?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Apply my experimental aliases support to HEAD. This will be a bit difficult to
[Samba/gebeck_regimport.git] / source / groupdb / mapping.c
blob5eaa4e1386fe402ba92d95dcb9eac29a91855abe
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-2000,
5 * Copyright (C) Jean François Micouleau 1998-2001.
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20 */
21
22 #include "includes.h"
23
24 static TDB_CONTEXT *tdb; /* used for driver files */
25
26 #define DATABASE_VERSION_V1 1 /* native byte format. */
27 #define DATABASE_VERSION_V2 2 /* le format. */
28
29 #define GROUP_PREFIX "UNIXGROUP/"
30 #define ALIASMEM_PREFIX "ALIASMEMBERS/"
31
32 PRIVS privs[] = {
33 {SE_PRIV_NONE, "no_privs", "No privilege" }, /* this one MUST be first */
34 {SE_PRIV_ADD_MACHINES, "SeMachineAccountPrivilege", "Add workstations to the domain" },
35 {SE_PRIV_SEC_PRIV, "SeSecurityPrivilege", "Manage the audit logs" },
36 {SE_PRIV_TAKE_OWNER, "SeTakeOwnershipPrivilege", "Take ownership of file" },
37 {SE_PRIV_ADD_USERS, "SaAddUsers", "Add users to the domain - Samba" },
38 {SE_PRIV_PRINT_OPERATOR, "SaPrintOp", "Add or remove printers - Samba" },
39 {SE_PRIV_ALL, "SaAllPrivs", "all privileges" }
40 };
41
42
43 /****************************************************************************
44 dump the mapping group mapping to a text file
45 ****************************************************************************/
46 char *decode_sid_name_use(fstring group, enum SID_NAME_USE name_use)
47 {
48 static fstring group_type;
49
50 switch(name_use) {
51 case SID_NAME_USER:
52 fstrcpy(group_type,"User");
53 break;
54 case SID_NAME_DOM_GRP:
55 fstrcpy(group_type,"Domain group");
56 break;
57 case SID_NAME_DOMAIN:
58 fstrcpy(group_type,"Domain");
59 break;
60 case SID_NAME_ALIAS:
61 fstrcpy(group_type,"Local group");
62 break;
63 case SID_NAME_WKN_GRP:
64 fstrcpy(group_type,"Builtin group");
65 break;
66 case SID_NAME_DELETED:
67 fstrcpy(group_type,"Deleted");
68 break;
69 case SID_NAME_INVALID:
70 fstrcpy(group_type,"Invalid");
71 break;
72 case SID_NAME_UNKNOWN:
73 default:
74 fstrcpy(group_type,"Unknown type");
75 break;
76 }
77
78 fstrcpy(group, group_type);
79 return group_type;
80 }
81
82 /****************************************************************************
83 initialise first time the mapping list - called from init_group_mapping()
84 ****************************************************************************/
85 static BOOL default_group_mapping(void)
86 {
87 DOM_SID sid_admins;
88 DOM_SID sid_users;
89 DOM_SID sid_guests;
90 fstring str_admins;
91 fstring str_users;
92 fstring str_guests;
93
94 /* Add the Wellknown groups */
95
96 add_initial_entry(-1, "S-1-5-32-544", SID_NAME_WKN_GRP, "Administrators", "");
97 add_initial_entry(-1, "S-1-5-32-545", SID_NAME_WKN_GRP, "Users", "");
98 add_initial_entry(-1, "S-1-5-32-546", SID_NAME_WKN_GRP, "Guests", "");
99 add_initial_entry(-1, "S-1-5-32-547", SID_NAME_WKN_GRP, "Power Users", "");
100 add_initial_entry(-1, "S-1-5-32-548", SID_NAME_WKN_GRP, "Account Operators", "");
101 add_initial_entry(-1, "S-1-5-32-549", SID_NAME_WKN_GRP, "System Operators", "");
102 add_initial_entry(-1, "S-1-5-32-550", SID_NAME_WKN_GRP, "Print Operators", "");
103 add_initial_entry(-1, "S-1-5-32-551", SID_NAME_WKN_GRP, "Backup Operators", "");
104 add_initial_entry(-1, "S-1-5-32-552", SID_NAME_WKN_GRP, "Replicators", "");
105
106 /* Add the defaults domain groups */
107
108 sid_copy(&sid_admins, get_global_sam_sid());
109 sid_append_rid(&sid_admins, DOMAIN_GROUP_RID_ADMINS);
110 sid_to_string(str_admins, &sid_admins);
111 add_initial_entry(-1, str_admins, SID_NAME_DOM_GRP, "Domain Admins", "");
112
113 sid_copy(&sid_users, get_global_sam_sid());
114 sid_append_rid(&sid_users, DOMAIN_GROUP_RID_USERS);
115 sid_to_string(str_users, &sid_users);
116 add_initial_entry(-1, str_users, SID_NAME_DOM_GRP, "Domain Users", "");
117
118 sid_copy(&sid_guests, get_global_sam_sid());
119 sid_append_rid(&sid_guests, DOMAIN_GROUP_RID_GUESTS);
120 sid_to_string(str_guests, &sid_guests);
121 add_initial_entry(-1, str_guests, SID_NAME_DOM_GRP, "Domain Guests", "");
122
123 return True;
124 }
125
126 /****************************************************************************
