source3/groupdb/mapping.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-2000,
   5  *  Copyright (C) Jean François Micouleau      1998-2001.
   6  *  Copyright (C) Volker Lendecke              2006.
   7  *  Copyright (C) Gerald Carter                2006.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 3 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  21  */
  22
  23 #include "includes.h"
  24 #include "system/passwd.h"
  25 #include "passdb.h"
  26 #include "groupdb/mapping.h"
  27 #include "../libcli/security/security.h"
  28 #include "lib/winbind_util.h"
  29 #include "tdb_compat.h"
  30
  31 static const struct mapping_backend *backend;
  32
  33 /*
  34   initialise a group mapping backend
  35  */
  36 static bool init_group_mapping(void)
  37 {
  38         if (backend != NULL) {
  39                 /* already initialised */
  40                 return True;
  41         }
  42
  43         backend = groupdb_tdb_init();
  44
  45         return backend != NULL;
  46 }
  47
  48 /****************************************************************************
  49 initialise first time the mapping list
  50 ****************************************************************************/
  51 NTSTATUS add_initial_entry(gid_t gid, const char *sid, enum lsa_SidType sid_name_use, const char *nt_name, const char *comment)
  52 {
  53         GROUP_MAP map;
  54
  55         if(!init_group_mapping()) {
  56                 DEBUG(0,("failed to initialize group mapping\n"));
  57                 return NT_STATUS_UNSUCCESSFUL;
  58         }
  59
  60         map.gid=gid;
  61         if (!string_to_sid(&map.sid, sid)) {
  62                 DEBUG(0, ("string_to_sid failed: %s", sid));
  63                 return NT_STATUS_UNSUCCESSFUL;
  64         }
  65
  66         map.sid_name_use=sid_name_use;
  67         fstrcpy(map.nt_name, nt_name);
  68         fstrcpy(map.comment, comment);
  69
  70         return pdb_add_group_mapping_entry(&map);
  71 }
  72
  73 static NTSTATUS alias_memberships(const struct dom_sid *members, size_t num_members,
  74                                   struct dom_sid **sids, size_t *num)
  75 {
  76         size_t i;
  77
  78         *num = 0;
  79         *sids = NULL;
  80
  81         for (i=0; i<num_members; i++) {
  82                 NTSTATUS status = backend->one_alias_membership(&members[i], sids, num);
  83                 if (!NT_STATUS_IS_OK(status))
  84                         return status;
  85         }
  86         return NT_STATUS_OK;
  87 }
  88
  89 struct aliasmem_closure {
  90         const struct dom_sid *alias;
  91         struct dom_sid **sids;
  92         size_t *num;
  93 };
  94
  95
  96
  97 /*
  98  *
  99  * High level functions
 100  * better to use them than the lower ones.
 101  *
 102  * we are checking if the group is in the mapping file
 103  * and if the group is an existing unix group
 104  *
 105  */
 106
 107 /* get a domain group from it's SID */
 108
 109 bool get_domain_group_from_sid(struct dom_sid sid, GROUP_MAP *map)
 110 {
 111         struct group *grp;
 112         bool ret;
 113
 114         if(!init_group_mapping()) {
 115                 DEBUG(0,("failed to initialize group mapping\n"));
 116                 return(False);
 117         }
 118
 119         DEBUG(10, ("get_domain_group_from_sid\n"));
 120
 121         /* if the group is NOT in the database, it CAN NOT be a domain group */
 122
 123         become_root();
 124         ret = pdb_getgrsid(map, sid);
 125         unbecome_root();
 126
 127         /* special case check for rid 513 */
 128
 129         if ( !ret ) {
 130                 uint32 rid;
 131
 132                 sid_peek_rid( &sid, &rid );
 133
 134                 if ( rid == DOMAIN_RID_USERS ) {
 135                         fstrcpy( map->nt_name, "None" );
 136                         fstrcpy( map->comment, "Ordinary Users" );
 137                         sid_copy( &map->sid, &sid );
 138                         map->sid_name_use = SID_NAME_DOM_GRP;
 139                         map->gid = (gid_t)-1;
 140                         return True;
 141                 }
 142                 return False;
 143         }
 144
 145         DEBUG(10, ("get_domain_group_from_sid: SID found in passdb\n"));
 146
 147         /* if it's not a domain group, continue */
 148         if (map->sid_name_use!=SID_NAME_DOM_GRP) {
 149                 return False;
 150         }
 151
 152         DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
 153
 154         if (map->gid==-1) {
 155                 return False;
 156         }
 157
 158         DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid));
 159
 160         grp = getgrgid(map->gid);
 161         if ( !grp ) {
 162                 DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n"));
 163                 return False;
 164         }
 165
 166         DEBUG(10, ("get_domain_group_from_sid: gid exists in UNIX security\n"));
 167
 168         return True;
 169 }
 170
 171 /****************************************************************************
