2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-2000,
5 * Copyright (C) Jean François Micouleau 1998-2001.
6 * Copyright (C) Volker Lendecke 2006.
7 * Copyright (C) Gerald Carter 2006.
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 #include "groupdb/mapping.h"
27 /****************************************************************************
28 initialise first time the mapping list
29 ****************************************************************************/
30 NTSTATUS
add_initial_entry(gid_t gid
, const char *sid
, enum lsa_SidType sid_name_use
, const char *nt_name
, const char *comment
)
34 if(!init_group_mapping()) {
35 DEBUG(0,("failed to initialize group mapping\n"));
36 return NT_STATUS_UNSUCCESSFUL
;
40 if (!string_to_sid(&map
.sid
, sid
)) {
41 DEBUG(0, ("string_to_sid failed: %s", sid
));
42 return NT_STATUS_UNSUCCESSFUL
;
45 map
.sid_name_use
=sid_name_use
;
46 fstrcpy(map
.nt_name
, nt_name
);
47 fstrcpy(map
.comment
, comment
);
49 return pdb_add_group_mapping_entry(&map
);
52 /****************************************************************************
53 Map a unix group to a newly created mapping
54 ****************************************************************************/
55 NTSTATUS
map_unix_group(const struct group
*grp
, GROUP_MAP
*pmap
)
59 const char *grpname
, *dom
, *name
;
62 if (pdb_getgrgid(&map
, grp
->gr_gid
)) {
63 return NT_STATUS_GROUP_EXISTS
;
66 map
.gid
= grp
->gr_gid
;
67 grpname
= grp
->gr_name
;
69 if (lookup_name(tmp_talloc_ctx(), grpname
, LOOKUP_NAME_ISOLATED
,
70 &dom
, &name
, NULL
, NULL
)) {
72 const char *tmp
= talloc_asprintf(
73 tmp_talloc_ctx(), "Unix Group %s", grp
->gr_name
);
75 DEBUG(5, ("%s exists as %s\\%s, retrying as \"%s\"\n",
76 grpname
, dom
, name
, tmp
));
80 if (lookup_name(tmp_talloc_ctx(), grpname
, LOOKUP_NAME_ISOLATED
,
81 NULL
, NULL
, NULL
, NULL
)) {
82 DEBUG(3, ("\"%s\" exists, can't map it\n", grp
->gr_name
));
83 return NT_STATUS_GROUP_EXISTS
;
86 fstrcpy(map
.nt_name
, grpname
);
88 if (pdb_rid_algorithm()) {
89 rid
= algorithmic_pdb_gid_to_group_rid( grp
->gr_gid
);
91 if (!pdb_new_rid(&rid
)) {
92 DEBUG(3, ("Could not get a new RID for %s\n",
94 return NT_STATUS_ACCESS_DENIED
;
98 sid_compose(&map
.sid
, get_global_sam_sid(), rid
);
99 map
.sid_name_use
= SID_NAME_DOM_GRP
;
100 fstrcpy(map
.comment
, talloc_asprintf(tmp_talloc_ctx(), "Unix Group %s",
103 status
= pdb_add_group_mapping_entry(&map
);
104 if (NT_STATUS_IS_OK(status
)) {
116 static NTSTATUS
alias_memberships(const DOM_SID
*members
, size_t num_members
,
117 DOM_SID
**sids
, size_t *num
)
124 for (i
=0; i
<num_members
; i
++) {
125 NTSTATUS status
= one_alias_membership(&members
[i
], sids
, num
);
126 if (!NT_STATUS_IS_OK(status
))
132 struct aliasmem_closure
{
133 const DOM_SID
*alias
;
142 * High level functions
143 * better to use them than the lower ones.
