source3/groupdb/mapping.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-2000,
   5  *  Copyright (C) Jean François Micouleau      1998-2001.
   6  *  Copyright (C) Volker Lendecke              2006.
   7  *  Copyright (C) Gerald Carter                2006.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 3 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  21  */
  22
  23 #include "includes.h"
  24 #include "system/passwd.h"
  25 #include "passdb.h"
  26 #include "groupdb/mapping.h"
  27 #include "../libcli/security/security.h"
  28 #include "lib/winbind_util.h"
  29 #include "tdb_compat.h"
  30 #include "groupdb/mapping_tdb.h"
  31
  32 static const struct mapping_backend *backend;
  33
  34 /*
  35   initialise a group mapping backend
  36  */
  37 static bool init_group_mapping(void)
  38 {
  39         if (backend != NULL) {
  40                 /* already initialised */
  41                 return True;
  42         }
  43
  44         backend = groupdb_tdb_init();
  45
  46         return backend != NULL;
  47 }
  48
  49 /****************************************************************************
  50 initialise first time the mapping list
  51 ****************************************************************************/
  52 NTSTATUS add_initial_entry(gid_t gid, const char *sid, enum lsa_SidType sid_name_use, const char *nt_name, const char *comment)
  53 {
  54         NTSTATUS status;
  55         GROUP_MAP *map;
  56
  57         if(!init_group_mapping()) {
  58                 DEBUG(0,("failed to initialize group mapping\n"));
  59                 return NT_STATUS_UNSUCCESSFUL;
  60         }
  61
  62         map = talloc_zero(NULL, GROUP_MAP);
  63         if (!map) {
  64                 return NT_STATUS_NO_MEMORY;
  65         }
  66
  67         map->gid=gid;
  68         if (!string_to_sid(&map->sid, sid)) {
  69                 DEBUG(0, ("string_to_sid failed: %s", sid));
  70                 status = NT_STATUS_UNSUCCESSFUL;
  71                 goto done;
  72         }
  73
  74         map->sid_name_use=sid_name_use;
  75         map->nt_name = talloc_strdup(map, nt_name);
  76         if (!map->nt_name) {
  77                 status = NT_STATUS_NO_MEMORY;
  78                 goto done;
  79         }
  80
  81         if (comment) {
  82                 map->comment = talloc_strdup(map, comment);
  83         } else {
  84                 map->comment = talloc_strdup(map, "");
  85         }
  86         if (!map->comment) {
  87                 status = NT_STATUS_NO_MEMORY;
  88                 goto done;
  89         }
  90
  91         status = pdb_add_group_mapping_entry(map);
  92
  93 done:
  94         TALLOC_FREE(map);
  95         return status;
  96 }
  97
  98 static NTSTATUS alias_memberships(const struct dom_sid *members, size_t num_members,
  99                                   struct dom_sid **sids, size_t *num)
 100 {
 101         size_t i;
 102
 103         *num = 0;
 104         *sids = NULL;
 105
 106         for (i=0; i<num_members; i++) {
 107                 NTSTATUS status = backend->one_alias_membership(&members[i], sids, num);
 108                 if (!NT_STATUS_IS_OK(status))
 109                         return status;
 110         }
 111         return NT_STATUS_OK;
 112 }
 113
 114 struct aliasmem_closure {
 115         const struct dom_sid *alias;
 116         struct dom_sid **sids;
 117         size_t *num;
 118 };
 119
 120
 121
 122 /*
 123  *
 124  * High level functions
 125  * better to use them than the lower ones.