 172  Create a UNIX group on demand.
 173 ****************************************************************************/
 174
 175 int smb_create_group(const char *unix_group, gid_t *new_gid)
 176 {
 177         char *add_script = NULL;
 178         int     ret = -1;
 179         int     fd = 0;
 180
 181         *new_gid = 0;
 182
 183         /* defer to scripts */
 184
 185         if ( *lp_addgroup_script() ) {
 186                 TALLOC_CTX *ctx = talloc_tos();
 187
 188                 add_script = talloc_strdup(ctx,
 189                                         lp_addgroup_script());
 190                 if (!add_script) {
 191                         return -1;
 192                 }
 193                 add_script = talloc_string_sub(ctx,
 194                                 add_script, "%g", unix_group);
 195                 if (!add_script) {
 196                         return -1;
 197                 }
 198
 199                 ret = smbrun(add_script, &fd);
 200                 DEBUG(ret ? 0 : 3,("smb_create_group: Running the command `%s' gave %d\n",add_script,ret));
 201                 if (ret == 0) {
 202                         smb_nscd_flush_group_cache();
 203                 }
 204                 if (ret != 0)
 205                         return ret;
 206
 207                 if (fd != 0) {
 208                         fstring output;
 209
 210                         *new_gid = 0;
 211                         if (read(fd, output, sizeof(output)) > 0) {
 212                                 *new_gid = (gid_t)strtoul(output, NULL, 10);
 213                         }
 214
 215                         close(fd);
 216                 }
 217
 218         }
 219
 220         if (*new_gid == 0) {
 221                 struct group *grp = getgrnam(unix_group);
 222
 223                 if (grp != NULL)
 224                         *new_gid = grp->gr_gid;
 225         }
 226
 227         return ret;
 228 }
 229
 230 /****************************************************************************
 231  Delete a UNIX group on demand.
 232 ****************************************************************************/
 233
 234 int smb_delete_group(const char *unix_group)
 235 {
 236         char *del_script = NULL;
 237         int ret = -1;
 238
 239         /* defer to scripts */
 240
 241         if ( *lp_delgroup_script() ) {
 242                 TALLOC_CTX *ctx = talloc_tos();
 243
 244                 del_script = talloc_strdup(ctx,
 245                                 lp_delgroup_script());
 246                 if (!del_script) {
 247                         return -1;
 248                 }
 249                 del_script = talloc_string_sub(ctx,
 250                                 del_script, "%g", unix_group);
 251                 if (!del_script) {
 252                         return -1;
 253                 }
 254                 ret = smbrun(del_script,NULL);
 255                 DEBUG(ret ? 0 : 3,("smb_delete_group: Running the command `%s' gave %d\n",del_script,ret));
 256                 if (ret == 0) {
 257                         smb_nscd_flush_group_cache();
 258                 }
 259                 return ret;
 260         }
 261
 262         return -1;
 263 }
 264
 265 /****************************************************************************
