2 Unix SMB/CIFS implementation.
3 Samba utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Luke Kenneth Caseson Leighton 1998-1999
6 Copyright (C) Jeremy Allison 1999
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 #define MAX_SID_NAMES 7
27 typedef struct _known_sid_users
{
29 enum SID_NAME_USE sid_name_use
;
30 const char *known_user_name
;
33 static struct sid_name_map_info
37 const known_sid_users
*known_users
;
38 } sid_name_map
[MAX_SID_NAMES
];
40 extern DOM_SID global_sid_Builtin
; /* Local well-known domain */
41 extern DOM_SID global_sid_World_Domain
; /* Everyone domain */
42 extern DOM_SID global_sid_Creator_Owner_Domain
; /* Creator Owner domain */
43 extern DOM_SID global_sid_NT_Authority
; /* NT Authority */
46 static BOOL sid_name_map_initialized
= False
;
47 /* static known_sid_users no_users[] = {{0, 0, NULL}}; */
49 static const known_sid_users everyone_users
[] = {
50 { 0, SID_NAME_WKN_GRP
, "Everyone" },
51 {0, (enum SID_NAME_USE
)0, NULL
}};
53 static const known_sid_users creator_owner_users
[] = {
54 { 0, SID_NAME_WKN_GRP
, "Creator Owner" },
55 { 1, SID_NAME_WKN_GRP
, "Creator Group" },
56 {0, (enum SID_NAME_USE
)0, NULL
}};
58 static const known_sid_users nt_authority_users
[] = {
59 { 1, SID_NAME_ALIAS
, "Dialup" },
60 { 2, SID_NAME_ALIAS
, "Network"},
61 { 3, SID_NAME_ALIAS
, "Batch"},
62 { 4, SID_NAME_ALIAS
, "Interactive"},
63 { 6, SID_NAME_ALIAS
, "Service"},
64 { 7, SID_NAME_ALIAS
, "AnonymousLogon"},
65 { 8, SID_NAME_ALIAS
, "Proxy"},
66 { 9, SID_NAME_ALIAS
, "ServerLogon"},
67 { 11, SID_NAME_ALIAS
, "Authenticated Users"},
68 { 18, SID_NAME_ALIAS
, "SYSTEM"},
69 { 0, (enum SID_NAME_USE
)0, NULL
}};
71 static const known_sid_users builtin_groups
[] = {
72 { BUILTIN_ALIAS_RID_ADMINS
, SID_NAME_ALIAS
, "Administrators" },
73 { BUILTIN_ALIAS_RID_USERS
, SID_NAME_ALIAS
, "Users" },
74 { BUILTIN_ALIAS_RID_GUESTS
, SID_NAME_ALIAS
, "Guests" },
75 { BUILTIN_ALIAS_RID_POWER_USERS
, SID_NAME_ALIAS
, "Power Users" },
76 { BUILTIN_ALIAS_RID_ACCOUNT_OPS
, SID_NAME_ALIAS
, "Account Operators" },
77 { BUILTIN_ALIAS_RID_SYSTEM_OPS
, SID_NAME_ALIAS
, "Server Operators" },
78 { BUILTIN_ALIAS_RID_PRINT_OPS
, SID_NAME_ALIAS
, "Print Operators" },
79 { BUILTIN_ALIAS_RID_BACKUP_OPS
, SID_NAME_ALIAS
, "Backup Operators" },
80 { BUILTIN_ALIAS_RID_REPLICATOR
, SID_NAME_ALIAS
, "Replicator" },
81 { BUILTIN_ALIAS_RID_RAS_SERVERS
, SID_NAME_ALIAS
, "RAS Servers" },
82 { BUILTIN_ALIAS_RID_PRE_2K_ACCESS
, SID_NAME_ALIAS
, "Pre-Windows 2000 Compatible Access" },
83 { 0, (enum SID_NAME_USE
)0, NULL
}};
85 /**************************************************************************
87 *************************************************************************/
89 static void init_sid_name_map (void)
93 if (sid_name_map_initialized
) return;
95 generate_wellknown_sids();
97 if ((lp_security() == SEC_USER
) && lp_domain_logons()) {
98 sid_name_map
[i
].sid
= get_global_sam_sid();
99 /* This is not lp_workgroup() for good reason:
100 it must stay around longer than the lp_*()
102 sid_name_map
[i
].name
= strdup(lp_workgroup());
103 sid_name_map
[i
].known_users
= NULL
;
105 sid_name_map
[i
].sid
= get_global_sam_sid();
106 sid_name_map
[i
].name
= strdup(global_myname());
107 sid_name_map
[i
].known_users
= NULL
;
110 sid_name_map
[i
].sid
= get_global_sam_sid();
111 sid_name_map
[i
].name
= strdup(global_myname());
112 sid_name_map
[i
].known_users
= NULL
;
116 sid_name_map
[i
].sid
= &global_sid_Builtin
;
117 sid_name_map
[i
].name
= "BUILTIN";
118 sid_name_map
[i
].known_users
= &builtin_groups
[0];
121 sid_name_map
[i
].sid
= &global_sid_World_Domain
;
122 sid_name_map
[i
].name
= "";
123 sid_name_map
[i
].known_users
= &everyone_users
[0];
126 sid_name_map
[i
].sid
= &global_sid_Creator_Owner_Domain
;
127 sid_name_map
[i
].name
= "";
128 sid_name_map
[i
].known_users
= &creator_owner_users
[0];
131 sid_name_map
[i
].sid
= &global_sid_NT_Authority
;
132 sid_name_map
[i
].name
= "NT Authority";
133 sid_name_map
[i
].known_users
= &nt_authority_users
[0];
137 sid_name_map
[i
].sid
= NULL
;
138 sid_name_map
[i
].name
= NULL
;
139 sid_name_map
[i
].known_users
= NULL
;
141 sid_name_map_initialized
= True
;
146 /**************************************************************************
147 Turns a domain SID into a name, returned in the nt_domain argument.
148 ***************************************************************************/
150 BOOL
map_domain_sid_to_name(DOM_SID
*sid
, fstring nt_domain
)
155 sid_to_string(sid_str
, sid
);
157 if (!sid_name_map_initialized
)
160 DEBUG(5,("map_domain_sid_to_name: %s\n", sid_str
));
162 if (nt_domain
== NULL
)
165 while (sid_name_map
[i
].sid
!= NULL
) {
166 sid_to_string(sid_str
, sid_name_map
[i
].sid
);
167 DEBUG(5,("map_domain_sid_to_name: compare: %s\n", sid_str
));
168 if (sid_equal(sid_name_map
[i
].sid
, sid
)) {
169 fstrcpy(nt_domain
, sid_name_map
[i
].name
);
170 DEBUG(5,("map_domain_sid_to_name: found '%s'\n", nt_domain
));
176 DEBUG(5,("map_domain_sid_to_name: mapping for %s not found\n", sid_str
));
181 /**************************************************************************
182 Looks up a known username from one of the known domains.
183 ***************************************************************************/
185 BOOL
lookup_known_rid(DOM_SID
*sid
, uint32 rid
, char *name
, enum SID_NAME_USE
*psid_name_use
)
188 struct sid_name_map_info
*psnm
;
190 if (!sid_name_map_initialized
)
193 for(i
= 0; sid_name_map
[i
].sid
!= NULL
; i
++) {
194 psnm
= &sid_name_map
[i
];
195 if(sid_equal(psnm
->sid
, sid
)) {
197 for(j
= 0; psnm
->known_users
&& psnm
->known_users
[j
].known_user_name
!= NULL
; j
++) {
198 if(rid
== psnm
->known_users
[j
].rid
) {
199 DEBUG(5,("lookup_builtin_rid: rid = %u, domain = '%s', user = '%s'\n",
200 (unsigned int)rid
, psnm
->name
, psnm
->known_users
[j
].known_user_name
));
201 fstrcpy( name
, psnm
->known_users
[j
].known_user_name
);
202 *psid_name_use
= psnm
->known_users
[j
].sid_name_use
;