 126  *
 127  * we are checking if the group is in the mapping file
 128  * and if the group is an existing unix group
 129  *
 130  */
 131
 132 /* get a domain group from it's SID */
 133
 134 bool get_domain_group_from_sid(struct dom_sid sid, GROUP_MAP *map)
 135 {
 136         struct group *grp;
 137         bool ret;
 138
 139         if(!init_group_mapping()) {
 140                 DEBUG(0,("failed to initialize group mapping\n"));
 141                 return(False);
 142         }
 143
 144         DEBUG(10, ("get_domain_group_from_sid\n"));
 145
 146         /* if the group is NOT in the database, it CAN NOT be a domain group */
 147
 148         become_root();
 149         ret = pdb_getgrsid(map, sid);
 150         unbecome_root();
 151
 152         /* special case check for rid 513 */
 153
 154         if ( !ret ) {
 155                 uint32 rid;
 156
 157                 sid_peek_rid( &sid, &rid );
 158
 159                 if ( rid == DOMAIN_RID_USERS ) {
 160                         map->nt_name = talloc_strdup(map, "None");
 161                         if (!map->nt_name) {
 162                                 return false;
 163                         }
 164                         map->comment = talloc_strdup(map, "Ordinary Users");
 165                         if (!map->comment) {
 166                                 return false;
 167                         }
 168                         sid_copy( &map->sid, &sid );
 169                         map->sid_name_use = SID_NAME_DOM_GRP;
 170                         map->gid = (gid_t)-1;
 171                         return True;
 172                 }
 173                 return False;
 174         }
 175
 176         DEBUG(10, ("get_domain_group_from_sid: SID found in passdb\n"));
 177
 178         /* if it's not a domain group, continue */
 179         if (map->sid_name_use!=SID_NAME_DOM_GRP) {
 180                 return False;
 181         }
 182
 183         DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
 184
 185         if (map->gid==-1) {
 186                 return False;
 187         }
 188
 189         DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid));
 190
 191         grp = getgrgid(map->gid);
 192         if ( !grp ) {
 193                 DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n"));
 194                 return False;
 195         }
 196
 197         DEBUG(10, ("get_domain_group_from_sid: gid exists in UNIX security\n"));
 198
 199         return True;
 200 }
 201
 202 /****************************************************************************
 203  Create a UNIX group on demand.
 204 ****************************************************************************/
 205
 206 int smb_create_group(const char *unix_group, gid_t *new_gid)
 207 {
 208         char *add_script = NULL;
 209         int     ret = -1;
 210         int     fd = 0;
 211
 212         *new_gid = 0;
 213
 214         /* defer to scripts */
 215
 216         if ( *lp_addgroup_script(talloc_tos()) ) {
 217                 TALLOC_CTX *ctx = talloc_tos();
 218
 219                 add_script = talloc_strdup(ctx,
 220                                         lp_addgroup_script(ctx));
 221                 if (!add_script) {
 222                         return -1;
 223                 }
 224                 add_script = talloc_string_sub(ctx,
 225                                 add_script, "%g", unix_group);
 226                 if (!add_script) {
 227                         return -1;
 228                 }
 229
 230                 ret = smbrun(add_script, &fd);
 231                 DEBUG(ret ? 0 : 3,("smb_create_group: Running the command `%s' gave %d\n",add_script,ret));
 232                 if (ret == 0) {
 233                         smb_nscd_flush_group_cache();
 234                 }
 235                 if (ret != 0)
 236                         return ret;
 237
 238                 if (fd != 0) {
 239                         fstring output;
 240
 241                         *new_gid = 0;
 242                         if (read(fd, output, sizeof(output)) > 0) {
 243                                 *new_gid = (gid_t)strtoul(output, NULL, 10);
 244                         }
 245
 246                         close(fd);
 247                 }
 248
 249         }
 250
 251         if (*new_gid == 0) {
 252                 struct group *grp = getgrnam(unix_group);
 253
 254                 if (grp != NULL)
 255                         *new_gid = grp->gr_gid;
 256         }
 257
 258         return ret;
 259 }
 260
 261 /****************************************************************************
 262  Delete a UNIX group on demand.
 263 ****************************************************************************/
 264
 265 int smb_delete_group(const char *unix_group)
 266 {
 267         char *del_script = NULL;
 268         int ret = -1;
 269
 270         /* defer to scripts */
 271
 272         if ( *lp_delgroup_script(talloc_tos()) ) {
 273                 TALLOC_CTX *ctx = talloc_tos();
 274
 275                 del_script = talloc_strdup(ctx,
 276                                 lp_delgroup_script(ctx));
 277                 if (!del_script) {
 278                         return -1;
 279                 }
 280                 del_script = talloc_string_sub(ctx,
 281                                 del_script, "%g", unix_group);
 282                 if (!del_script) {
 283                         return -1;
 284                 }
 285                 ret = smbrun(del_script,NULL);
 286                 DEBUG(ret ? 0 : 3,("smb_delete_group: Running the command `%s' gave %d\n",del_script,ret));
 287                 if (ret == 0) {
 288                         smb_nscd_flush_group_cache();
 289                 }
 290                 return ret;
 291         }
 292
 293         return -1;
 294 }
 295
 296 /****************************************************************************
