2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-2000,
5 * Copyright (C) Jean François Micouleau 1998-2001.
6 * Copyright (C) Gerald Carter 2003.
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 #include "../utils/net.h"
28 /*********************************************************
29 utility function to parse an integer parameter from
31 **********************************************************/
32 static uint32
get_int_param( const char* param
)
36 p
= strchr( param
, '=' );
43 /*********************************************************
44 utility function to parse an integer parameter from
46 **********************************************************/
47 static char* get_string_param( const char* param
)
51 p
= strchr( param
, '=' );
58 /*********************************************************
59 Figure out if the input was an NT group or a SID string.
61 **********************************************************/
62 static BOOL
get_sid_from_input(DOM_SID
*sid
, char *input
)
66 if (StrnCaseCmp( input
, "S-", 2)) {
67 /* Perhaps its the NT group name? */
68 if (!pdb_getgrnam(&map
, input
, MAPPING_WITHOUT_PRIV
)) {
69 printf("NT Group %s doesn't exist in mapping DB\n", input
);
75 if (!string_to_sid(sid
, input
)) {
76 printf("converting sid %s from a string failed!\n", input
);
83 /*********************************************************
84 Dump a GROUP_MAP entry to stdout (long or short listing)
85 **********************************************************/
87 static void print_map_entry ( GROUP_MAP map
, BOOL long_list
)
93 decode_sid_name_use(group_type
, map
.sid_name_use
);
94 sid_to_string(string_sid
, &map
.sid
);
95 convert_priv_to_text(&(map
.priv_set
), priv_text
);
98 d_printf("%s (%s) -> %s\n", map
.nt_name
, string_sid
, gidtoname(map
.gid
));
100 d_printf("%s\n", map
.nt_name
);
101 d_printf("\tSID : %s\n", string_sid
);
102 d_printf("\tUnix group: %s\n", gidtoname(map
.gid
));
103 d_printf("\tGroup type: %s\n", group_type
);
104 d_printf("\tComment : %s\n", map
.comment
);
105 d_printf("\tPrivilege : %s\n\n", priv_text
);
109 /*********************************************************
111 **********************************************************/
112 int net_groupmap_list(int argc
, const char **argv
)
115 BOOL long_list
= False
;
117 fstring ntgroup
= "";
118 fstring sid_string
= "";
120 /* get the options */
121 for ( i
=0; i
<argc
; i
++ ) {
122 if ( !StrCaseCmp(argv
[i
], "verbose")) {
125 else if ( !StrnCaseCmp(argv
[i
], "ntgroup", strlen("ntgroup")) ) {
126 fstrcpy( ntgroup
, get_string_param( argv
[i
] ) );
128 d_printf("must supply a name\n");
132 else if ( !StrnCaseCmp(argv
[i
], "sid", strlen("sid")) ) {
133 fstrcpy( sid_string
, get_string_param( argv
[i
] ) );
134 if ( !sid_string
[0] ) {
135 d_printf("must supply a SID\n");
140 d_printf("Bad option: %s\n", argv
[i
]);
145 /* list a single group is given a name */
146 if ( ntgroup
[0] || sid_string
[0] ) {
151 fstrcpy( ntgroup
, sid_string
);
153 if (!get_sid_from_input(&sid
, ntgroup
)) {
157 /* Get the current mapping from the database */
158 if(!pdb_getgrsid(&map
, sid
, MAPPING_WITH_PRIV
)) {
159 d_printf("Failure to local group SID in the database\n");
163 print_map_entry( map
, long_list
);
164 free_privilege(&(map
.priv_set
));
168 /* enumerate all group mappings */
169 if ( !pdb_enum_group_mapping(SID_NAME_UNKNOWN