145 * we are checking if the group is in the mapping file
146 * and if the group is an existing unix group
150 /* get a domain group from it's SID */
152 BOOL
get_domain_group_from_sid(DOM_SID sid
, GROUP_MAP
*map
)
157 if(!init_group_mapping()) {
158 DEBUG(0,("failed to initialize group mapping\n"));
162 DEBUG(10, ("get_domain_group_from_sid\n"));
164 /* if the group is NOT in the database, it CAN NOT be a domain group */
167 ret
= pdb_getgrsid(map
, sid
);
170 /* special case check for rid 513 */
175 sid_peek_rid( &sid
, &rid
);
177 if ( rid
== DOMAIN_GROUP_RID_USERS
) {
178 fstrcpy( map
->nt_name
, "None" );
179 fstrcpy( map
->comment
, "Ordinary Users" );
180 sid_copy( &map
->sid
, &sid
);
181 map
->sid_name_use
= SID_NAME_DOM_GRP
;
182 map
->gid
= (gid_t
)-1;
190 DEBUG(10, ("get_domain_group_from_sid: SID found in the TDB\n"));
192 /* if it's not a domain group, continue */
193 if (map
->sid_name_use
!=SID_NAME_DOM_GRP
) {
197 DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
203 DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map
->gid
));
205 grp
= getgrgid(map
->gid
);
207 DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n"));
211 DEBUG(10, ("get_domain_group_from_sid: gid exists in UNIX security\n"));
216 /****************************************************************************
217 Create a UNIX group on demand.
218 ****************************************************************************/
220 int smb_create_group(const char *unix_group
, gid_t
*new_gid
)
228 /* defer to scripts */
230 if ( *lp_addgroup_script() ) {
231 pstrcpy(add_script
, lp_addgroup_script());
232 pstring_sub(add_script
, "%g", unix_group
);
233 ret
= smbrun(add_script
, &fd
);
234 DEBUG(ret
? 0 : 3,("smb_create_group: Running the command `%s' gave %d\n",add_script
,ret
));
236 smb_nscd_flush_group_cache();
245 if (read(fd
, output
, sizeof(output
)) > 0) {
246 *new_gid
= (gid_t
)strtoul(output
, NULL
, 10);
255 struct group
*grp
= getgrnam(unix_group
);
258 *new_gid
= grp
->gr_gid
;
264 /****************************************************************************
265 Delete a UNIX group on demand.
266 ****************************************************************************/
268 int smb_delete_group(const char *unix_group
)
273 /* defer to scripts */
275 if ( *lp_delgroup_script() ) {
276 pstrcpy(del_script
, lp_delgroup_script());
277 pstring_sub(del_script
, "%g", unix_group
);
278 ret
= smbrun(del_script
,NULL
);
279 DEBUG(ret
? 0 : 3,("smb_delete_group: Running the command `%s' gave %d\n",del_script
,ret
));
281 smb_nscd_flush_group_cache();
289 /****************************************************************************
290 Set a user's primary UNIX group.
291 ****************************************************************************/
292 int smb_set_primary_group(const char *unix_group
, const char* unix_user
)
297 /* defer to scripts */
299 if ( *lp_setprimarygroup_script() ) {
300 pstrcpy(add_script
, lp_setprimarygroup_script());
301 all_string_sub(add_script
, "%g", unix_group
, sizeof(add_script
));
302 all_string_sub(add_script
, "%u", unix_user
, sizeof(add_script
));
303 ret
= smbrun(add_script
,NULL
);
305 DEBUG(ret
? 0 : 3,("smb_set_primary_group: "
306 "Running the command `%s' gave %d\n",add_script
,ret
));
308 smb_nscd_flush_group_cache();
316 /****************************************************************************
317 Add a user to a UNIX group.
318 ****************************************************************************/
320 int smb_add_user_group(const char *unix_group
, const char *unix_user
)
325 /* defer to scripts */
327 if ( *lp_addusertogroup_script() ) {
328 pstrcpy(add_script
, lp_addusertogroup_script());
329 pstring_sub(add_script
, "%g", unix_group
);
330 pstring_sub(add_script
, "%u", unix_user
);
331 ret
= smbrun(add_script
,NULL
);
332 DEBUG(ret
? 0 : 3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script
,ret
));
334 smb_nscd_flush_group_cache();
342 /****************************************************************************
343 Delete a user from a UNIX group
344 ****************************************************************************/
346 int smb_delete_user_group(const char *unix_group
, const char *unix_user
)
351 /* defer to scripts */
353 if ( *lp_deluserfromgroup_script() ) {
354 pstrcpy(del_script
, lp_deluserfromgroup_script());
355 pstring_sub(del_script
, "%g", unix_group
);
356 pstring_sub(del_script
, "%u", unix_user
);
357 ret
= smbrun(del_script
,NULL
);
358 DEBUG(ret
? 0 : 3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script
,ret
));
360 smb_nscd_flush_group_cache();
369 NTSTATUS
pdb_default_getgrsid(struct pdb_methods
*methods
, GROUP_MAP
*map
,
372 return get_group_map_from_sid(sid
, map
) ?