 297  Set a user's primary UNIX group.
 298 ****************************************************************************/
 299
 300 int smb_set_primary_group(const char *unix_group, const char* unix_user)
 301 {
 302         char *add_script = NULL;
 303         int ret = -1;
 304
 305         /* defer to scripts */
 306
 307         if ( *lp_setprimarygroup_script(talloc_tos()) ) {
 308                 TALLOC_CTX *ctx = talloc_tos();
 309
 310                 add_script = talloc_strdup(ctx,
 311                                 lp_setprimarygroup_script(ctx));
 312                 if (!add_script) {
 313                         return -1;
 314                 }
 315                 add_script = talloc_all_string_sub(ctx,
 316                                 add_script, "%g", unix_group);
 317                 if (!add_script) {
 318                         return -1;
 319                 }
 320                 add_script = talloc_string_sub(ctx,
 321                                 add_script, "%u", unix_user);
 322                 if (!add_script) {
 323                         return -1;
 324                 }
 325                 ret = smbrun(add_script,NULL);
 326                 flush_pwnam_cache();
 327                 DEBUG(ret ? 0 : 3,("smb_set_primary_group: "
 328                          "Running the command `%s' gave %d\n",add_script,ret));
 329                 if (ret == 0) {
 330                         smb_nscd_flush_group_cache();
 331                 }
 332                 return ret;
 333         }
 334
 335         return -1;
 336 }
 337
 338 /****************************************************************************
 339  Add a user to a UNIX group.
 340 ****************************************************************************/
 341
 342 int smb_add_user_group(const char *unix_group, const char *unix_user)
 343 {
 344         char *add_script = NULL;
 345         int ret = -1;
 346
 347         /* defer to scripts */
 348
 349         if ( *lp_addusertogroup_script(talloc_tos()) ) {
 350                 TALLOC_CTX *ctx = talloc_tos();
 351
 352                 add_script = talloc_strdup(ctx,
 353                                 lp_addusertogroup_script(ctx));
 354                 if (!add_script) {
 355                         return -1;
 356                 }
 357                 add_script = talloc_string_sub(ctx,
 358                                 add_script, "%g", unix_group);
 359                 if (!add_script) {
 360                         return -1;
 361                 }
 362                 add_script = talloc_string_sub2(ctx,
 363                                 add_script, "%u", unix_user, true, false, true);
 364                 if (!add_script) {
 365                         return -1;
 366                 }
 367                 ret = smbrun(add_script,NULL);
 368                 DEBUG(ret ? 0 : 3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script,ret));
 369                 if (ret == 0) {
 370                         smb_nscd_flush_group_cache();
 371                 }
 372                 return ret;
 373         }
 374
 375         return -1;
 376 }
 377
 378 /****************************************************************************
 379  Delete a user from a UNIX group
 380 ****************************************************************************/
 381
 382 int smb_delete_user_group(const char *unix_group, const char *unix_user)
 383 {
 384         char *del_script = NULL;
 385         int ret = -1;
 386
 387         /* defer to scripts */
 388
 389         if ( *lp_deluserfromgroup_script(talloc_tos()) ) {
 390                 TALLOC_CTX *ctx = talloc_tos();
 391
 392                 del_script = talloc_strdup(ctx,
 393                                 lp_deluserfromgroup_script(ctx));
 394                 if (!del_script) {
 395                         return -1;
 396                 }
 397                 del_script = talloc_string_sub(ctx,
 398                                 del_script, "%g", unix_group);
 399                 if (!del_script) {
 400                         return -1;
 401                 }
 402                 del_script = talloc_string_sub2(ctx,
 403                                 del_script, "%u", unix_user, true, false, true);
 404                 if (!del_script) {
 405                         return -1;
 406                 }
 407                 ret = smbrun(del_script,NULL);
 408                 DEBUG(ret ? 0 : 3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script,ret));
 409                 if (ret == 0) {
 410                         smb_nscd_flush_group_cache();
 411                 }
 412                 return ret;
 413         }
 414
 415         return -1;
 416 }
 417
 418
 419 NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
 420                                  struct dom_sid sid)
 421 {
 422         if (!init_group_mapping()) {
 423                 DEBUG(0,("failed to initialize group mapping\n"));
 424                 return NT_STATUS_UNSUCCESSFUL;
 425         }
 426         return backend->get_group_map_from_sid(sid, map) ?