, &map
, &entries
, ENUM_ALL_MAPPED
, MAPPING_WITH_PRIV
) )
172 for (i
=0; i
<entries
; i
++) {
173 print_map_entry( map
[i
], long_list
);
174 free_privilege(&(map
[i
].priv_set
));
181 /*********************************************************
182 Add a new group mapping entry
183 **********************************************************/
185 int net_groupmap_add(int argc
, const char **argv
)
187 PRIVILEGE_SET se_priv
;
189 fstring ntgroup
= "";
190 fstring unixgrp
= "";
191 fstring string_sid
= "";
193 fstring ntcomment
= "";
194 enum SID_NAME_USE sid_type
= SID_NAME_DOM_GRP
;
199 /* get the options */
200 for ( i
=0; i
<argc
; i
++ ) {
201 if ( !StrnCaseCmp(argv
[i
], "rid", strlen("rid")) ) {
202 rid
= get_int_param(argv
[i
]);
203 if ( rid
< DOMAIN_GROUP_RID_ADMINS
) {
204 d_printf("RID must be greater than %d\n", (uint32
)DOMAIN_GROUP_RID_ADMINS
-1);
208 else if ( !StrnCaseCmp(argv
[i
], "unixgroup", strlen("unixgroup")) ) {
209 fstrcpy( unixgrp
, get_string_param( argv
[i
] ) );
211 d_printf("must supply a name\n");
215 else if ( !StrnCaseCmp(argv
[i
], "ntgroup", strlen("ntgroup")) ) {
216 fstrcpy( ntgroup
, get_string_param( argv
[i
] ) );
218 d_printf("must supply a name\n");
222 else if ( !StrnCaseCmp(argv
[i
], "sid", strlen("sid")) ) {
223 fstrcpy( string_sid
, get_string_param( argv
[i
] ) );
224 if ( !string_sid
[0] ) {
225 d_printf("must supply a SID\n");
229 else if ( !StrnCaseCmp(argv
[i
], "comment", strlen("comment")) ) {
230 fstrcpy( ntcomment
, get_string_param( argv
[i
] ) );
231 if ( !ntcomment
[0] ) {
232 d_printf("must supply a comment string\n");
236 else if ( !StrnCaseCmp(argv
[i
], "type", strlen("type")) ) {
237 fstrcpy( type
, get_string_param( argv
[i
] ) );
241 sid_type
= SID_NAME_WKN_GRP
;
245 sid_type
= SID_NAME_DOM_GRP
;
249 sid_type
= SID_NAME_ALIAS
;
254 d_printf("Bad option: %s\n", argv
[i
]);
259 if ( !unixgrp
[0] || (!rid
&& !string_sid
[0]) ) {
260 d_printf("Usage: net groupmap add {rid=<int>|sid=<string>} unixgroup=<string> [type=<domain|local|builtin>] [ntgroup=<string>] [comment=<string>]\n");
264 /* append the rid to our own domain/machine SID if we don't have a full SID */
265 if ( !string_sid
[0] ) {
266 sid_copy(&sid
, get_global_sam_sid());
267 sid_append_rid(&sid
, rid
);
268 sid_to_string(string_sid
, &sid
);
272 fstrcpy(ntcomment
, "Local Unix group");
274 if ( !(gid
= nametogid(unixgrp
)) ) {
275 d_printf("Can't lookup UNIX group %s\n", ntgroup
);
280 fstrcpy( ntgroup
, unixgrp
);
283 init_privilege(&se_priv
);
286 convert_priv_from_text(&se_priv
, privilege
);
289 if (!add_initial_entry(gid
, string_sid
, sid_type
, ntgroup
,
290 ntcomment
, se_priv
, PR_ACCESS_FROM_NETWORK
) ) {
291 d_printf("adding entry for group %s failed!\n", ntgroup
);
295 free_privilege(&se_priv
);
297 d_printf("Successully added group %s to the mapping db\n", ntgroup
);
301 int net_groupmap_modify(int argc
, const char **argv
)
305 fstring ntcomment
= "";
307 fstring ntgroup
= "";
308 fstring unixgrp
= "";
309 fstring sid_string
= "";
310 enum SID_NAME_USE sid_type
= SID_NAME_UNKNOWN
;
314 /* get the options */
315 for ( i
=0; i
<argc
; i
++ ) {
316 if ( !StrnCaseCmp(argv
[i
], "ntgroup", strlen("ntgroup")) ) {
317 fstrcpy( ntgroup
, get_string_param( argv
[i
] ) );
319 d_printf("must supply a name\n");
323 else if ( !StrnCaseCmp(argv
[i