127 Open the group mapping tdb.
128 ****************************************************************************/
129
130 static BOOL init_group_mapping(void)
131 {
132 static pid_t local_pid;
133 const char *vstring = "INFO/version";
134 int32 vers_id;
135
136 if (tdb && local_pid == sys_getpid())
137 return True;
138 tdb = tdb_open_log(lock_path("group_mapping.tdb"), 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
139 if (!tdb) {
140 DEBUG(0,("Failed to open group mapping database\n"));
141 return False;
142 }
143
144 local_pid = sys_getpid();
145
146 /* handle a Samba upgrade */
147 tdb_lock_bystring(tdb, vstring, 0);
148
149 /* Cope with byte-reversed older versions of the db. */
150 vers_id = tdb_fetch_int32(tdb, vstring);
151 if ((vers_id == DATABASE_VERSION_V1) || (IREV(vers_id) == DATABASE_VERSION_V1)) {
152 /* Written on a bigendian machine with old fetch_int code. Save as le. */
153 tdb_store_int32(tdb, vstring, DATABASE_VERSION_V2);
154 vers_id = DATABASE_VERSION_V2;
155 }
156
157 if (vers_id != DATABASE_VERSION_V2) {
158 tdb_traverse(tdb, tdb_traverse_delete_fn, NULL);
159 tdb_store_int32(tdb, vstring, DATABASE_VERSION_V2);
160 }
161
162 tdb_unlock_bystring(tdb, vstring);
163
164 /* write a list of default groups */
165 if(!default_group_mapping())
166 return False;
167
168 return True;
169 }
170
171 /****************************************************************************
172 ****************************************************************************/
173 static BOOL add_mapping_entry(GROUP_MAP *map, int flag)
174 {
175 TDB_DATA kbuf, dbuf;
176 pstring key, buf;
177 fstring string_sid="";
178 int len;
179
180 if(!init_group_mapping()) {
181 DEBUG(0,("failed to initialize group mapping"));
182 return(False);
183 }
184
185 sid_to_string(string_sid, &map->sid);
186
187 len = tdb_pack(buf, sizeof(buf), "ddff",
188 map->gid, map->sid_name_use, map->nt_name, map->comment);
189
190 if (len > sizeof(buf))
191 return False;
192
193 slprintf(key, sizeof(key), "%s%s", GROUP_PREFIX, string_sid);
194
195 kbuf.dsize = strlen(key)+1;
196 kbuf.dptr = key;
197 dbuf.dsize = len;
198 dbuf.dptr = buf;
199 if (tdb_store(tdb, kbuf, dbuf, flag) != 0) return False;
200
201 return True;
202 }
203
204 /****************************************************************************
205 initialise first time the mapping list
206 ****************************************************************************/
207 BOOL add_initial_entry(gid_t gid, const char *sid, enum SID_NAME_USE sid_name_use, const char *nt_name, const char *comment)
208 {
209 GROUP_MAP map;
210
211 if(!init_group_mapping()) {
212 DEBUG(0,("failed to initialize group mapping"));
213 return(False);
214 }
215
216 map.gid=gid;
217 if (!string_to_sid(&map.sid, sid)) {
218 DEBUG(0, ("string_to_sid failed: %s", sid));
219 return False;
220 }
221
222 map.sid_name_use=sid_name_use;
223 fstrcpy(map.nt_name, nt_name);
224 fstrcpy(map.comment, comment);
225
226 return pdb_add_group_mapping_entry(&map);
227 }
228
229 /****************************************************************************
230 Return the sid and the type of the unix group.
231 ****************************************************************************/
232
233 static BOOL get_group_map_from_sid(DOM_SID sid, GROUP_MAP *map)
234 {
235 TDB_DATA kbuf, dbuf;
236 pstring key;
237 fstring string_sid;
238 int ret = 0;
239
240 if(!init_group_mapping()) {
241 DEBUG(0,("failed to initialize group mapping"));
242 return(False);
243 }
244
245 /* the key is the SID, retrieving is direct */
246
247 sid_to_string(string_sid, &sid);
248 slprintf(key, sizeof(key), "%s%s", GROUP_PREFIX, string_sid);
249
250 kbuf.dptr = key;
251 kbuf.dsize = strlen(key)+1;
252
253 dbuf = tdb_fetch(tdb, kbuf);
254 if (!dbuf.dptr)
255 return False;
256
257 ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff",
258 &map->gid, &map->sid_name_use, &map->nt_name, &map->comment);
259
260 SAFE_FREE(dbuf.dptr);
261
262 if ( ret == -1 ) {
263 DEBUG(3,("get_group_map_from_sid: tdb_unpack failure\n"));
264 return False;
265 }
266
267 sid_copy(&map->sid, &sid);
268
269 return True;
270 }
271
272 /****************************************************************************
273 Return the sid and the type of the unix group.
274 ****************************************************************************/
275
276 static BOOL get_group_map_from_gid(gid_t gid, GROUP_MAP *map)
277 {
278 TDB_DATA kbuf, dbuf, newkey;
279 fstring string_sid;
280 int ret;
281
282 if(!init_group_mapping()) {
283 DEBUG(0,("failed to initialize group mapping"));
284 return(False);
285 }
286
287 /* we need to enumerate the TDB to find the GID */
288
289 for (kbuf = tdb_firstkey(tdb);
290 kbuf.dptr;
291 newkey = tdb_nextkey(tdb, kbuf), safe_free(kbuf.dptr), kbuf=newkey) {
292
293 if (strncmp(kbuf.dptr, GROUP_PREFIX, strlen(GROUP_PREFIX)) != 0) continue;
294
295 dbuf = tdb_fetch(tdb, kbuf);
296 if (!dbuf.dptr)
297 continue;
298
299 fstrcpy(string_sid, kbuf.dptr+strlen(GROUP_PREFIX));
300
301 string_to_sid(&map->sid, string_sid);
302
303 ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff",
304 &map->gid, &map->sid_name_use, &map->nt_name, &map->comment);
305
306 SAFE_FREE(dbuf.dptr);
307
308 if ( ret == -1 ) {
309 DEBUG(3,("get_group_map_from_gid: tdb_unpack failure\n"));
310 return False;
311 }
312
313 if (gid==map->gid) {
314 SAFE_FREE(kbuf.dptr);
315 return True;
316 }
317 }
318
319 return False;
320 }
321
322 /****************************************************************************