 427                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 428 }
 429
 430 NTSTATUS pdb_default_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
 431                                  gid_t gid)
 432 {
 433         if (!init_group_mapping()) {
 434                 DEBUG(0,("failed to initialize group mapping\n"));
 435                 return NT_STATUS_UNSUCCESSFUL;
 436         }
 437         return backend->get_group_map_from_gid(gid, map) ?
 438                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 439 }
 440
 441 NTSTATUS pdb_default_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
 442                                  const char *name)
 443 {
 444         if (!init_group_mapping()) {
 445                 DEBUG(0,("failed to initialize group mapping\n"));
 446                 return NT_STATUS_UNSUCCESSFUL;
 447         }
 448         return backend->get_group_map_from_ntname(name, map) ?
 449                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 450 }
 451
 452 NTSTATUS pdb_default_add_group_mapping_entry(struct pdb_methods *methods,
 453                                                 GROUP_MAP *map)
 454 {
 455         if (!init_group_mapping()) {
 456                 DEBUG(0,("failed to initialize group mapping\n"));
 457                 return NT_STATUS_UNSUCCESSFUL;
 458         }
 459         return backend->add_mapping_entry(map, TDB_INSERT) ?
 460                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 461 }
 462
 463 NTSTATUS pdb_default_update_group_mapping_entry(struct pdb_methods *methods,
 464                                                    GROUP_MAP *map)
 465 {
 466         if (!init_group_mapping()) {
 467                 DEBUG(0,("failed to initialize group mapping\n"));
 468                 return NT_STATUS_UNSUCCESSFUL;
 469         }
 470         return backend->add_mapping_entry(map, TDB_REPLACE) ?
 471                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 472 }
 473
 474 NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods,
 475                                                    struct dom_sid sid)
 476 {
 477         if (!init_group_mapping()) {
 478                 DEBUG(0,("failed to initialize group mapping\n"));
 479                 return NT_STATUS_UNSUCCESSFUL;
 480         }
 481         return backend->group_map_remove(&sid) ?
 482                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 483 }
 484
 485 NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
 486                                         const struct dom_sid *sid,
 487                                         enum lsa_SidType sid_name_use,
 488                                         GROUP_MAP ***pp_rmap,
 489                                         size_t *p_num_entries,
 490                                         bool unix_only)
 491 {
 492         if (!init_group_mapping()) {
 493                 DEBUG(0,("failed to initialize group mapping\n"));
 494                 return NT_STATUS_UNSUCCESSFUL;
 495         }
 496         return backend->enum_group_mapping(sid, sid_name_use, pp_rmap, p_num_entries, unix_only) ?