], "sid", strlen("sid")) ) {
324 fstrcpy( sid_string
, get_string_param( argv
[i
] ) );
325 if ( !sid_string
[0] ) {
326 d_printf("must supply a name\n");
330 else if ( !StrnCaseCmp(argv
[i
], "comment", strlen("comment")) ) {
331 fstrcpy( ntcomment
, get_string_param( argv
[i
] ) );
332 if ( !ntcomment
[0] ) {
333 d_printf("must supply a comment string\n");
337 else if ( !StrnCaseCmp(argv
[i
], "unixgroup", strlen("unixgroup")) ) {
338 fstrcpy( unixgrp
, get_string_param( argv
[i
] ) );
340 d_printf("must supply a group name\n");
344 else if ( !StrnCaseCmp(argv
[i
], "type", strlen("type")) ) {
345 fstrcpy( type
, get_string_param( argv
[i
] ) );
349 sid_type
= SID_NAME_DOM_GRP
;
353 sid_type
= SID_NAME_ALIAS
;
358 d_printf("Bad option: %s\n", argv
[i
]);
363 if ( !ntgroup
[0] && !sid_string
[0] ) {
364 d_printf("Usage: net groupmap modify {ntgroup=<string>|sid=<SID>} [comment=<string>] [unixgroup=<string>] [type=<domain|local>]\n");
368 /* give preference to the SID; if both the ntgroup name and SID
369 are defined, use the SID and assume that the group name could be a
372 if ( sid_string
[0] ) {
373 if (!get_sid_from_input(&sid
, sid_string
)) {
378 if (!get_sid_from_input(&sid
, ntgroup
)) {
383 /* Get the current mapping from the database */
384 if(!pdb_getgrsid(&map
, sid
, MAPPING_WITH_PRIV
)) {
385 d_printf("Failure to local group SID in the database\n");
390 * Allow changing of group type only between domain and local
391 * We disallow changing Builtin groups !!! (SID problem)
393 if ( sid_type
!= SID_NAME_UNKNOWN
)
395 if ( map
.sid_name_use
== SID_NAME_WKN_GRP
) {
396 d_printf("You can only change between domain and local groups.\n");
400 map
.sid_name_use
=sid_type
;
403 /* Change comment if new one */
405 fstrcpy( map
.comment
, ntcomment
);
408 fstrcpy( map
.nt_name
, ntgroup
);
411 gid
= nametogid( unixgrp
);
413 d_printf("Unable to lookup UNIX group %s. Make sure the group exists.\n",
422 /* Change the privilege if new one */
424 convert_priv_from_text(&map
.priv_set
, privilege
);
427 if ( !pdb_update_group_mapping_entry(&map
) ) {
428 d_printf("Could not update group database\n");
429 free_privilege(&map
.priv_set
);
433 free_privilege(&map
.priv_set
);
435 d_printf("Updated mapping entry for %s\n", ntgroup
);
440 int net_groupmap_delete(int argc
, const char **argv
)
443 fstring ntgroup
= "";
444 fstring sid_string
= "";
447 /* get the options */
448 for ( i
=0; i
<argc
; i
++ ) {
449 if ( !StrnCaseCmp(argv
[i
], "ntgroup", strlen("ntgroup")) ) {
450 fstrcpy( ntgroup
, get_string_param( argv
[i
] ) );
452 d_printf("must supply a name\n");
456 else if ( !StrnCaseCmp(argv
[i
], "sid", strlen("sid")) ) {
457 fstrcpy( sid_string
, get_string_param( argv
[i
] ) );
458 if ( !sid_string
[0] ) {
459 d_printf("must supply a SID\n");
464 d_printf("Bad option: %s\n", argv
[i
]);
469 if ( !ntgroup
[0] && !sid_string
[0]) {
470 d_printf("Usage: net groupmap delete {ntgroup=<string>|sid=<SID>}\n");
474 /* give preference to the SID if we have that */
477 fstrcpy( ntgroup
, sid_string
);
479 if ( !get_sid_from_input(&sid
, ntgroup
) ) {
480 d_printf("Unable to resolve group %s to a SID\n", ntgroup
);
484 if ( !pdb_delete_group_mapping_entry(sid
) ) {
485 printf("Failed to removing group %s from the mapping db!\n", ntgroup
);
489 d_printf("Sucessfully removed %s from the mapping db\n", ntgroup
);