 266  Set a user's primary UNIX group.
 267 ****************************************************************************/
 268
 269 int smb_set_primary_group(const char *unix_group, const char* unix_user)
 270 {
 271         char *add_script = NULL;
 272         int ret = -1;
 273
 274         /* defer to scripts */
 275
 276         if ( *lp_setprimarygroup_script() ) {
 277                 TALLOC_CTX *ctx = talloc_tos();
 278
 279                 add_script = talloc_strdup(ctx,
 280                                 lp_setprimarygroup_script());
 281                 if (!add_script) {
 282                         return -1;
 283                 }
 284                 add_script = talloc_all_string_sub(ctx,
 285                                 add_script, "%g", unix_group);
 286                 if (!add_script) {
 287                         return -1;
 288                 }
 289                 add_script = talloc_string_sub(ctx,
 290                                 add_script, "%u", unix_user);
 291                 if (!add_script) {
 292                         return -1;
 293                 }
 294                 ret = smbrun(add_script,NULL);
 295                 flush_pwnam_cache();
 296                 DEBUG(ret ? 0 : 3,("smb_set_primary_group: "
 297                          "Running the command `%s' gave %d\n",add_script,ret));
 298                 if (ret == 0) {
 299                         smb_nscd_flush_group_cache();
 300                 }
 301                 return ret;
 302         }
 303
 304         return -1;
 305 }
 306
 307 /****************************************************************************
 308  Add a user to a UNIX group.
 309 ****************************************************************************/
 310
 311 int smb_add_user_group(const char *unix_group, const char *unix_user)
 312 {
 313         char *add_script = NULL;
 314         int ret = -1;
 315
 316         /* defer to scripts */
 317
 318         if ( *lp_addusertogroup_script() ) {
 319                 TALLOC_CTX *ctx = talloc_tos();
 320
 321                 add_script = talloc_strdup(ctx,
 322                                 lp_addusertogroup_script());
 323                 if (!add_script) {
 324                         return -1;
 325                 }
 326                 add_script = talloc_string_sub(ctx,
 327                                 add_script, "%g", unix_group);
 328                 if (!add_script) {
 329                         return -1;
 330                 }
 331                 add_script = talloc_string_sub2(ctx,
 332                                 add_script, "%u", unix_user, true, false, true);
 333                 if (!add_script) {
 334                         return -1;
 335                 }
 336                 ret = smbrun(add_script,NULL);
 337                 DEBUG(ret ? 0 : 3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script,ret));
 338                 if (ret == 0) {
 339                         smb_nscd_flush_group_cache();
 340                 }
 341                 return ret;
 342         }
 343
 344         return -1;
 345 }
 346
 347 /****************************************************************************
 348  Delete a user from a UNIX group
 349 ****************************************************************************/
 350
 351 int smb_delete_user_group(const char *unix_group, const char *unix_user)
 352 {
 353         char *del_script = NULL;
 354         int ret = -1;
 355
 356         /* defer to scripts */
 357
 358         if ( *lp_deluserfromgroup_script() ) {
 359                 TALLOC_CTX *ctx = talloc_tos();
 360
 361                 del_script = talloc_strdup(ctx,
 362                                 lp_deluserfromgroup_script());
 363                 if (!del_script) {
 364                         return -1;
 365                 }
 366                 del_script = talloc_string_sub(ctx,
 367                                 del_script, "%g", unix_group);
 368                 if (!del_script) {
 369                         return -1;
 370                 }
 371                 del_script = talloc_string_sub2(ctx,
 372                                 del_script, "%u", unix_user, true, false, true);
 373                 if (!del_script) {
 374                         return -1;
 375                 }
 376                 ret = smbrun(del_script,NULL);
 377                 DEBUG(ret ? 0 : 3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script,ret));
 378                 if (ret == 0) {
 379                         smb_nscd_flush_group_cache();
 380                 }
 381                 return ret;
 382         }
 383
 384         return -1;
 385 }
 386
 387
 388 NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
 389                                  struct dom_sid sid)
 390 {
 391         if (!init_group_mapping()) {
 392                 DEBUG(0,("failed to initialize group mapping\n"));
 393                 return NT_STATUS_UNSUCCESSFUL;
 394         }
 395         return backend->get_group_map_from_sid(sid, map) ?