323 Return the sid and the type of the unix group.
324 ****************************************************************************/
325
326 static BOOL get_group_map_from_ntname(const char *name, GROUP_MAP *map)
327 {
328 TDB_DATA kbuf, dbuf, newkey;
329 fstring string_sid;
330 int ret;
331
332 if(!init_group_mapping()) {
333 DEBUG(0,("get_group_map_from_ntname:failed to initialize group mapping"));
334 return(False);
335 }
336
337 /* we need to enumerate the TDB to find the name */
338
339 for (kbuf = tdb_firstkey(tdb);
340 kbuf.dptr;
341 newkey = tdb_nextkey(tdb, kbuf), safe_free(kbuf.dptr), kbuf=newkey) {
342
343 if (strncmp(kbuf.dptr, GROUP_PREFIX, strlen(GROUP_PREFIX)) != 0) continue;
344
345 dbuf = tdb_fetch(tdb, kbuf);
346 if (!dbuf.dptr)
347 continue;
348
349 fstrcpy(string_sid, kbuf.dptr+strlen(GROUP_PREFIX));
350
351 string_to_sid(&map->sid, string_sid);
352
353 ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff",
354 &map->gid, &map->sid_name_use, &map->nt_name, &map->comment);
355
356 SAFE_FREE(dbuf.dptr);
357
358 if ( ret == -1 ) {
359 DEBUG(3,("get_group_map_from_ntname: tdb_unpack failure\n"));
360 return False;
361 }
362
363 if (StrCaseCmp(name, map->nt_name)==0) {
364 SAFE_FREE(kbuf.dptr);
365 return True;
366 }
367 }
368
369 return False;
370 }
371
372 /****************************************************************************
373 Remove a group mapping entry.
374 ****************************************************************************/
375
376 static BOOL group_map_remove(DOM_SID sid)
377 {
378 TDB_DATA kbuf, dbuf;
379 pstring key;
380 fstring string_sid;
381
382 if(!init_group_mapping()) {
383 DEBUG(0,("failed to initialize group mapping"));
384 return(False);
385 }
386
387 /* the key is the SID, retrieving is direct */
388
389 sid_to_string(string_sid, &sid);
390 slprintf(key, sizeof(key), "%s%s", GROUP_PREFIX, string_sid);
391
392 kbuf.dptr = key;
393 kbuf.dsize = strlen(key)+1;
394
395 dbuf = tdb_fetch(tdb, kbuf);
396 if (!dbuf.dptr)
397 return False;
398
399 SAFE_FREE(dbuf.dptr);
400
401 if(tdb_delete(tdb, kbuf) != TDB_SUCCESS)
402 return False;
403
404 return True;
405 }
406
407 /****************************************************************************
408 Enumerate the group mapping.
409 ****************************************************************************/
410
411 static BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap,
412 int *num_entries, BOOL unix_only)
413 {
414 TDB_DATA kbuf, dbuf, newkey;
415 fstring string_sid;
416 fstring group_type;
417 GROUP_MAP map;
418 GROUP_MAP *mapt;
419 int ret;
420 int entries=0;
421
422 if(!init_group_mapping()) {
423 DEBUG(0,("failed to initialize group mapping"));
424 return(False);
425 }
426
427 *num_entries=0;
428 *rmap=NULL;
429
430 for (kbuf = tdb_firstkey(tdb);
431 kbuf.dptr;
432 newkey = tdb_nextkey(tdb, kbuf), safe_free(kbuf.dptr), kbuf=newkey) {
433
434 if (strncmp(kbuf.dptr, GROUP_PREFIX, strlen(GROUP_PREFIX)) != 0)
435 continue;
436
437 dbuf = tdb_fetch(tdb, kbuf);
438 if (!dbuf.dptr)
439 continue;
440
441 fstrcpy(string_sid, kbuf.dptr+strlen(GROUP_PREFIX));
442
443 ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff",
444 &map.gid, &map.sid_name_use, &map.nt_name, &map.comment);
445
446 SAFE_FREE(dbuf.dptr);
447
448 if ( ret == -1 ) {
449 DEBUG(3,("enum_group_mapping: tdb_unpack failure\n"));
450 continue;
451 }
452
453 /* list only the type or everything if UNKNOWN */
454 if (sid_name_use!=SID_NAME_UNKNOWN && sid_name_use!=map.sid_name_use) {
455 DEBUG(11,("enum_group_mapping: group %s is not of the requested type\n", map.nt_name));
456 continue;
457 }
458
459 if (unix_only==ENUM_ONLY_MAPPED && map.gid==-1) {
460 DEBUG(11,("enum_group_mapping: group %s is non mapped\n", map.nt_name));
461 continue;
462 }
463
464 string_to_sid(&map.sid, string_sid);
465
466 decode_sid_name_use(group_type, map.sid_name_use);
467 DEBUG(11,("enum_group_mapping: returning group %s of type %s\n", map.nt_name ,group_type));
468
469 mapt=(GROUP_MAP *)Realloc((*rmap), (entries+1)*sizeof(GROUP_MAP));
470 if (!mapt) {
471 DEBUG(0,("enum_group_mapping: Unable to enlarge group map!\n"));
472 SAFE_FREE(*rmap);
473 return False;
474 }
475 else
476 (*rmap) = mapt;
477
478 mapt[entries].gid = map.gid;
479 sid_copy( &mapt[entries].sid, &map.sid);
480 mapt[entries].sid_name_use = map.sid_name_use;
