2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-2000,
5 * Copyright (C) Jean François Micouleau 1998-2001.
6 * Copyright (C) Volker Lendecke 2006.
7 * Copyright (C) Gerald Carter 2006.
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 3 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, see <http://www.gnu.org/licenses/>.
24 #include "groupdb/mapping.h"
25 #include "../libcli/security/security.h"
26 #include "lib/winbind_util.h"
28 static const struct mapping_backend *backend;
31 initialise a group mapping backend
33 static bool init_group_mapping(void)
35 if (backend != NULL) {
36 /* already initialised */
40 backend = groupdb_tdb_init();
42 return backend != NULL;
45 /****************************************************************************
46 initialise first time the mapping list
47 ****************************************************************************/
48 NTSTATUS add_initial_entry(gid_t gid, const char *sid, enum lsa_SidType sid_name_use, const char *nt_name, const char *comment)
52 if(!init_group_mapping()) {
53 DEBUG(0,("failed to initialize group mapping\n"));
54 return NT_STATUS_UNSUCCESSFUL;
58 if (!string_to_sid(&map.sid, sid)) {
59 DEBUG(0, ("string_to_sid failed: %s", sid));
60 return NT_STATUS_UNSUCCESSFUL;
63 map.sid_name_use=sid_name_use;
64 fstrcpy(map.nt_name, nt_name);
65 fstrcpy(map.comment, comment);
67 return pdb_add_group_mapping_entry(&map);
70 static NTSTATUS alias_memberships(const struct dom_sid *members, size_t num_members,
71 struct dom_sid **sids, size_t *num)
78 for (i=0; i<num_members; i++) {
79 NTSTATUS status = backend->one_alias_membership(&members[i], sids, num);
80 if (!NT_STATUS_IS_OK(status))
86 struct aliasmem_closure {
87 const struct dom_sid *alias;
88 struct dom_sid **sids;
96 * High level functions
97 * better to use them than the lower ones.
99 * we are checking if the group is in the mapping file
100 * and if the group is an existing unix group
104 /* get a domain group from it's SID */
106 bool get_domain_group_from_sid(struct dom_sid sid, GROUP_MAP *map)
111 if(!init_group_mapping()) {
112 DEBUG(0,("failed to initialize group mapping\n"));
116 DEBUG(10, ("get_domain_group_from_sid\n"));
118 /* if the group is NOT in the database, it CAN NOT be a domain group */
121 ret = pdb_getgrsid(map, sid);
124 /* special case check for rid 513 */
129 sid_peek_rid( &sid, &rid );
131 if ( rid == DOMAIN_RID_USERS ) {
132 fstrcpy( map->nt_name, "None" );
133 fstrcpy( map->comment, "Ordinary Users" );
134 sid_copy( &map->sid, &sid );
135 map->sid_name_use = SID_NAME_DOM_GRP;
136 map->gid = (gid_t)-1;
142 DEBUG(10, ("get_domain_group_from_sid: SID found in passdb\n"));
144 /* if it's not a domain group, continue */
145 if (map->sid_name_use!=SID_NAME_DOM_GRP) {
149 DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
155 DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid));
157 grp = getgrgid(map->gid);
159 DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n"));
163 DEBUG(10, ("get_domain_group_from_sid: gid exists in UNIX security\n"));
168 /****************************************************************************
169 Create a UNIX group on demand.
170 ****************************************************************************/
172 int smb_create_group(const char *unix_group, gid_t *new_gid)
174 char *add_script = NULL;
180 /* defer to scripts */
182 if ( *lp_addgroup_script() ) {
183 TALLOC_CTX *ctx = talloc_tos();
185 add_script = talloc_strdup(ctx,
186 lp_addgroup_script());
190 add_script = talloc_string_sub(ctx,
191 add_script, "%g", unix_group);
196 ret = smbrun(add_script, &fd);
197 DEBUG(ret ? 0 : 3,("smb_create_group: Running the command `%s' gave %d\n",add_script,ret));
199 smb_nscd_flush_group_cache();
208 if (read(fd, output, sizeof(output)) > 0) {
209 *new_gid = (gid_t)strtoul(output, NULL, 10);
218 struct group *grp = getgrnam(unix_group);
221 *new_gid = grp->gr_gid;
227 /****************************************************************************
228 Delete a UNIX group on demand.
229 ****************************************************************************/
231 int smb_delete_group(const char *unix_group)
233 char *del_script = NULL;
236 /* defer to scripts */
238 if ( *lp_delgroup_script() ) {
239 TALLOC_CTX *ctx = talloc_tos();
241 del_script = talloc_strdup(ctx,
242 lp_delgroup_script());
246 del_script = talloc_string_sub(ctx,
247 del_script, "%g", unix_group);
251 ret = smbrun(del_script,NULL);
252 DEBUG(ret ? 0 : 3,("smb_delete_group: Running the command `%s' gave %d\n",del_script,ret));
254 smb_nscd_flush_group_cache();
262 /****************************************************************************