 396                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 397 }
 398
 399 NTSTATUS pdb_default_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
 400                                  gid_t gid)
 401 {
 402         if (!init_group_mapping()) {
 403                 DEBUG(0,("failed to initialize group mapping\n"));
 404                 return NT_STATUS_UNSUCCESSFUL;
 405         }
 406         return backend->get_group_map_from_gid(gid, map) ?
 407                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 408 }
 409
 410 NTSTATUS pdb_default_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
 411                                  const char *name)
 412 {
 413         if (!init_group_mapping()) {
 414                 DEBUG(0,("failed to initialize group mapping\n"));
 415                 return NT_STATUS_UNSUCCESSFUL;
 416         }
 417         return backend->get_group_map_from_ntname(name, map) ?
 418                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 419 }
 420
 421 NTSTATUS pdb_default_add_group_mapping_entry(struct pdb_methods *methods,
 422                                                 GROUP_MAP *map)
 423 {
 424         if (!init_group_mapping()) {
 425                 DEBUG(0,("failed to initialize group mapping\n"));
 426                 return NT_STATUS_UNSUCCESSFUL;
 427         }
 428         return backend->add_mapping_entry(map, TDB_INSERT) ?
 429                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 430 }
 431
 432 NTSTATUS pdb_default_update_group_mapping_entry(struct pdb_methods *methods,
 433                                                    GROUP_MAP *map)
 434 {
 435         if (!init_group_mapping()) {
 436                 DEBUG(0,("failed to initialize group mapping\n"));
 437                 return NT_STATUS_UNSUCCESSFUL;
 438         }
 439         return backend->add_mapping_entry(map, TDB_REPLACE) ?
 440                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 441 }
 442
 443 NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods,
 444                                                    struct dom_sid sid)
 445 {
 446         if (!init_group_mapping()) {
 447                 DEBUG(0,("failed to initialize group mapping\n"));
 448                 return NT_STATUS_UNSUCCESSFUL;
 449         }
 450         return backend->group_map_remove(&sid) ?
 451                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 452 }
 453
 454 NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
 455                                            const struct dom_sid *sid, enum lsa_SidType sid_name_use,
 456                                            GROUP_MAP **pp_rmap, size_t *p_num_entries,
 457                                            bool unix_only)
 458 {
 459         if (!init_group_mapping()) {
 460                 DEBUG(0,("failed to initialize group mapping\n"));
 461                 return NT_STATUS_UNSUCCESSFUL;
 462         }
 463         return backend->enum_group_mapping(sid, sid_name_use, pp_rmap, p_num_entries, unix_only) ?
