source3/passdb/pdb_util.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Authentication utility functions
   4  *  Copyright (C) Andrew Tridgell 1992-1998
   5  *  Copyright (C) Andrew Bartlett 2001
   6  *  Copyright (C) Jeremy Allison 2000-2001
   7  *  Copyright (C) Rafal Szczesniak 2002
   8  *  Copyright (C) Volker Lendecke 2006
   9  *  Copyright (C) Michael Adam 2007
  10  *
  11  *  This program is free software; you can redistribute it and/or modify
  12  *  it under the terms of the GNU General Public License as published by
  13  *  the Free Software Foundation; either version 3 of the License, or
  14  *  (at your option) any later version.
  15  *
  16  *  This program is distributed in the hope that it will be useful,
  17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  *  GNU General Public License for more details.
  20  *
  21  *  You should have received a copy of the GNU General Public License
  22  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  23  */
  24
  25 #include "includes.h"
  26 #include "../libcli/security/security.h"
  27 #include "passdb.h"
  28 #include "lib/winbind_util.h"
  29
  30 /**
  31  * Add sid as a member of builtin_sid.
  32  *
  33  * @param[in] builtin_sid       An existing builtin group.
  34  * @param[in] dom_sid           sid to add as a member of builtin_sid.
  35  * @return Normal NTSTATUS return
  36  */
  37 static NTSTATUS add_sid_to_builtin(const struct dom_sid *builtin_sid,
  38                                    const struct dom_sid *dom_sid)
  39 {
  40         NTSTATUS status = NT_STATUS_OK;
  41
  42         if (!dom_sid || !builtin_sid) {
  43                 return NT_STATUS_INVALID_PARAMETER;
  44         }
  45
  46         status = pdb_add_aliasmem(builtin_sid, dom_sid);
  47
  48         if (NT_STATUS_EQUAL(status, NT_STATUS_MEMBER_IN_ALIAS)) {
  49                 DEBUG(5, ("add_sid_to_builtin %s is already a member of %s\n",
  50                           sid_string_dbg(dom_sid),
  51                           sid_string_dbg(builtin_sid)));
  52                 return NT_STATUS_OK;
  53         }
  54
  55         if (!NT_STATUS_IS_OK(status)) {
  56                 DEBUG(4, ("add_sid_to_builtin %s could not be added to %s: "
  57                           "%s\n", sid_string_dbg(dom_sid),
  58                           sid_string_dbg(builtin_sid), nt_errstr(status)));
  59         }
  60         return status;
  61 }
  62
  63 /**
  64  * Create the requested BUILTIN if it doesn't already exist.  This requires
  65  * winbindd to be running.
  66  *
  67  * @param[in] rid BUILTIN rid to create
  68  * @return Normal NTSTATUS return.
  69  */
  70 static NTSTATUS create_builtin(uint32 rid)
  71 {
  72         NTSTATUS status = NT_STATUS_OK;
  73         struct dom_sid sid;
  74         gid_t gid;
  75
  76         if (!sid_compose(&sid, &global_sid_Builtin, rid)) {
  77                 return NT_STATUS_NO_SUCH_ALIAS;
  78         }
  79
  80         if (!sid_to_gid(&sid, &gid)) {
  81                 if (!lp_winbind_nested_groups() || !winbind_ping()) {
  82                         return NT_STATUS_PROTOCOL_UNREACHABLE;
  83                 }
  84                 status = pdb_create_builtin_alias(rid);
  85         }
  86         return status;
  87 }
  88
  89 /*******************************************************************
  90 *******************************************************************/
  91
  92 NTSTATUS create_builtin_users(const struct dom_sid *dom_sid)
  93 {
  94         NTSTATUS status;
  95         struct dom_sid dom_users;
  96
  97         status = create_builtin(BUILTIN_RID_USERS);
  98         if ( !NT_STATUS_IS_OK(status) ) {
  99                 DEBUG(5,("create_builtin_users: Failed to create Users\n"));
 100                 return status;
 101         }
 102
 103         /* add domain users */
 104         if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
 105                 && sid_compose(&dom_users, dom_sid, DOMAIN_RID_USERS))
 106         {
 107                 status = add_sid_to_builtin(&global_sid_Builtin_Users,
 108                                             &dom_users);
 109         }
 110
 111         return status;
 112 }
 113
 114 /*******************************************************************
 115 *******************************************************************/
 116
 117 NTSTATUS create_builtin_administrators(const struct dom_sid *dom_sid)
 118 {
 119         NTSTATUS status;
 120         struct dom_sid dom_admins, root_sid;
 121         fstring root_name;
 122         enum lsa_SidType type;
 123         TALLOC_CTX *ctx;
 124         bool ret;
 125
 126         status = create_builtin(BUILTIN_RID_ADMINISTRATORS);
 127         if ( !NT_STATUS_IS_OK(status) ) {
 128                 DEBUG(5,("create_builtin_administrators: Failed to create Administrators\n"));
 129                 return status;
 130         }
 131
 132         /* add domain admins */
 133         if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
 134                 && sid_compose(&dom_admins, dom_sid, DOMAIN_RID_ADMINS))
 135         {
 136                 status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
 137                                             &dom_admins);
 138                 if (!NT_STATUS_IS_OK(status)) {
 139                         return status;
 140                 }
 141         }
 142
 143         /* add root */
 144         if ( (ctx = talloc_init("create_builtin_administrators")) == NULL ) {
 145                 return NT_STATUS_NO_MEMORY;
 146         }
 147         fstr_sprintf( root_name, "%s\\root", get_global_sam_name() );
 148         ret = lookup_name(ctx, root_name, LOOKUP_NAME_DOMAIN, NULL, NULL,
 149                           &root_sid, &type);
 150         TALLOC_FREE( ctx );
 151
 152         if ( ret ) {
 153                 status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
 154                                             &root_sid);
 155         }
 156
 157         return status;
 158 }