373 NT_STATUS_OK
: NT_STATUS_UNSUCCESSFUL
;
376 NTSTATUS
pdb_default_getgrgid(struct pdb_methods
*methods
, GROUP_MAP
*map
,
379 return get_group_map_from_gid(gid
, map
) ?
380 NT_STATUS_OK
: NT_STATUS_UNSUCCESSFUL
;
383 NTSTATUS
pdb_default_getgrnam(struct pdb_methods
*methods
, GROUP_MAP
*map
,
386 return get_group_map_from_ntname(name
, map
) ?
387 NT_STATUS_OK
: NT_STATUS_UNSUCCESSFUL
;
390 NTSTATUS
pdb_default_add_group_mapping_entry(struct pdb_methods
*methods
,
393 return add_mapping_entry(map
, TDB_INSERT
) ?
394 NT_STATUS_OK
: NT_STATUS_UNSUCCESSFUL
;
397 NTSTATUS
pdb_default_update_group_mapping_entry(struct pdb_methods
*methods
,
400 return add_mapping_entry(map
, TDB_REPLACE
) ?
401 NT_STATUS_OK
: NT_STATUS_UNSUCCESSFUL
;
404 NTSTATUS
pdb_default_delete_group_mapping_entry(struct pdb_methods
*methods
,
407 return group_map_remove(&sid
) ?
408 NT_STATUS_OK
: NT_STATUS_UNSUCCESSFUL
;
411 NTSTATUS
pdb_default_enum_group_mapping(struct pdb_methods
*methods
,
412 const DOM_SID
*sid
, enum lsa_SidType sid_name_use
,
413 GROUP_MAP
**pp_rmap
, size_t *p_num_entries
,
416 return enum_group_mapping(sid
, sid_name_use
, pp_rmap
, p_num_entries
, unix_only
) ?
417 NT_STATUS_OK
: NT_STATUS_UNSUCCESSFUL
;
420 NTSTATUS
pdb_default_find_alias(struct pdb_methods
*methods
,
421 const char *name
, DOM_SID
*sid
)
425 if (!pdb_getgrnam(&map
, name
))
426 return NT_STATUS_NO_SUCH_ALIAS
;
428 if ((map
.sid_name_use
!= SID_NAME_WKN_GRP
) &&
429 (map
.sid_name_use
!= SID_NAME_ALIAS
))
430 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
432 sid_copy(sid
, &map
.sid
);
436 NTSTATUS
pdb_default_create_alias(struct pdb_methods
*methods
,
437 const char *name
, uint32
*rid
)
440 enum lsa_SidType type
;
448 DEBUG(10, ("Trying to create alias %s\n", name
));
450 mem_ctx
= talloc_new(NULL
);
451 if (mem_ctx
== NULL
) {
452 return NT_STATUS_NO_MEMORY
;
455 exists
= lookup_name(mem_ctx
, name
, LOOKUP_NAME_ISOLATED
,
456 NULL
, NULL
, &sid
, &type
);
457 TALLOC_FREE(mem_ctx
);
460 return NT_STATUS_ALIAS_EXISTS
;
463 if (!winbind_allocate_gid(&gid
)) {
464 DEBUG(3, ("Could not get a gid out of winbind\n"));
465 return NT_STATUS_ACCESS_DENIED
;
468 if (!pdb_new_rid(&new_rid
)) {
469 DEBUG(0, ("Could not allocate a RID -- wasted a gid :-(\n"));
470 return NT_STATUS_ACCESS_DENIED
;
473 DEBUG(10, ("Creating alias %s with gid %d and rid %d\n",
474 name
, gid
, new_rid
));
476 sid_copy(&sid
, get_global_sam_sid());
477 sid_append_rid(&sid
, new_rid
);
480 sid_copy(&map
.sid
, &sid
);
481 map
.sid_name_use
= SID_NAME_ALIAS
;
482 fstrcpy(map
.nt_name
, name
);
483 fstrcpy(map
.comment
, "");
485 status
= pdb_add_group_mapping_entry(&map
);
487 if (!NT_STATUS_IS_OK(status
)) {
488 DEBUG(0, ("Could not add group mapping entry for alias %s "
489 "(%s)\n", name