481 fstrcpy(mapt[entries].nt_name, map.nt_name);
482 fstrcpy(mapt[entries].comment, map.comment);
483
484 entries++;
485
486 }
487
488 *num_entries=entries;
489
490 return True;
491 }
492
493 static NTSTATUS add_aliasmem(const DOM_SID *alias, const DOM_SID *member)
494 {
495 GROUP_MAP map;
496 TDB_DATA kbuf, dbuf;
497 pstring key;
498 fstring string_sid;
499 char *new_memberstring;
500 int result;
501
502 if(!init_group_mapping()) {
503 DEBUG(0,("failed to initialize group mapping"));
504 return NT_STATUS_ACCESS_DENIED;
505 }
506
507 if (!get_group_map_from_sid(*alias, &map))
508 return NT_STATUS_NO_SUCH_ALIAS;
509
510 if ( (map.sid_name_use != SID_NAME_ALIAS) &&
511 (map.sid_name_use != SID_NAME_WKN_GRP) )
512 return NT_STATUS_NO_SUCH_ALIAS;
513
514 sid_to_string(string_sid, alias);
515 slprintf(key, sizeof(key), "%s%s", ALIASMEM_PREFIX, string_sid);
516
517 kbuf.dsize = strlen(key)+1;
518 kbuf.dptr = key;
519
520 dbuf = tdb_fetch(tdb, kbuf);
521
522 sid_to_string(string_sid, member);
523
524 if (dbuf.dptr != NULL) {
525 asprintf(&new_memberstring, "%s %s", (char *)(dbuf.dptr),
526 string_sid);
527 } else {
528 new_memberstring = strdup(string_sid);
529 }
530
531 if (new_memberstring == NULL)
532 return NT_STATUS_NO_MEMORY;
533
534 SAFE_FREE(dbuf.dptr);
535 dbuf.dsize = strlen(new_memberstring)+1;
536 dbuf.dptr = new_memberstring;
537
538 result = tdb_store(tdb, kbuf, dbuf, 0);
539
540 SAFE_FREE(new_memberstring);
541
542 return (result == 0 ? NT_STATUS_OK : NT_STATUS_ACCESS_DENIED);
543 }
544
545 static BOOL add_sid_to_array(DOM_SID sid, DOM_SID **sids, int *num)
546 {
547 *sids = Realloc(*sids, ((*num)+1) * sizeof(DOM_SID));
548
549 if (*sids == NULL)
550 return False;
551
552 sid_copy(&((*sids)[*num]), &sid);
553 *num += 1;
554
555 return True;
556 }
557
558 static NTSTATUS enum_aliasmem(const DOM_SID *alias, DOM_SID **sids, int *num)
559 {
560 GROUP_MAP map;
561 TDB_DATA kbuf, dbuf;
562 pstring key;
563 fstring string_sid;
564 const char *p;
565
566 if(!init_group_mapping()) {
567 DEBUG(0,("failed to initialize group mapping"));
568 return NT_STATUS_ACCESS_DENIED;
569 }
570
571 if (!get_group_map_from_sid(*alias, &map))
572 return NT_STATUS_NO_SUCH_ALIAS;
573
574 if ( (map.sid_name_use != SID_NAME_ALIAS) &&
575 (map.sid_name_use != SID_NAME_WKN_GRP) )
576 return NT_STATUS_NO_SUCH_ALIAS;
577
578 *sids = NULL;
579 *num = 0;
580
581 sid_to_string(string_sid, alias);
582 slprintf(key, sizeof(key), "%s%s", ALIASMEM_PREFIX, string_sid);
583
584 kbuf.dsize = strlen(key)+1;
585 kbuf.dptr = key;
586
587 dbuf = tdb_fetch(tdb, kbuf);
588
589 if (dbuf.dptr == NULL) {
590 return NT_STATUS_OK;
591 }
592
593 p = dbuf.dptr;
594
595 while (next_token(&p, string_sid, " ", sizeof(string_sid))) {
596
597 DOM_SID sid;
598
599 if (!string_to_sid(&sid, string_sid))
600 continue;
601
602 if (!add_sid_to_array(sid, sids, num))
603 return NT_STATUS_NO_MEMORY;
604 }
605
606 SAFE_FREE(dbuf.dptr);
607
608 return NT_STATUS_OK;
609 }
610
611 /* This is racy as hell, but hey, it's only a prototype :-) */
612
613 static NTSTATUS del_aliasmem(const DOM_SID *alias, const DOM_SID *member)
614 {
615 NTSTATUS result;
616 DOM_SID *sids;
617 int i, num;
618 BOOL found = False;
619 char *member_string;
620 TDB_DATA kbuf, dbuf;
621 pstring key;
622 fstring sid_string;
623
624 result = enum_aliasmem(alias, &sids, &num);
625
626 if (!NT_STATUS_IS_OK(result))
627 return result;
628
629 for (i=0; i<num; i++) {
630 if (sid_compare(&sids[i], member) == 0) {
631 found = True;
632 break;
633 }
634 }
635
636 if (!found) {
637 SAFE_FREE(sids);
638 return NT_STATUS_MEMBER_NOT_IN_ALIAS;
639 }
640
641 if (i < num)
642 sids[i] = sids[num-1];
643
644 num -= 1;
645
646 member_string = strdup("");
647
648 if (member_string == NULL) {
649 SAFE_FREE(sids);
650 return NT_STATUS_NO_MEMORY;
651 }
652
653 for (i=0; i<num; i++) {
654 char *s = member_string;
655
656 sid_to_string(sid_string, &sids[i]);
657 asprintf(&member_string, "%s %s", s, sid_string);
658
659 SAFE_FREE(s);
660 if (member_string == NULL) {
661 SAFE_FREE(sids);
662 return NT_STATUS_NO_MEMORY;
663 }
664 }
665
666 sid_to_string(sid_string, alias);
667 slprintf(key, sizeof(key), "%s%s", ALIASMEM_PREFIX, sid_string);
668
669 kbuf.dsize = strlen(key)+1;
670 kbuf.dptr = key;
671 dbuf.dsize = strlen(member_string)+1;
672 dbuf.dptr = member_string;
673
674 result = tdb_store(tdb, kbuf, dbuf, 0) == 0 ?