212 /**************************************************************************
213 Turns a domain name into a SID.
214 *** side-effect: if the domain name is NULL, it is set to our domain ***
215 ***************************************************************************/
217 BOOL
map_domain_name_to_sid(DOM_SID
*sid
, char *nt_domain
)
221 if (nt_domain
== NULL
) {
222 DEBUG(5,("map_domain_name_to_sid: mapping NULL domain to our SID.\n"));
223 sid_copy(sid
, get_global_sam_sid());
227 if (nt_domain
[0] == 0) {
228 fstrcpy(nt_domain
, global_myname());
229 DEBUG(5,("map_domain_name_to_sid: overriding blank name to %s\n", nt_domain
));
230 sid_copy(sid
, get_global_sam_sid());
234 DEBUG(5,("map_domain_name_to_sid: %s\n", nt_domain
));
236 if (!sid_name_map_initialized
)
239 while (sid_name_map
[i
].name
!= NULL
) {
240 DEBUG(5,("map_domain_name_to_sid: compare: %s\n", sid_name_map
[i
].name
));
241 if (strequal(sid_name_map
[i
].name
, nt_domain
)) {
243 sid_copy(sid
, sid_name_map
[i
].sid
);
244 sid_to_string(sid_str
, sid_name_map
[i
].sid
);
245 DEBUG(5,("map_domain_name_to_sid: found %s\n", sid_str
));
251 DEBUG(0,("map_domain_name_to_sid: mapping to %s not found.\n", nt_domain
));
255 /*****************************************************************
256 Check if the SID is our domain SID (S-1-5-21-x-y-z).
257 *****************************************************************/
259 BOOL
sid_check_is_domain(const DOM_SID
*sid
)
261 return sid_equal(sid
, get_global_sam_sid());
264 /*****************************************************************
265 Check if the SID is our domain SID (S-1-5-21-x-y-z).
266 *****************************************************************/
268 BOOL
sid_check_is_in_our_domain(const DOM_SID
*sid
)
273 sid_copy(&dom_sid
, sid
);
274 sid_split_rid(&dom_sid
, &rid
);
276 return sid_equal(&dom_sid
, get_global_sam_sid());
279 /**************************************************************************
280 Try and map a name to one of the well known SIDs.
281 ***************************************************************************/
283 BOOL
map_name_to_wellknown_sid(DOM_SID
*sid
, enum SID_NAME_USE
*use
, const char *name
)
287 if (!sid_name_map_initialized
)
290 for (i
=0; sid_name_map
[i
].sid
!= NULL
; i
++) {
291 const known_sid_users
*users
= sid_name_map
[i
].known_users
;
296 for (j
=0; users
[j
].known_user_name
!= NULL
; j
++) {
297 if ( strequal(users
[j
].known_user_name
, name
) ) {
298 sid_copy(sid
, sid_name_map
[i
].sid
);
299 sid_append_rid(sid
, users
[j
].rid
);
300 *use
= users
[j
].sid_name_use
;
309 void add_sid_to_array(const DOM_SID
*sid
, DOM_SID
**sids
, int *num
)
311 *sids
= Realloc(*sids
, ((*num
)+1) * sizeof(DOM_SID
));
316 sid_copy(&((*sids
)[*num
]), sid
);
322 void add_gid_to_array_unique(gid_t gid
, gid_t
**gids
, int *num
)
326 if ((*num
) >= groups_max())
329 for (i
=0; i
<*num
; i
++) {
330 if ((*gids
)[i
] == gid
)
334 *gids
= Realloc(*gids
, (*num
+1) * sizeof(gid_t
));
343 /**************************************************************************
344 Augment a gid list with gids from alias memberships
345 ***************************************************************************/
347 void add_foreign_gids_from_sid(const DOM_SID
*sid
, gid_t
**gids
, int *num
)
352 if (!pdb_enum_alias_memberships(sid
, &aliases
, &num_aliases
))
355 for (j
=0; j
<num_aliases
; j
++) {
358 if (!NT_STATUS_IS_OK(sid_to_gid(&aliases
[j
], &gid
)))
361 add_gid_to_array_unique(gid
, gids
, num
);