263 Set a user's primary UNIX group.
264 ****************************************************************************/
266 int smb_set_primary_group(const char *unix_group, const char* unix_user)
268 char *add_script = NULL;
271 /* defer to scripts */
273 if ( *lp_setprimarygroup_script() ) {
274 TALLOC_CTX *ctx = talloc_tos();
276 add_script = talloc_strdup(ctx,
277 lp_setprimarygroup_script());
281 add_script = talloc_all_string_sub(ctx,
282 add_script, "%g", unix_group);
286 add_script = talloc_string_sub(ctx,
287 add_script, "%u", unix_user);
291 ret = smbrun(add_script,NULL);
293 DEBUG(ret ? 0 : 3,("smb_set_primary_group: "
294 "Running the command `%s' gave %d\n",add_script,ret));
296 smb_nscd_flush_group_cache();
304 /****************************************************************************
305 Add a user to a UNIX group.
306 ****************************************************************************/
308 int smb_add_user_group(const char *unix_group, const char *unix_user)
310 char *add_script = NULL;
313 /* defer to scripts */
315 if ( *lp_addusertogroup_script() ) {
316 TALLOC_CTX *ctx = talloc_tos();
318 add_script = talloc_strdup(ctx,
319 lp_addusertogroup_script());
323 add_script = talloc_string_sub(ctx,
324 add_script, "%g", unix_group);
328 add_script = talloc_string_sub2(ctx,
329 add_script, "%u", unix_user, true, false, true);
333 ret = smbrun(add_script,NULL);
334 DEBUG(ret ? 0 : 3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script,ret));
336 smb_nscd_flush_group_cache();
344 /****************************************************************************
345 Delete a user from a UNIX group
346 ****************************************************************************/
348 int smb_delete_user_group(const char *unix_group, const char *unix_user)
350 char *del_script = NULL;
353 /* defer to scripts */
355 if ( *lp_deluserfromgroup_script() ) {
356 TALLOC_CTX *ctx = talloc_tos();
358 del_script = talloc_strdup(ctx,
359 lp_deluserfromgroup_script());
363 del_script = talloc_string_sub(ctx,
364 del_script, "%g", unix_group);
368 del_script = talloc_string_sub2(ctx,
369 del_script, "%u", unix_user, true, false, true);
373 ret = smbrun(del_script,NULL);
374 DEBUG(ret ? 0 : 3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script,ret));
376 smb_nscd_flush_group_cache();
385 NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
388 if (!init_group_mapping()) {
389 DEBUG(0,("failed to initialize group mapping\n"));
390 return NT_STATUS_UNSUCCESSFUL;
392 return backend->get_group_map_from_sid(sid, map) ?
393 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
396 NTSTATUS pdb_default_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
399 if (!init_group_mapping()) {
400 DEBUG(0,("failed to initialize group mapping\n"));
401 return NT_STATUS_UNSUCCESSFUL;
403 return backend->get_group_map_from_gid(gid, map) ?
404 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
407 NTSTATUS pdb_default_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
410 if (!init_group_mapping()) {
411 DEBUG(0,("failed to initialize group mapping\n"));
412 return NT_STATUS_UNSUCCESSFUL;
414 return backend->get_group_map_from_ntname(name, map) ?
415 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
418 NTSTATUS pdb_default_add_group_mapping_entry(struct pdb_methods *methods,
421 if (!init_group_mapping()) {
422 DEBUG(0,("failed to initialize group mapping\n"));
423 return NT_STATUS_UNSUCCESSFUL;
425 return backend->add_mapping_entry(map, TDB_INSERT) ?
426 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
429 NTSTATUS pdb_default_update_group_mapping_entry(struct pdb_methods *methods,
432 if (!init_group_mapping()) {
433 DEBUG(0,("failed to initialize group mapping\n"));
434 return NT_STATUS_UNSUCCESSFUL;
436 return backend->add_mapping_entry(map, TDB_REPLACE) ?
437 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
440 NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods,
443 if (!init_group_mapping()) {
444 DEBUG(0,("failed to initialize group mapping\n"));
445 return NT_STATUS_UNSUCCESSFUL;
447 return backend->group_map_remove(&sid) ?
448 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
451 NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
452 const struct dom_sid *sid, enum lsa_SidType sid_name_use,
453 GROUP_MAP **pp_rmap, size_t *p_num_entries,
456 if (!init_group_mapping()) {
457 DEBUG(0,("failed to initialize group mapping\n"));
458 return NT_STATUS_UNSUCCESSFUL;
460 return backend->enum_group_mapping(sid, sid_name_use, pp_rmap, p_num_entries, unix_only) ?