675 NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
676
677 SAFE_FREE(sids);
678 SAFE_FREE(member_string);
679
680 return result;
681 }
682
683 static BOOL is_foreign_alias_member(const DOM_SID *sid, const DOM_SID *alias)
684 {
685 DOM_SID *members;
686 int i, num;
687 BOOL result = False;
688
689 if (!NT_STATUS_IS_OK(enum_aliasmem(alias, &members, &num)))
690 return False;
691
692 for (i=0; i<num; i++) {
693
694 if (sid_compare(&members[i], sid) == 0) {
695 result = True;
696 break;
697 }
698 }
699
700 SAFE_FREE(members);
701 return result;
702 }
703
704 static NTSTATUS alias_memberships(const DOM_SID *sid, DOM_SID **sids, int *num)
705 {
706 GROUP_MAP *maps;
707 int i, num_maps;
708
709 *num = 0;
710 *sids = NULL;
711
712 if (!enum_group_mapping(SID_NAME_WKN_GRP, &maps, &num_maps, False))
713 return NT_STATUS_NO_MEMORY;
714
715 for (i=0; i<num_maps; i++) {
716 if (is_foreign_alias_member(sid, &maps[i].sid))
717 add_sid_to_array(maps[i].sid, sids, num);
718 }
719 SAFE_FREE(maps);
720
721 if (!enum_group_mapping(SID_NAME_ALIAS, &maps, &num_maps, False))
722 return NT_STATUS_NO_MEMORY;
723
724 for (i=0; i<num_maps; i++) {
725 if (is_foreign_alias_member(sid, &maps[i].sid))
726 add_sid_to_array(maps[i].sid, sids, num);
727 }
728 SAFE_FREE(maps);
729
730 return NT_STATUS_OK;
731 }
732
733 /*
734 *
735 * High level functions
736 * better to use them than the lower ones.
737 *
738 * we are checking if the group is in the mapping file
739 * and if the group is an existing unix group
740 *
741 */
742
743 /* get a domain group from it's SID */
744
745 BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map)
746 {
747 struct group *grp;
748 BOOL ret;
749
750 if(!init_group_mapping()) {
751 DEBUG(0,("failed to initialize group mapping"));
752 return(False);
753 }
754
755 DEBUG(10, ("get_domain_group_from_sid\n"));
756
757 /* if the group is NOT in the database, it CAN NOT be a domain group */
758
759 become_root();
760 ret = pdb_getgrsid(map, sid);
761 unbecome_root();
762
763 if ( !ret )
764 return False;
765
766 DEBUG(10, ("get_domain_group_from_sid: SID found in the TDB\n"));
767
768 /* if it's not a domain group, continue */
769 if (map->sid_name_use!=SID_NAME_DOM_GRP) {
770 return False;
771 }
772
773 DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
774
775 if (map->gid==-1) {
776 return False;
777 }
778
779 DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid));
780
781 grp = getgrgid(map->gid);
782 if ( !grp ) {
783 DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n"));
784 return False;
785 }
786
787 DEBUG(10, ("get_domain_group_from_sid: gid exists in UNIX security\n"));
788
789 return True;
790 }
791
792
793 /* get a local (alias) group from it's SID */
794
795 BOOL get_local_group_from_sid(DOM_SID *sid, GROUP_MAP *map)
796 {
797 BOOL ret;
798
799 if(!init_group_mapping()) {
800 DEBUG(0,("failed to initialize group mapping"));
801 return(False);
802 }
803
804 /* The group is in the mapping table */
805 become_root();
806 ret = pdb_getgrsid(map, *sid);
807 unbecome_root();
808
809 if ( !ret )
810 return False;
811
812 if ( ( (map->sid_name_use != SID_NAME_ALIAS) &&
813 (map->sid_name_use != SID_NAME_WKN_GRP) )
814 || (map->gid == -1)
815 || (getgrgid(map->gid) == NULL) )
816 {
817 return False;
818 }
819
820 #if 1 /* JERRY */
821 /* local groups only exist in the group mapping DB so this
822 is not necessary */
823
824 else {
825 /* the group isn't in the mapping table.