, nt_errstr(status
)));
498 NTSTATUS
pdb_default_delete_alias(struct pdb_methods
*methods
,
501 return pdb_delete_group_mapping_entry(*sid
);
504 NTSTATUS
pdb_default_get_aliasinfo(struct pdb_methods
*methods
,
506 struct acct_info
*info
)
510 if (!pdb_getgrsid(&map
, *sid
))
511 return NT_STATUS_NO_SUCH_ALIAS
;
513 if ((map
.sid_name_use
!= SID_NAME_ALIAS
) &&
514 (map
.sid_name_use
!= SID_NAME_WKN_GRP
)) {
515 DEBUG(2, ("%s is a %s, expected an alias\n",
516 sid_string_static(sid
),
517 sid_type_lookup(map
.sid_name_use
)));
518 return NT_STATUS_NO_SUCH_ALIAS
;
521 fstrcpy(info
->acct_name
, map
.nt_name
);
522 fstrcpy(info
->acct_desc
, map
.comment
);
523 sid_peek_rid(&map
.sid
, &info
->rid
);
527 NTSTATUS
pdb_default_set_aliasinfo(struct pdb_methods
*methods
,
529 struct acct_info
*info
)
533 if (!pdb_getgrsid(&map
, *sid
))
534 return NT_STATUS_NO_SUCH_ALIAS
;
536 fstrcpy(map
.nt_name
, info
->acct_name
);
537 fstrcpy(map
.comment
, info
->acct_desc
);
539 return pdb_update_group_mapping_entry(&map
);
542 NTSTATUS
pdb_default_add_aliasmem(struct pdb_methods
*methods
,
543 const DOM_SID
*alias
, const DOM_SID
*member
)
545 return add_aliasmem(alias
, member
);
548 NTSTATUS
pdb_default_del_aliasmem(struct pdb_methods
*methods
,
549 const DOM_SID
*alias
, const DOM_SID
*member
)
551 return del_aliasmem(alias
, member
);
554 NTSTATUS
pdb_default_enum_aliasmem(struct pdb_methods
*methods
,
555 const DOM_SID
*alias
, DOM_SID
**pp_members
,
556 size_t *p_num_members
)
558 return enum_aliasmem(alias
, pp_members
, p_num_members
);
561 NTSTATUS
pdb_default_alias_memberships(struct pdb_methods
*methods
,
563 const DOM_SID
*domain_sid
,
564 const DOM_SID
*members
,
566 uint32
**pp_alias_rids
,
567 size_t *p_num_alias_rids
)
570 size_t i
, num_alias_sids
;
576 result
= alias_memberships(members
, num_members
,
577 &alias_sids
, &num_alias_sids
);
579 if (!NT_STATUS_IS_OK(result
))
582 *p_num_alias_rids
= 0;
584 if (num_alias_sids
== 0) {
585 TALLOC_FREE(alias_sids
);
589 *pp_alias_rids
= TALLOC_ARRAY(mem_ctx
, uint32
, num_alias_sids
);
590 if (*pp_alias_rids
== NULL
)
591 return NT_STATUS_NO_MEMORY
;
593 for (i
=0; i
<num_alias_sids
; i
++) {
594 if (!sid_peek_check_rid(domain_sid
, &alias_sids
[i
],
595 &(*pp_alias_rids
)[*p_num_alias_rids
]))
597 *p_num_alias_rids
+= 1;
600 TALLOC_FREE(alias_sids
);
605 /**********************************************************************
606 no ops for passdb backends that don't implement group mapping
607 *********************************************************************/
609 NTSTATUS
pdb_nop_getgrsid(struct pdb_methods
*methods
, GROUP_MAP
*map
,
612 return NT_STATUS_UNSUCCESSFUL
;
615 NTSTATUS
pdb_nop_getgrgid(struct pdb_methods
*methods
, GROUP_MAP
*map
,
618 return NT_STATUS_UNSUCCESSFUL
;