 464                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 465 }
 466
 467 NTSTATUS pdb_default_create_alias(struct pdb_methods *methods,
 468                                   const char *name, uint32 *rid)
 469 {
 470         struct dom_sid sid;
 471         enum lsa_SidType type;
 472         uint32 new_rid;
 473         gid_t gid;
 474         bool exists;
 475         GROUP_MAP map;
 476         TALLOC_CTX *mem_ctx;
 477         NTSTATUS status;
 478
 479         DEBUG(10, ("Trying to create alias %s\n", name));
 480
 481         mem_ctx = talloc_new(NULL);
 482         if (mem_ctx == NULL) {
 483                 return NT_STATUS_NO_MEMORY;
 484         }
 485
 486         exists = lookup_name(mem_ctx, name, LOOKUP_NAME_LOCAL,
 487                              NULL, NULL, &sid, &type);
 488         TALLOC_FREE(mem_ctx);
 489
 490         if (exists) {
 491                 return NT_STATUS_ALIAS_EXISTS;
 492         }
 493
 494         if (!pdb_new_rid(&new_rid)) {
 495                 DEBUG(0, ("Could not allocate a RID.\n"));
 496                 return NT_STATUS_ACCESS_DENIED;
 497         }
 498
 499         sid_compose(&sid, get_global_sam_sid(), new_rid);
 500
 501         if (!winbind_allocate_gid(&gid)) {
 502                 DEBUG(3, ("Could not get a gid out of winbind - "
 503                           "wasted a rid :-(\n"));
 504                 return NT_STATUS_ACCESS_DENIED;
 505         }
 506
 507         DEBUG(10, ("Creating alias %s with gid %u and rid %u\n",
 508                    name, (unsigned int)gid, (unsigned int)new_rid));
 509
 510         map.gid = gid;
 511         sid_copy(&map.sid, &sid);
 512         map.sid_name_use = SID_NAME_ALIAS;
 513         fstrcpy(map.nt_name, name);
 514         fstrcpy(map.comment, "");
 515
 516         status = pdb_add_group_mapping_entry(&map);
 517
 518         if (!NT_STATUS_IS_OK(status)) {
 519                 DEBUG(0, ("Could not add group mapping entry for alias %s "
 520                           "(%s)\n", name, nt_errstr(status)));
 521                 return status;
 522         }
 523
 524         *rid = new_rid;
 525
 526         return NT_STATUS_OK;
 527 }
 528
 529 NTSTATUS pdb_default_delete_alias(struct pdb_methods *methods,
 530                                   const struct dom_sid *sid)
 531 {
 532         return pdb_delete_group_mapping_entry(*sid);
 533 }
 534
 535 NTSTATUS pdb_default_get_aliasinfo(struct pdb_methods *methods,
 536                                    const struct dom_sid *sid,
 537                                    struct acct_info *info)
 538 {
 539         GROUP_MAP map;
 540
 541         if (!pdb_getgrsid(&map, *sid))
 542                 return NT_STATUS_NO_SUCH_ALIAS;
 543
 544         if ((map.sid_name_use != SID_NAME_ALIAS) &&
 545             (map.sid_name_use != SID_NAME_WKN_GRP)) {
 546                 DEBUG(2, ("%s is a %s, expected an alias\n",
 547                           sid_string_dbg(sid),
 548                           sid_type_lookup(map.sid_name_use)));
 549                 return NT_STATUS_NO_SUCH_ALIAS;
 550         }
 551
 552         fstrcpy(info->acct_name, map.nt_name);
 553         fstrcpy(info->acct_desc, map.comment);
 554         sid_peek_rid(&map.sid, &info->rid);
 555         return NT_STATUS_OK;
 556 }
 557
 558 NTSTATUS pdb_default_set_aliasinfo(struct pdb_methods *methods,
 559                                    const struct dom_sid *sid,
 560                                    struct acct_info *info)
 561 {
 562         GROUP_MAP map;
 563
 564         if (!pdb_getgrsid(&map, *sid))
 565                 return NT_STATUS_NO_SUCH_ALIAS;
 566
 567         fstrcpy(map.nt_name, info->acct_name);
 568         fstrcpy(map.comment, info->acct_desc);
 569
 570         return pdb_update_group_mapping_entry(&map);
 571 }
 572
 573 NTSTATUS pdb_default_add_aliasmem(struct pdb_methods *methods,
 574                                   const struct dom_sid *alias, const struct dom_sid *member)
 575 {
 576         if (!init_group_mapping()) {