826 * make one based on the unix information */
827 uint32 alias_rid;
828 struct group *grp;
829
830 sid_peek_rid(sid, &alias_rid);
831 map->gid=pdb_group_rid_to_gid(alias_rid);
832
833 grp = getgrgid(map->gid);
834 if ( !grp ) {
835 DEBUG(3,("get_local_group_from_sid: No unix group for [%ul]\n", map->gid));
836 return False;
837 }
838
839 map->sid_name_use=SID_NAME_ALIAS;
840
841 fstrcpy(map->nt_name, grp->gr_name);
842 fstrcpy(map->comment, "Local Unix Group");
843
844 sid_copy(&map->sid, sid);
845 }
846 #endif
847
848 return True;
849 }
850
851 /* get a builtin group from it's SID */
852
853 BOOL get_builtin_group_from_sid(DOM_SID *sid, GROUP_MAP *map)
854 {
855 struct group *grp;
856 BOOL ret;
857
858
859 if(!init_group_mapping()) {
860 DEBUG(0,("failed to initialize group mapping"));
861 return(False);
862 }
863
864 become_root();
865 ret = pdb_getgrsid(map, *sid);
866 unbecome_root();
867
868 if ( !ret )
869 return False;
870
871 if (map->sid_name_use!=SID_NAME_WKN_GRP) {
872 return False;
873 }
874
875 if (map->gid==-1) {
876 return False;
877 }
878
879 if ( (grp=getgrgid(map->gid)) == NULL) {
880 return False;
881 }
882
883 return True;
884 }
885
886
887
888 /****************************************************************************
889 Returns a GROUP_MAP struct based on the gid.
890 ****************************************************************************/
891 BOOL get_group_from_gid(gid_t gid, GROUP_MAP *map)
892 {
893 struct group *grp;
894 BOOL ret;
895
896 if(!init_group_mapping()) {
897 DEBUG(0,("failed to initialize group mapping"));
898 return(False);
899 }
900
901 if ( (grp=getgrgid(gid)) == NULL)
902 return False;
903
904 /*
905 * make a group map from scratch if doesn't exist.
906 */
907
908 become_root();
909 ret = pdb_getgrgid(map, gid);
910 unbecome_root();
911
912 if ( !ret ) {
913 map->gid=gid;
914 map->sid_name_use=SID_NAME_ALIAS;
915
916 /* interim solution until we have a last RID allocated */
917
918 sid_copy(&map->sid, get_global_sam_sid());
919 sid_append_rid(&map->sid, pdb_gid_to_group_rid(gid));
920
921 fstrcpy(map->nt_name, grp->gr_name);
922 fstrcpy(map->comment, "Local Unix Group");
923 }
924
925 return True;
926 }
927
928
929
930
931 /****************************************************************************
932 Get the member users of a group and
933 all the users who have that group as primary.
934
935 give back an array of SIDS
936 return the grand number of users
937
938
939 TODO: sort the list and remove duplicate. JFM.
940
941 ****************************************************************************/
942
943 BOOL get_sid_list_of_group(gid_t gid, DOM_SID **sids, int *num_sids)
944 {
945 struct group *grp;
946 int i=0;
947 char *gr;
948 DOM_SID *s;
949 DOM_SID sid;
950 DOM_SID *members;
951 int num_members;
952
953 struct sys_pwent *userlist;
954 struct sys_pwent *user;
955
956 if(!init_group_mapping()) {
957 DEBUG(0,("failed to initialize group mapping"));
958 return(False);
959 }
960
961 *num_sids = 0;
962 *sids=NULL;
963
964 if ( (grp=getgrgid(gid)) == NULL)
965 return False;
966
967 gr = grp->gr_mem[0];
968 DEBUG(10, ("getting members\n"));
969
970 while (gr && (*gr != (char)'\0')) {
971 SAM_ACCOUNT *group_member_acct = NULL;
972 BOOL found_user;
973 s = Realloc((*sids), sizeof(**sids)*(*num_sids+1));
974 if (!s) {
975 DEBUG(0,("get_uid_list_of_group: unable to enlarge SID list!\n"));
976 return False;
977 }
978 else (*sids) = s;
979
980 if (!NT_STATUS_IS_OK(pdb_init_sam(&group_member_acct))) {
981 continue;
982 }
983
984 become_root();
985 found_user = pdb_getsampwnam(group_member_acct, gr);
986 unbecome_root();
987
988 if (found_user) {
989 sid_copy(&(*sids)[*num_sids], pdb_get_user_sid(group_member_acct));
990 (*num_sids)++;
991 }
992
993 pdb_free_sam(&group_member_acct);
994
995 gr = grp->gr_mem[++i];
996 }
997 DEBUG(10, ("got [%d] members\n", *num_sids));
998
999 winbind_off();
1000
1001 user = userlist = getpwent_list();
1002
1003 while (user != NULL) {
1004
1005 SAM_ACCOUNT *group_member_acct = NULL;
1006 BOOL found_user;
1007
1008 if (user->pw_gid != gid) {
1009 user = user->next;
1010 continue;
1011 }
1012
1013 s = Realloc((*sids), sizeof(**sids)*(*num_sids+1));
1014 if (!s) {
1015 DEBUG(0,("get_sid_list_of_group: unable to enlarge "
1016 "SID list!\n"));
1017 pwent_free(userlist);
1018 winbind_on();
1019 return False;
1020 }
1021 else (*sids) = s;
1022
1023 if (!NT_STATUS_IS_OK(pdb_init_sam(&group_member_acct))) {
1024 continue;
1025 }
1026
1027 become_root();
1028 found_user = pdb_getsampwnam(group_member_acct, user->pw_name);
1029 unbecome_root();
1030
1031 if (found_user) {
1032 sid_copy(&(*sids)[*num_sids],
1033 pdb_get_user_sid(group_member_acct));
1034 (*num_sids)++;
1035 } else {
1036 DEBUG(4,("get_sid_list_of_group: User %s [uid == %lu] "
1037 "has no samba account\n",
1038 user->pw_name, (unsigned long)user->pw_uid));
1039 if (algorithmic_uid_to_sid(&(*sids)[*num_sids],
1040 user->pw_uid))
1041 (*num_sids)++;
1042 }
1043 pdb_free_sam(&group_member_acct);
1044
1045 user = user->next;
1046 }
1047 pwent_free(userlist);
1048 DEBUG(10, ("got primary groups, members: [%d]\n", *num_sids));
1049
1050 winbind_on();
1051
1052 if ( NT_STATUS_IS_OK(gid_to_sid(&sid, gid)) &&
1053 NT_STATUS_IS_OK(enum_aliasmem(&sid, &members, &num_members)) ) {
1054
1055 for (i=0; i<num_members; i++) {
1056 add_sid_to_array(members[i], sids, num_sids);
1057 }
1058 }
1059
1060 return True;
1061 }
1062
1063 /****************************************************************************