461 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
464 NTSTATUS pdb_default_create_alias(struct pdb_methods *methods,
465 const char *name, uint32 *rid)
468 enum lsa_SidType type;
476 DEBUG(10, ("Trying to create alias %s\n", name));
478 mem_ctx = talloc_new(NULL);
479 if (mem_ctx == NULL) {
480 return NT_STATUS_NO_MEMORY;
483 exists = lookup_name(mem_ctx, name, LOOKUP_NAME_LOCAL,
484 NULL, NULL, &sid, &type);
485 TALLOC_FREE(mem_ctx);
488 return NT_STATUS_ALIAS_EXISTS;
491 if (!pdb_new_rid(&new_rid)) {
492 DEBUG(0, ("Could not allocate a RID.\n"));
493 return NT_STATUS_ACCESS_DENIED;
496 sid_compose(&sid, get_global_sam_sid(), new_rid);
498 if (!winbind_allocate_gid(&gid)) {
499 DEBUG(3, ("Could not get a gid out of winbind - "
500 "wasted a rid :-(\n"));
501 return NT_STATUS_ACCESS_DENIED;
504 DEBUG(10, ("Creating alias %s with gid %u and rid %u\n",
505 name, (unsigned int)gid, (unsigned int)new_rid));
508 sid_copy(&map.sid, &sid);
509 map.sid_name_use = SID_NAME_ALIAS;
510 fstrcpy(map.nt_name, name);
511 fstrcpy(map.comment, "");
513 status = pdb_add_group_mapping_entry(&map);
515 if (!NT_STATUS_IS_OK(status)) {
516 DEBUG(0, ("Could not add group mapping entry for alias %s "
517 "(%s)\n", name, nt_errstr(status)));
526 NTSTATUS pdb_default_delete_alias(struct pdb_methods *methods,
527 const struct dom_sid *sid)
529 return pdb_delete_group_mapping_entry(*sid);
532 NTSTATUS pdb_default_get_aliasinfo(struct pdb_methods *methods,
533 const struct dom_sid *sid,
534 struct acct_info *info)
538 if (!pdb_getgrsid(&map, *sid))
539 return NT_STATUS_NO_SUCH_ALIAS;
541 if ((map.sid_name_use != SID_NAME_ALIAS) &&
542 (map.sid_name_use != SID_NAME_WKN_GRP)) {
543 DEBUG(2, ("%s is a %s, expected an alias\n",
545 sid_type_lookup(map.sid_name_use)));
546 return NT_STATUS_NO_SUCH_ALIAS;
549 fstrcpy(info->acct_name, map.nt_name);
550 fstrcpy(info->acct_desc, map.comment);
551 sid_peek_rid(&map.sid, &info->rid);
555 NTSTATUS pdb_default_set_aliasinfo(struct pdb_methods *methods,
556 const struct dom_sid *sid,
557 struct acct_info *info)
561 if (!pdb_getgrsid(&map, *sid))
562 return NT_STATUS_NO_SUCH_ALIAS;
564 fstrcpy(map.nt_name, info->acct_name);
565 fstrcpy(map.comment, info->acct_desc);
567 return pdb_update_group_mapping_entry(&map);
570 NTSTATUS pdb_default_add_aliasmem(struct pdb_methods *methods,
571 const struct dom_sid *alias, const struct dom_sid *member)
573 if (!init_group_mapping()) {
574 DEBUG(0,("failed to initialize group mapping\n"));
575 return NT_STATUS_UNSUCCESSFUL;
577 return backend->add_aliasmem(alias, member);
580 NTSTATUS pdb_default_del_aliasmem(struct pdb_methods *methods,
581 const struct dom_sid *alias, const struct dom_sid *member)
583 if (!init_group_mapping()) {
584 DEBUG(0,("failed to initialize group mapping\n"));
585 return NT_STATUS_UNSUCCESSFUL;
587 return backend->del_aliasmem(alias, member);
590 NTSTATUS pdb_default_enum_aliasmem(struct pdb_methods *methods,
591 const struct dom_sid *alias, TALLOC_CTX *mem_ctx,
592 struct dom_sid **pp_members, size_t *p_num_members)
594 if (!init_group_mapping()) {
595 DEBUG(0,("failed to initialize group mapping\n"));
596 return NT_STATUS_UNSUCCESSFUL;
598 return backend->enum_aliasmem(alias, mem_ctx, pp_members,
602 NTSTATUS pdb_default_alias_memberships(struct pdb_methods *methods,
604 const struct dom_sid *domain_sid,
605 const struct dom_sid *members,
607 uint32 **pp_alias_rids,
608 size_t *p_num_alias_rids)
610 struct dom_sid *alias_sids;
611 size_t i, num_alias_sids;
614 if (!init_group_mapping()) {
615 DEBUG(0,("failed to initialize group mapping\n"));
616 return NT_STATUS_UNSUCCESSFUL;
622 result = alias_memberships(members, num_members,
