 * Copyright (C) Andrew Tridgell 1992-1998
5 * Copyright (C) Andrew Bartlett 2001
6 * Copyright (C) Jeremy Allison 2000-2001
7 * Copyright (C) Rafal Szczesniak 2002
8 * Copyright (C) Volker Lendecke 2006
9 * Copyright (C) Michael Adam 2007
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 3 of the License, or
14 * (at your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, see <http://www.gnu.org/licenses/>.
23 */
24
25#include "includes.h"
26#include "../libcli/security/security.h"
27#include "passdb.h"
28#include "lib/winbind_util.h"
29#include "../librpc/gen_ndr/idmap.h"
30
31/**
32 * Add sid as a member of builtin_sid.
33 *
34 * @param[in] builtin_sid An existing builtin group.
35 * @param[in] dom_sid sid to add as a member of builtin_sid.
36 * @return Normal NTSTATUS return
37 */
38static NTSTATUS add_sid_to_builtin(const struct dom_sid *builtin_sid,
39 const struct dom_sid *dom_sid)
40{
41 NTSTATUS status = NT_STATUS_OK;
42
43 if (!dom_sid || !builtin_sid) {
44 return NT_STATUS_INVALID_PARAMETER;
45 }
46
47 status = pdb_add_aliasmem(builtin_sid, dom_sid);
48
49 if (NT_STATUS_EQUAL(status, NT_STATUS_MEMBER_IN_ALIAS)) {
50 DEBUG(5, ("add_sid_to_builtin %s is already a member of %s\n",
51 sid_string_dbg(dom_sid),
52 sid_string_dbg(builtin_sid)));
53 return NT_STATUS_OK;
54 }
55
56 if (!NT_STATUS_IS_OK(status)) {
57 DEBUG(4, ("add_sid_to_builtin %s could not be added to %s: "
58 "%s\n", sid_string_dbg(dom_sid),
59 sid_string_dbg(builtin_sid), nt_errstr(status)));
60 }
61 return status;
62}
63
64/**
65 * Create the requested BUILTIN if it doesn't already exist. This requires
66 * winbindd to be running.
67 *
68 * @param[in] rid BUILTIN rid to create
69 * @return Normal NTSTATUS return.
70 */
71NTSTATUS pdb_create_builtin(uint32_t rid)
72{
73 NTSTATUS status = NT_STATUS_OK;
74 struct dom_sid sid;
75 gid_t gid;
76 bool mapresult;
77
78 if (!sid_compose(&sid, &global_sid_Builtin, rid)) {
79 return NT_STATUS_NO_SUCH_ALIAS;
80 }
81
82 if (!pdb_is_responsible_for_builtin()) {
83 /*
84 * if this backend is not responsible for BUILTIN
85 *
86 * Use the gid from the mapping request for entry.
87 * If the mapping fails, bail out
88 */
89 mapresult = sid_to_gid(&sid, &gid);
90 if (!mapresult) {
91 status = NT_STATUS_NO_SUCH_GROUP;
92 } else {
93 status = pdb_create_builtin_alias(rid, gid);
94 }
95 } else {
96 /*
97 * this backend is responsible for BUILTIN
98 *
99 * a failed mapping result means that the entry
100 * does not exist yet, so create it
101 *
102 * we use pdb_sid_to_id intentionally here to
103 * directly query the passdb backend (sid_to_gid
104 * would finally do the same)
105 */
106 struct unixid id;
107 mapresult = pdb_sid_to_id(&sid, &id);
108 if (!mapresult) {
109 if (!lp_winbind_nested_groups() || !winbind_ping()) {
110 return NT_STATUS_PROTOCOL_UNREACHABLE;
111 }
112 status = pdb_create_builtin_alias(rid, 0);
113 }
114 }
115 return status;
116}
117
118/*******************************************************************
119*******************************************************************/
120
121NTSTATUS create_builtin_users(const struct dom_sid *dom_sid)
122{
123 NTSTATUS status;
124 struct dom_sid dom_users;
125
126 status = pdb_create_builtin(BUILTIN_RID_USERS);
127 if ( !NT_STATUS_IS_OK(status) ) {
128 DEBUG(5,("create_builtin_users: Failed to create Users\n"));
129 return status;
130 }
131
132 /* add domain users */
133 if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
134 && sid_compose(&dom_users, dom_sid, DOMAIN_RID_USERS))
135 {
136 status = add_sid_to_builtin(&global_sid_Builtin_Users,
137 &dom_users);
138 }
139
140 return status;
141}
142
143/*******************************************************************
144*******************************************************************/
145
146NTSTATUS create_builtin_administrators(const struct dom_sid *dom_sid)
147{
148 NTSTATUS status;
149 struct dom_sid dom_admins, root_sid;
150 fstring root_name;
151 enum lsa_SidType type;
152 TALLOC_CTX *ctx;
153 bool ret;
154
155 status = pdb_create_builtin(BUILTIN_RID_ADMINISTRATORS);
156 if ( !NT_STATUS_IS_OK(status) ) {
157 DEBUG(5,("create_builtin_administrators: Failed to create Administrators\n"));
158 return status;
159 }
160
161 /* add domain admins */
162 if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
163 && sid_compose(&dom_admins, dom_sid, DOMAIN_RID_ADMINS))
164 {
165 status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
166 &dom_admins);
167 if (!NT_STATUS_IS_OK(status)) {
168 return status;
169 }
170 }
171
172 /* add root */
173 if ( (ctx = talloc_init("create_builtin_administrators")) == NULL ) {
174 return NT_STATUS_NO_MEMORY;
175 }
176 fstr_sprintf( root_name, "%s\\root", get_global_sam_name() );
177 ret = lookup_name(ctx, root_name, LOOKUP_NAME_DOMAIN, NULL, NULL,
178 &root_sid, &type);
179 TALLOC_FREE( ctx );
180
181 if ( ret ) {
182 status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
183 &root_sid);
184 }
185
186 return status;
187}
Note: See TracBrowser for help on using the repository browser.