1064 Create a UNIX group on demand.
1065 ****************************************************************************/
1066
1067 int smb_create_group(char *unix_group, gid_t *new_gid)
1068 {
1069 pstring add_script;
1070 int ret = -1;
1071 int fd = 0;
1072
1073 *new_gid = 0;
1074
1075 /* defer to scripts */
1076
1077 if ( *lp_addgroup_script() ) {
1078 pstrcpy(add_script, lp_addgroup_script());
1079 pstring_sub(add_script, "%g", unix_group);
1080 ret = smbrun(add_script, (new_gid!=NULL) ? &fd : NULL);
1081 DEBUG(3,("smb_create_group: Running the command `%s' gave %d\n",add_script,ret));
1082 if (ret != 0)
1083 return ret;
1084
1085 if (fd != 0) {
1086 fstring output;
1087
1088 *new_gid = 0;
1089 if (read(fd, output, sizeof(output)) > 0) {
1090 *new_gid = (gid_t)strtoul(output, NULL, 10);
1091 }
1092
1093 close(fd);
1094 }
1095
1096 } else if ( winbind_create_group( unix_group, NULL ) ) {
1097
1098 DEBUG(3,("smb_create_group: winbindd created the group (%s)\n",
1099 unix_group));
1100 ret = 0;
1101 }
1102
1103 if (*new_gid == 0) {
1104 struct group *grp = getgrnam(unix_group);
1105
1106 if (grp != NULL)
1107 *new_gid = grp->gr_gid;
1108 }
1109
1110 return ret;
1111 }
1112
1113 /****************************************************************************
1114 Delete a UNIX group on demand.
1115 ****************************************************************************/
1116
1117 int smb_delete_group(char *unix_group)
1118 {
1119 pstring del_script;
1120 int ret;
1121
1122 /* defer to scripts */
1123
1124 if ( *lp_delgroup_script() ) {
1125 pstrcpy(del_script, lp_delgroup_script());
1126 pstring_sub(del_script, "%g", unix_group);
1127 ret = smbrun(del_script,NULL);
1128 DEBUG(3,("smb_delete_group: Running the command `%s' gave %d\n",del_script,ret));
1129 return ret;
1130 }
1131
1132 if ( winbind_delete_group( unix_group ) ) {
1133 DEBUG(3,("smb_delete_group: winbindd deleted the group (%s)\n",
1134 unix_group));
1135 return 0;
1136 }
1137
1138 return -1;
1139 }
1140
1141 /****************************************************************************
1142 Set a user's primary UNIX group.
1143 ****************************************************************************/
1144 int smb_set_primary_group(const char *unix_group, const char* unix_user)
1145 {
1146 pstring add_script;
1147 int ret;
1148
1149 /* defer to scripts */
1150
1151 if ( *lp_setprimarygroup_script() ) {
1152 pstrcpy(add_script, lp_setprimarygroup_script());
1153 all_string_sub(add_script, "%g", unix_group, sizeof(add_script));
1154 all_string_sub(add_script, "%u", unix_user, sizeof(add_script));
1155 ret = smbrun(add_script,NULL);
1156 DEBUG(3,("smb_set_primary_group: "
1157 "Running the command `%s' gave %d\n",add_script,ret));
1158 return ret;
1159 }
1160
1161 /* Try winbindd */
1162
1163 if ( winbind_set_user_primary_group( unix_user, unix_group ) ) {
1164 DEBUG(3,("smb_delete_group: winbindd set the group (%s) as the primary group for user (%s)\n",
1165 unix_group, unix_user));
1166 return 0;
1167 }
1168
1169 return -1;
1170 }
1171
1172 /****************************************************************************