623 &alias_sids, &num_alias_sids);
625 if (!NT_STATUS_IS_OK(result))
628 *p_num_alias_rids = 0;
630 if (num_alias_sids == 0) {
631 TALLOC_FREE(alias_sids);
635 *pp_alias_rids = TALLOC_ARRAY(mem_ctx, uint32, num_alias_sids);
636 if (*pp_alias_rids == NULL)
637 return NT_STATUS_NO_MEMORY;
639 for (i=0; i<num_alias_sids; i++) {
640 if (!sid_peek_check_rid(domain_sid, &alias_sids[i],
641 &(*pp_alias_rids)[*p_num_alias_rids]))
643 *p_num_alias_rids += 1;
646 TALLOC_FREE(alias_sids);
651 /**********************************************************************
652 no ops for passdb backends that don't implement group mapping
653 *********************************************************************/
655 NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
658 return NT_STATUS_UNSUCCESSFUL;
661 NTSTATUS pdb_nop_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
664 return NT_STATUS_UNSUCCESSFUL;
667 NTSTATUS pdb_nop_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
670 return NT_STATUS_UNSUCCESSFUL;
673 NTSTATUS pdb_nop_add_group_mapping_entry(struct pdb_methods *methods,
676 return NT_STATUS_UNSUCCESSFUL;
679 NTSTATUS pdb_nop_update_group_mapping_entry(struct pdb_methods *methods,
682 return NT_STATUS_UNSUCCESSFUL;
685 NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods,
688 return NT_STATUS_UNSUCCESSFUL;
691 NTSTATUS pdb_nop_enum_group_mapping(struct pdb_methods *methods,
692 enum lsa_SidType sid_name_use,
693 GROUP_MAP **rmap, size_t *num_entries,
696 return NT_STATUS_UNSUCCESSFUL;
699 /****************************************************************************
700 These need to be redirected through pdb_interface.c
701 ****************************************************************************/
702 bool pdb_get_dom_grp_info(const struct dom_sid *sid, struct acct_info *info)
708 res = get_domain_group_from_sid(*sid, &map);
714 fstrcpy(info->acct_name, map.nt_name);
715 fstrcpy(info->acct_desc, map.comment);
716 sid_peek_rid(sid, &info->rid);
720 bool pdb_set_dom_grp_info(const struct dom_sid *sid, const struct acct_info *info)
724 if (!get_domain_group_from_sid(*sid, &map))
727 fstrcpy(map.nt_name, info->acct_name);
728 fstrcpy(map.comment, info->acct_desc);
730 return NT_STATUS_IS_OK(pdb_update_group_mapping_entry(&map));
733 /********************************************************************
734 Really just intended to be called by smbd
735 ********************************************************************/
737 NTSTATUS pdb_create_builtin_alias(uint32 rid)
740 enum lsa_SidType type;
745 const char *name = NULL;
748 DEBUG(10, ("Trying to create builtin alias %d\n", rid));
750 if ( !sid_compose( &sid, &global_sid_Builtin, rid ) ) {
751 return NT_STATUS_NO_SUCH_ALIAS;
754 if ( (mem_ctx = talloc_new(NULL)) == NULL ) {
755 return NT_STATUS_NO_MEMORY;
758 if ( !lookup_sid(mem_ctx, &sid, NULL, &name, &type) ) {
759 TALLOC_FREE( mem_ctx );
760 return NT_STATUS_NO_SUCH_ALIAS;
763 /* validate RID so copy the name and move on */
765 fstrcpy( groupname, name );
766 TALLOC_FREE( mem_ctx );
768 if (!winbind_allocate_gid(&gid)) {
769 DEBUG(3, ("pdb_create_builtin_alias: Could not get a gid out of winbind\n"));
770 return NT_STATUS_ACCESS_DENIED;
773 DEBUG(10,("Creating alias %s with gid %u\n", groupname, (unsigned int)gid));
776 sid_copy(&map.sid, &sid);
777 map.sid_name_use = SID_NAME_ALIAS;
778 fstrcpy(map.nt_name, groupname);
779 fstrcpy(map.comment, "");
781 status = pdb_add_group_mapping_entry(&map);
783 if (!NT_STATUS_IS_OK(status)) {
784 DEBUG(0, ("pdb_create_builtin_alias: Could not add group mapping entry for alias %d "
785 "(%s)\n", rid, nt_errstr(status)));