 577                 DEBUG(0,("failed to initialize group mapping\n"));
 578                 return NT_STATUS_UNSUCCESSFUL;
 579         }
 580         return backend->add_aliasmem(alias, member);
 581 }
 582
 583 NTSTATUS pdb_default_del_aliasmem(struct pdb_methods *methods,
 584                                   const struct dom_sid *alias, const struct dom_sid *member)
 585 {
 586         if (!init_group_mapping()) {
 587                 DEBUG(0,("failed to initialize group mapping\n"));
 588                 return NT_STATUS_UNSUCCESSFUL;
 589         }
 590         return backend->del_aliasmem(alias, member);
 591 }
 592
 593 NTSTATUS pdb_default_enum_aliasmem(struct pdb_methods *methods,
 594                                    const struct dom_sid *alias, TALLOC_CTX *mem_ctx,
 595                                    struct dom_sid **pp_members, size_t *p_num_members)
 596 {
 597         if (!init_group_mapping()) {
 598                 DEBUG(0,("failed to initialize group mapping\n"));
 599                 return NT_STATUS_UNSUCCESSFUL;
 600         }
 601         return backend->enum_aliasmem(alias, mem_ctx, pp_members,
 602                                       p_num_members);
 603 }
 604
 605 NTSTATUS pdb_default_alias_memberships(struct pdb_methods *methods,
 606                                        TALLOC_CTX *mem_ctx,
 607                                        const struct dom_sid *domain_sid,
 608                                        const struct dom_sid *members,
 609                                        size_t num_members,
 610                                        uint32 **pp_alias_rids,
 611                                        size_t *p_num_alias_rids)
 612 {
 613         struct dom_sid *alias_sids;
 614         size_t i, num_alias_sids;
 615         NTSTATUS result;
 616
 617         if (!init_group_mapping()) {
 618                 DEBUG(0,("failed to initialize group mapping\n"));
 619                 return NT_STATUS_UNSUCCESSFUL;
 620         }
 621
 622         alias_sids = NULL;
 623         num_alias_sids = 0;
 624
 625         result = alias_memberships(members, num_members,
 626                                    &alias_sids, &num_alias_sids);
 627
 628         if (!NT_STATUS_IS_OK(result))
 629                 return result;
 630
 631         *p_num_alias_rids = 0;
 632
 633         if (num_alias_sids == 0) {
 634                 TALLOC_FREE(alias_sids);
 635                 return NT_STATUS_OK;
 636         }
 637
 638         *pp_alias_rids = talloc_array(mem_ctx, uint32, num_alias_sids);
 639         if (*pp_alias_rids == NULL)
 640                 return NT_STATUS_NO_MEMORY;
 641
 642         for (i=0; i<num_alias_sids; i++) {
 643                 if (!sid_peek_check_rid(domain_sid, &alias_sids[i],
 644                                         &(*pp_alias_rids)[*p_num_alias_rids]))
 645                         continue;
 646                 *p_num_alias_rids += 1;
 647         }
 648
 649         TALLOC_FREE(alias_sids);
 650
 651         return NT_STATUS_OK;
 652 }
 653
 654 /**********************************************************************
 655  no ops for passdb backends that don't implement group mapping
 656  *********************************************************************/
 657
 658 NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
 659                                  struct dom_sid sid)
 660 {
 661         return NT_STATUS_UNSUCCESSFUL;
 662 }
 663
 664 NTSTATUS pdb_nop_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
 665                                  gid_t gid)
 666 {
 667         return NT_STATUS_UNSUCCESSFUL;
 668 }
 669
 670 NTSTATUS pdb_nop_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
 671                                  const char *name)
 672 {
 673         return NT_STATUS_UNSUCCESSFUL;
 674 }
 675
 676 NTSTATUS pdb_nop_add_group_mapping_entry(struct pdb_methods *methods,
 677                                                 GROUP_MAP *map)
 678 {
 679         return NT_STATUS_UNSUCCESSFUL;
 680 }