1173 Add a user to a UNIX group.
1174 ****************************************************************************/
1175
1176 int smb_add_user_group(char *unix_group, char *unix_user)
1177 {
1178 pstring add_script;
1179 int ret;
1180
1181 /* defer to scripts */
1182
1183 if ( *lp_addusertogroup_script() ) {
1184 pstrcpy(add_script, lp_addusertogroup_script());
1185 pstring_sub(add_script, "%g", unix_group);
1186 pstring_sub(add_script, "%u", unix_user);
1187 ret = smbrun(add_script,NULL);
1188 DEBUG(3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script,ret));
1189 return ret;
1190 }
1191
1192 /* Try winbindd */
1193
1194 if ( winbind_add_user_to_group( unix_user, unix_group ) ) {
1195 DEBUG(3,("smb_delete_group: winbindd added user (%s) to the group (%s)\n",
1196 unix_user, unix_group));
1197 return -1;
1198 }
1199
1200 return -1;
1201 }
1202
1203 /****************************************************************************
1204 Delete a user from a UNIX group
1205 ****************************************************************************/
1206
1207 int smb_delete_user_group(const char *unix_group, const char *unix_user)
1208 {
1209 pstring del_script;
1210 int ret;
1211
1212 /* defer to scripts */
1213
1214 if ( *lp_deluserfromgroup_script() ) {
1215 pstrcpy(del_script, lp_deluserfromgroup_script());
1216 pstring_sub(del_script, "%g", unix_group);
1217 pstring_sub(del_script, "%u", unix_user);
1218 ret = smbrun(del_script,NULL);
1219 DEBUG(3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script,ret));
1220 return ret;
1221 }
1222
1223 /* Try winbindd */
1224
1225 if ( winbind_remove_user_from_group( unix_user, unix_group ) ) {
1226 DEBUG(3,("smb_delete_group: winbindd removed user (%s) from the group (%s)\n",
1227 unix_user, unix_group));
1228 return 0;
1229 }
1230
1231 return -1;
1232 }
1233
1234
1235 NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
1236 DOM_SID sid)
1237 {
1238 return get_group_map_from_sid(sid, map) ?
1239 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1240 }
1241
1242 NTSTATUS pdb_default_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
1243 gid_t gid)
1244 {
1245 return get_group_map_from_gid(gid, map) ?
1246 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1247 }
1248
1249 NTSTATUS pdb_default_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
1250 const char *name)
1251 {
1252 return get_group_map_from_ntname(name, map) ?
1253 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1254 }
1255
1256 NTSTATUS pdb_default_add_group_mapping_entry(struct pdb_methods *methods,
1257 GROUP_MAP *map)
1258 {
1259 return add_mapping_entry(map, TDB_INSERT) ?
1260 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1261 }
1262
1263 NTSTATUS pdb_default_update_group_mapping_entry(struct pdb_methods *methods,
1264 GROUP_MAP *map)
1265 {
1266 return add_mapping_entry(map, TDB_REPLACE) ?
1267 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1268 }
1269
1270 NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods,
1271 DOM_SID sid)
1272 {
1273 return group_map_remove(sid) ?
1274 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1275 }
1276
1277 NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
1278 enum SID_NAME_USE sid_name_use,
1279 GROUP_MAP **rmap, int *num_entries,
1280 BOOL unix_only)
1281 {
1282 return enum_group_mapping(sid_name_use, rmap, num_entries, unix_only) ?
1283 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1284 }
1285
1286 NTSTATUS pdb_default_add_aliasmem(struct pdb_methods *methods,
1287 const DOM_SID *alias, const DOM_SID *member)
1288 {
1289 return add_aliasmem(alias, member);
1290 }
1291
1292 NTSTATUS pdb_default_del_aliasmem(struct pdb_methods *methods,
1293 const DOM_SID *alias, const DOM_SID *member)
1294 {
1295 return del_aliasmem(alias, member);
1296 }
1297
1298 NTSTATUS pdb_default_enum_aliasmem(struct pdb_methods *methods,
1299 const DOM_SID *alias, DOM_SID **members,
1300 int *num_members)
1301 {
1302 return enum_aliasmem(alias, members, num_members);
1303 }
1304
1305 NTSTATUS pdb_default_alias_memberships(struct pdb_methods *methods,
1306 const DOM_SID *sid,
1307 DOM_SID **aliases, int *num)
1308 {
1309 return alias_memberships(sid, aliases, num);
1310 }
1311
1312 /**********************************************************************
1313 no ops for passdb backends that don't implement group mapping
1314 *********************************************************************/
1315
1316 NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
1317 DOM_SID sid)
1318 {
1319 return NT_STATUS_UNSUCCESSFUL;
1320 }
1321
1322 NTSTATUS pdb_nop_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
1323 gid_t gid)
1324 {
1325 return NT_STATUS_UNSUCCESSFUL;
1326 }
1327
1328 NTSTATUS pdb_nop_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
1329 const char *name)
1330 {
1331 return NT_STATUS_UNSUCCESSFUL;
1332 }
1333
1334 NTSTATUS pdb_nop_add_group_mapping_entry(struct pdb_methods *methods,
1335 GROUP_MAP *map)
1336 {
1337 return NT_STATUS_UNSUCCESSFUL;
1338 }
1339
1340 NTSTATUS pdb_nop_update_group_mapping_entry(struct pdb_methods *methods,
1341 GROUP_MAP *map)
1342 {
1343 return NT_STATUS_UNSUCCESSFUL;
1344 }
1345
1346 NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods,
1347 DOM_SID sid)
1348 {
1349 return NT_STATUS_UNSUCCESSFUL;
1350 }
1351
1352 NTSTATUS pdb_nop_enum_group_mapping(struct pdb_methods *methods,
1353 enum SID_NAME_USE sid_name_use,
1354 GROUP_MAP **rmap, int *num_entries,
1355 BOOL unix_only)
1356 {
1357 return NT_STATUS_UNSUCCESSFUL;
1358 }
1359
reg import