621 NTSTATUS
pdb_nop_getgrnam(struct pdb_methods
*methods
, GROUP_MAP
*map
,
624 return NT_STATUS_UNSUCCESSFUL
;
627 NTSTATUS
pdb_nop_add_group_mapping_entry(struct pdb_methods
*methods
,
630 return NT_STATUS_UNSUCCESSFUL
;
633 NTSTATUS
pdb_nop_update_group_mapping_entry(struct pdb_methods
*methods
,
636 return NT_STATUS_UNSUCCESSFUL
;
639 NTSTATUS
pdb_nop_delete_group_mapping_entry(struct pdb_methods
*methods
,
642 return NT_STATUS_UNSUCCESSFUL
;
645 NTSTATUS
pdb_nop_enum_group_mapping(struct pdb_methods
*methods
,
646 enum lsa_SidType sid_name_use
,
647 GROUP_MAP
**rmap
, size_t *num_entries
,
650 return NT_STATUS_UNSUCCESSFUL
;
653 /****************************************************************************
654 These need to be redirected through pdb_interface.c
655 ****************************************************************************/
656 BOOL
pdb_get_dom_grp_info(const DOM_SID
*sid
, struct acct_info
*info
)
662 res
= get_domain_group_from_sid(*sid
, &map
);
668 fstrcpy(info
->acct_name
, map
.nt_name
);
669 fstrcpy(info
->acct_desc
, map
.comment
);
670 sid_peek_rid(sid
, &info
->rid
);
674 BOOL
pdb_set_dom_grp_info(const DOM_SID
*sid
, const struct acct_info
*info
)
678 if (!get_domain_group_from_sid(*sid
, &map
))
681 fstrcpy(map
.nt_name
, info
->acct_name
);
682 fstrcpy(map
.comment
, info
->acct_desc
);
684 return NT_STATUS_IS_OK(pdb_update_group_mapping_entry(&map
));
687 /********************************************************************
688 Really just intended to be called by smbd
689 ********************************************************************/
691 NTSTATUS
pdb_create_builtin_alias(uint32 rid
)
694 enum lsa_SidType type
;
699 const char *name
= NULL
;
702 DEBUG(10, ("Trying to create builtin alias %d\n", rid
));
704 if ( !sid_compose( &sid
, &global_sid_Builtin
, rid
) ) {
705 return NT_STATUS_NO_SUCH_ALIAS
;
708 if ( (mem_ctx
= talloc_new(NULL
)) == NULL
) {
709 return NT_STATUS_NO_MEMORY
;
712 if ( !lookup_sid(mem_ctx
, &sid
, NULL
, &name
, &type
) ) {
713 TALLOC_FREE( mem_ctx
);
714 return NT_STATUS_NO_SUCH_ALIAS
;
717 /* validate RID so copy the name and move on */
719 fstrcpy( groupname
, name
);
720 TALLOC_FREE( mem_ctx
);
722 if (!winbind_allocate_gid(&gid
)) {
723 DEBUG(3, ("pdb_create_builtin_alias: Could not get a gid out of winbind\n"));
724 return NT_STATUS_ACCESS_DENIED
;
727 DEBUG(10,("Creating alias %s with gid %d\n", name
, gid
));
730 sid_copy(&map
.sid
, &sid
);
731 map
.sid_name_use
= SID_NAME_ALIAS
;
732 fstrcpy(map
.nt_name
, name
);
733 fstrcpy(map
.comment
, "");
735 status
= pdb_add_group_mapping_entry(&map
);
737 if (!NT_STATUS_IS_OK(status
)) {
738 DEBUG(0, ("pdb_create_builtin_alias: Could not add group mapping entry for alias %d "
739 "(%s)\n", rid
, nt_errstr(status
)));