 497                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 498 }
 499
 500 NTSTATUS pdb_default_create_alias(struct pdb_methods *methods,
 501                                   const char *name, uint32 *rid)
 502 {
 503         struct dom_sid sid;
 504         enum lsa_SidType type;
 505         uint32 new_rid;
 506         gid_t gid;
 507         bool exists;
 508         GROUP_MAP *map;
 509         TALLOC_CTX *mem_ctx;
 510         NTSTATUS status;
 511
 512         DEBUG(10, ("Trying to create alias %s\n", name));
 513
 514         mem_ctx = talloc_new(NULL);
 515         if (mem_ctx == NULL) {
 516                 return NT_STATUS_NO_MEMORY;
 517         }
 518
 519         exists = lookup_name(mem_ctx, name, LOOKUP_NAME_LOCAL,
 520                              NULL, NULL, &sid, &type);
 521
 522         if (exists) {
 523                 status = NT_STATUS_ALIAS_EXISTS;
 524                 goto done;
 525         }
 526
 527         if (!pdb_new_rid(&new_rid)) {
 528                 DEBUG(0, ("Could not allocate a RID.\n"));
 529                 status = NT_STATUS_ACCESS_DENIED;
 530                 goto done;
 531         }
 532
 533         sid_compose(&sid, get_global_sam_sid(), new_rid);
 534
 535         if (!winbind_allocate_gid(&gid)) {
 536                 DEBUG(3, ("Could not get a gid out of winbind - "
 537                           "wasted a rid :-(\n"));
 538                 status = NT_STATUS_ACCESS_DENIED;
 539                 goto done;
 540         }
 541
 542         DEBUG(10, ("Creating alias %s with gid %u and rid %u\n",
 543                    name, (unsigned int)gid, (unsigned int)new_rid));
 544
 545         map = talloc_zero(mem_ctx, GROUP_MAP);
 546         if (!map) {
 547                 status = NT_STATUS_NO_MEMORY;
 548                 goto done;
 549         }
 550
 551         map->gid = gid;
 552         sid_copy(&map->sid, &sid);
 553         map->sid_name_use = SID_NAME_ALIAS;
 554         map->nt_name = talloc_strdup(map, name);
 555         if (!map->nt_name) {
 556                 status = NT_STATUS_NO_MEMORY;
 557                 goto done;
 558         }
 559         map->comment = talloc_strdup(map, "");
 560         if (!map->comment) {
 561                 status = NT_STATUS_NO_MEMORY;
 562                 goto done;
 563         }
 564
 565         status = pdb_add_group_mapping_entry(map);
 566
 567         if (!NT_STATUS_IS_OK(status)) {
 568                 DEBUG(0, ("Could not add group mapping entry for alias %s "
 569                           "(%s)\n", name, nt_errstr(status)));
 570                 goto done;
 571         }
 572
 573         *rid = new_rid;
 574
 575 done:
 576         TALLOC_FREE(mem_ctx);
 577         return status;
 578 }
 579
 580 NTSTATUS pdb_default_delete_alias(struct pdb_methods *methods,
 581                                   const struct dom_sid *sid)
 582 {
 583         return pdb_delete_group_mapping_entry(*sid);
 584 }
 585
 586 NTSTATUS pdb_default_get_aliasinfo(struct pdb_methods *methods,
 587                                    const struct dom_sid *sid,
 588                                    struct acct_info *info)
 589 {
 590         NTSTATUS status = NT_STATUS_OK;
 591         GROUP_MAP *map;
 592
 593         map = talloc_zero(NULL, GROUP_MAP);
 594         if (!map) {
 595                 return NT_STATUS_NO_MEMORY;
 596         }
 597
 598         if (!pdb_getgrsid(map, *sid)) {
 599                 status = NT_STATUS_NO_SUCH_ALIAS;
 600                 goto done;
 601         }
 602
 603         if ((map->sid_name_use != SID_NAME_ALIAS) &&
 604             (map->sid_name_use != SID_NAME_WKN_GRP)) {
 605                 DEBUG(2, ("%s is a %s, expected an alias\n",
 606                           sid_string_dbg(sid),
 607                           sid_type_lookup(map->sid_name_use)));
 608                 status = NT_STATUS_NO_SUCH_ALIAS;
 609                 goto done;
 610         }
 611
 612         info->acct_name = talloc_move(info, &map->nt_name);
 613         if (!info->acct_name) {
 614                 status = NT_STATUS_NO_MEMORY;
 615                 goto done;
 616         }
 617         info->acct_desc = talloc_move(info, &map->comment);
 618         if (!info->acct_desc) {
 619                 status = NT_STATUS_NO_MEMORY;
 620                 goto done;
 621         }
 622         sid_peek_rid(&map->sid, &info->rid);