 681
 682 NTSTATUS pdb_nop_update_group_mapping_entry(struct pdb_methods *methods,
 683                                                    GROUP_MAP *map)
 684 {
 685         return NT_STATUS_UNSUCCESSFUL;
 686 }
 687
 688 NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods,
 689                                                    struct dom_sid sid)
 690 {
 691         return NT_STATUS_UNSUCCESSFUL;
 692 }
 693
 694 NTSTATUS pdb_nop_enum_group_mapping(struct pdb_methods *methods,
 695                                            enum lsa_SidType sid_name_use,
 696                                            GROUP_MAP **rmap, size_t *num_entries,
 697                                            bool unix_only)
 698 {
 699         return NT_STATUS_UNSUCCESSFUL;
 700 }
 701
 702 /****************************************************************************
 703  These need to be redirected through pdb_interface.c
 704 ****************************************************************************/
 705 bool pdb_get_dom_grp_info(const struct dom_sid *sid, struct acct_info *info)
 706 {
 707         GROUP_MAP map;
 708         bool res;
 709
 710         become_root();
 711         res = get_domain_group_from_sid(*sid, &map);
 712         unbecome_root();
 713
 714         if (!res)
 715                 return False;
 716
 717         fstrcpy(info->acct_name, map.nt_name);
 718         fstrcpy(info->acct_desc, map.comment);
 719         sid_peek_rid(sid, &info->rid);
 720         return True;
 721 }
 722
 723 bool pdb_set_dom_grp_info(const struct dom_sid *sid, const struct acct_info *info)
 724 {
 725         GROUP_MAP map;
 726
 727         if (!get_domain_group_from_sid(*sid, &map))
 728                 return False;
 729
 730         fstrcpy(map.nt_name, info->acct_name);
 731         fstrcpy(map.comment, info->acct_desc);
 732
 733         return NT_STATUS_IS_OK(pdb_update_group_mapping_entry(&map));
 734 }
 735
 736 /********************************************************************
 737  Really just intended to be called by smbd
 738 ********************************************************************/
 739
 740 NTSTATUS pdb_create_builtin_alias(uint32 rid)
 741 {
 742         struct dom_sid sid;
 743         enum lsa_SidType type;
 744         gid_t gid;
 745         GROUP_MAP map;
 746         TALLOC_CTX *mem_ctx;
 747         NTSTATUS status;
 748         const char *name = NULL;
 749         fstring groupname;
 750
 751         DEBUG(10, ("Trying to create builtin alias %d\n", rid));
 752
 753         if ( !sid_compose( &sid, &global_sid_Builtin, rid ) ) {
 754                 return NT_STATUS_NO_SUCH_ALIAS;
 755         }
 756
 757         if ( (mem_ctx = talloc_new(NULL)) == NULL ) {
 758                 return NT_STATUS_NO_MEMORY;
 759         }
 760
 761         if ( !lookup_sid(mem_ctx, &sid, NULL, &name, &type) ) {
 762                 TALLOC_FREE( mem_ctx );
 763                 return NT_STATUS_NO_SUCH_ALIAS;
 764         }
 765
 766         /* validate RID so copy the name and move on */
 767
 768         fstrcpy( groupname, name );
 769         TALLOC_FREE( mem_ctx );
 770
 771         if (!winbind_allocate_gid(&gid)) {
 772                 DEBUG(3, ("pdb_create_builtin_alias: Could not get a gid out of winbind\n"));
 773                 return NT_STATUS_ACCESS_DENIED;
 774         }
 775
 776         DEBUG(10,("Creating alias %s with gid %u\n", groupname, (unsigned int)gid));
 777
 778         map.gid = gid;
 779         sid_copy(&map.sid, &sid);
 780         map.sid_name_use = SID_NAME_ALIAS;
 781         strlcpy(map.nt_name, groupname, sizeof(map.nt_name));
 782         strlcpy(map.comment, "", sizeof(map.comment));
 783
 784         status = pdb_add_group_mapping_entry(&map);
 785
 786         if (!NT_STATUS_IS_OK(status)) {
 787                 DEBUG(0, ("pdb_create_builtin_alias: Could not add group mapping entry for alias %d "
 788                           "(%s)\n", rid, nt_errstr(status)));
 789         }
 790
 791         return status;
 792 }
 793
 794