 623
 624 done:
 625         TALLOC_FREE(map);
 626         return status;
 627 }
 628
 629 NTSTATUS pdb_default_set_aliasinfo(struct pdb_methods *methods,
 630                                    const struct dom_sid *sid,
 631                                    struct acct_info *info)
 632 {
 633         NTSTATUS status = NT_STATUS_OK;
 634         GROUP_MAP *map;
 635
 636         map = talloc_zero(NULL, GROUP_MAP);
 637         if (!map) {
 638                 return NT_STATUS_NO_MEMORY;
 639         }
 640
 641         if (!pdb_getgrsid(map, *sid)) {
 642                 status = NT_STATUS_NO_SUCH_ALIAS;
 643                 goto done;
 644         }
 645
 646         map->nt_name = talloc_strdup(map, info->acct_name);
 647         if (!map->nt_name) {
 648                 status = NT_STATUS_NO_MEMORY;
 649                 goto done;
 650         }
 651         map->comment = talloc_strdup(map, info->acct_desc);
 652         if (!map->comment) {
 653                 status = NT_STATUS_NO_MEMORY;
 654                 goto done;
 655         }
 656
 657         status = pdb_update_group_mapping_entry(map);
 658
 659 done:
 660         TALLOC_FREE(map);
 661         return status;
 662 }
 663
 664 NTSTATUS pdb_default_add_aliasmem(struct pdb_methods *methods,
 665                                   const struct dom_sid *alias, const struct dom_sid *member)
 666 {
 667         if (!init_group_mapping()) {
 668                 DEBUG(0,("failed to initialize group mapping\n"));
 669                 return NT_STATUS_UNSUCCESSFUL;
 670         }
 671         return backend->add_aliasmem(alias, member);
 672 }
 673
 674 NTSTATUS pdb_default_del_aliasmem(struct pdb_methods *methods,
 675                                   const struct dom_sid *alias, const struct dom_sid *member)
 676 {
 677         if (!init_group_mapping()) {
 678                 DEBUG(0,("failed to initialize group mapping\n"));
 679                 return NT_STATUS_UNSUCCESSFUL;
 680         }
 681         return backend->del_aliasmem(alias, member);
 682 }
 683
 684 NTSTATUS pdb_default_enum_aliasmem(struct pdb_methods *methods,
 685                                    const struct dom_sid *alias, TALLOC_CTX *mem_ctx,
 686                                    struct dom_sid **pp_members, size_t *p_num_members)
 687 {
 688         if (!init_group_mapping()) {
 689                 DEBUG(0,("failed to initialize group mapping\n"));
 690                 return NT_STATUS_UNSUCCESSFUL;
 691         }
 692         return backend->enum_aliasmem(alias, mem_ctx, pp_members,
 693                                       p_num_members);
 694 }
 695
 696 NTSTATUS pdb_default_alias_memberships(struct pdb_methods *methods,
 697                                        TALLOC_CTX *mem_ctx,
 698                                        const struct dom_sid *domain_sid,
 699                                        const struct dom_sid *members,
 700                                        size_t num_members,
 701                                        uint32 **pp_alias_rids,
 702                                        size_t *p_num_alias_rids)
 703 {
 704         struct dom_sid *alias_sids;
 705         size_t i, num_alias_sids;
 706         NTSTATUS result;
 707
 708         if (!init_group_mapping()) {
 709                 DEBUG(0,("failed to initialize group mapping\n"));
 710                 return NT_STATUS_UNSUCCESSFUL;
 711         }
 712
 713         alias_sids = NULL;
 714         num_alias_sids = 0;
 715
 716         result = alias_memberships(members, num_members,
 717                                    &alias_sids, &num_alias_sids);
 718
 719         if (!NT_STATUS_IS_OK(result))
 720                 return result;
 721
 722         *p_num_alias_rids = 0;
 723
 724         if (num_alias_sids == 0) {
 725                 TALLOC_FREE(alias_sids);
 726                 return NT_STATUS_OK;
 727         }
 728
 729         *pp_alias_rids = talloc_array(mem_ctx, uint32, num_alias_sids);
 730         if (*pp_alias_rids == NULL)
 731                 return NT_STATUS_NO_MEMORY;
 732
 733         for (i=0; i<num_alias_sids; i++) {
 734                 if (!sid_peek_check_rid(domain_sid, &alias_sids[i],
 735                                         &(*pp_alias_rids)[*p_num_alias_rids]))
 736                         continue;
 737                 *p_num_alias_rids += 1;
 738         }
 739
 740         TALLOC_FREE(alias_sids);
 741
 742         return NT_STATUS_OK;
 743 }
 744
 745 /**********************************************************************
 746  no ops for passdb backends that don't implement group mapping
 747  *********************************************************************/
 748
 749 NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
 750                                  struct dom_sid sid)
 751 {
 752         return NT_STATUS_UNSUCCESSFUL;
 753 }
 754
 755 NTSTATUS pdb_nop_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
 756                                  gid_t gid)
 757 {
 758         return NT_STATUS_UNSUCCESSFUL;
 759 }
 760
 761 NTSTATUS pdb_nop_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
 762                                  const char *name)
 763 {
 764         return NT_STATUS_UNSUCCESSFUL;
 765 }
 766
 767 NTSTATUS pdb_nop_add_group_mapping_entry(struct pdb_methods *methods,
 768                                                 GROUP_MAP *map)
 769 {
 770         return NT_STATUS_UNSUCCESSFUL;
 771 }
 772
 773 NTSTATUS pdb_nop_update_group_mapping_entry(struct pdb_methods *methods,
 774                                                    GROUP_MAP *map)
 775 {
 776         return NT_STATUS_UNSUCCESSFUL;
 777 }
 778
 779 NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods,
 780                                                    struct dom_sid sid)
 781 {
 782         return NT_STATUS_UNSUCCESSFUL;
 783 }
 784
 785 NTSTATUS pdb_nop_enum_group_mapping(struct pdb_methods *methods,
 786                                            enum lsa_SidType sid_name_use,
 787                                            GROUP_MAP **rmap, size_t *num_entries,
 788                                            bool unix_only)
 789 {
 790         return NT_STATUS_UNSUCCESSFUL;
 791 }
 792
 793 /**
 794 * @brief Add a new group mapping
 795 *
 796 * @param[in] gid gid to use to store the mapping. If gid is 0,
 797 *                new gid will be allocated from winbind
 798 *
 799 * @return Normal NTSTATUS return
 800 */
 801 NTSTATUS pdb_create_builtin_alias(uint32 rid, gid_t gid)
 802 {
 803         struct dom_sid sid;
 804         enum lsa_SidType type;
 805         gid_t gidformap;
 806         GROUP_MAP *map;
 807         NTSTATUS status;
 808         const char *name = NULL;
 809
 810         DEBUG(10, ("Trying to create builtin alias %d\n", rid));
 811
 812         if ( !sid_compose( &sid, &global_sid_Builtin, rid ) ) {
 813                 return NT_STATUS_NO_SUCH_ALIAS;
 814         }
 815
 816         /* use map as overall temp mem context */
 817         map = talloc_zero(NULL, GROUP_MAP);
 818         if (!map) {
 819                 return NT_STATUS_NO_MEMORY;
 820         }
 821
 822         if (!lookup_sid(map, &sid, NULL, &name, &type)) {
 823                 status = NT_STATUS_NO_SUCH_ALIAS;
 824                 goto done;
 825         }
 826
 827         if (gid == 0) {
 828                 if (!winbind_allocate_gid(&gidformap)) {
 829                         DEBUG(3, ("pdb_create_builtin_alias: Could not get a "
 830                                   "gid out of winbind\n"));
 831                         status = NT_STATUS_ACCESS_DENIED;
 832                         goto done;
 833                 }
 834         } else {
 835                 gidformap = gid;
 836         }
 837
 838         DEBUG(10, ("Creating alias %s with gid %u\n", name,
 839                    (unsigned) gidformap));
 840
 841         map->gid = gidformap;
 842         sid_copy(&map->sid, &sid);
 843         map->sid_name_use = SID_NAME_ALIAS;
 844         map->nt_name = talloc_strdup(map, name);
 845         if (!map->nt_name) {
 846                 status = NT_STATUS_NO_MEMORY;
 847                 goto done;
 848         }
 849         map->comment = talloc_strdup(map, "");
 850         if (!map->comment) {
 851                 status = NT_STATUS_NO_MEMORY;
 852                 goto done;
 853         }
 854
 855         status = pdb_add_group_mapping_entry(map);
 856
 857         if (!NT_STATUS_IS_OK(status)) {
 858                 DEBUG(0, ("pdb_create_builtin_alias: Could not add group mapping entry for alias %d "
 859                           "(%s)\n", rid, nt_errstr(status)));
 860         }
 861
 862 done:
 863         TALLOC_FREE(map);
 864         return status;
 865 }
 866
 867