2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-2000,
5 * Copyright (C) Jean François Micouleau 1998-2001.
6 * Copyright (C) Volker Lendecke 2006.
7 * Copyright (C) Gerald Carter 2006.
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 3 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, see <http://www.gnu.org/licenses/>.
24 #include "groupdb/mapping.h"
25 #include "../libcli/security/security.h"
27 static const struct mapping_backend *backend;
30 initialise a group mapping backend
32 static bool init_group_mapping(void)
34 if (backend != NULL) {
35 /* already initialised */
39 backend = groupdb_tdb_init();
41 return backend != NULL;
44 /****************************************************************************
45 initialise first time the mapping list
46 ****************************************************************************/
47 NTSTATUS add_initial_entry(gid_t gid, const char *sid, enum lsa_SidType sid_name_use, const char *nt_name, const char *comment)
51 if(!init_group_mapping()) {
52 DEBUG(0,("failed to initialize group mapping\n"));
53 return NT_STATUS_UNSUCCESSFUL;
57 if (!string_to_sid(&map.sid, sid)) {
58 DEBUG(0, ("string_to_sid failed: %s", sid));
59 return NT_STATUS_UNSUCCESSFUL;
62 map.sid_name_use=sid_name_use;
63 fstrcpy(map.nt_name, nt_name);
64 fstrcpy(map.comment, comment);
66 return pdb_add_group_mapping_entry(&map);
69 static NTSTATUS alias_memberships(const struct dom_sid *members, size_t num_members,
70 struct dom_sid **sids, size_t *num)
77 for (i=0; i<num_members; i++) {
78 NTSTATUS status = backend->one_alias_membership(&members[i], sids, num);
79 if (!NT_STATUS_IS_OK(status))
85 struct aliasmem_closure {
86 const struct dom_sid *alias;
87 struct dom_sid **sids;
95 * High level functions
96 * better to use them than the lower ones.
98 * we are checking if the group is in the mapping file
99 * and if the group is an existing unix group
103 /* get a domain group from it's SID */
105 bool get_domain_group_from_sid(struct dom_sid sid, GROUP_MAP *map)
110 if(!init_group_mapping()) {
111 DEBUG(0,("failed to initialize group mapping\n"));
115 DEBUG(10, ("get_domain_group_from_sid\n"));
117 /* if the group is NOT in the database, it CAN NOT be a domain group */
120 ret = pdb_getgrsid(map, sid);
123 /* special case check for rid 513 */
128 sid_peek_rid( &sid, &rid );
130 if ( rid == DOMAIN_RID_USERS ) {
131 fstrcpy( map->nt_name, "None" );
132 fstrcpy( map->comment, "Ordinary Users" );
133 sid_copy( &map->sid, &sid );
134 map->sid_name_use = SID_NAME_DOM_GRP;
135 map->gid = (gid_t)-1;
141 DEBUG(10, ("get_domain_group_from_sid: SID found in passdb\n"));
143 /* if it's not a domain group, continue */
144 if (map->sid_name_use!=SID_NAME_DOM_GRP) {
148 DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
154 DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid));
156 grp = getgrgid(map->gid);
158 DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n"));
162 DEBUG(10, ("get_domain_group_from_sid: gid exists in UNIX security\n"));
167 /****************************************************************************
168 Create a UNIX group on demand.
169 ****************************************************************************/
171 int smb_create_group(const char *unix_group, gid_t *new_gid)
173 char *add_script = NULL;
179 /* defer to scripts */
181 if ( *lp_addgroup_script() ) {
182 TALLOC_CTX *ctx = talloc_tos();
184 add_script = talloc_strdup(ctx,
185 lp_addgroup_script());
189 add_script = talloc_string_sub(ctx,
190 add_script, "%g", unix_group);
195 ret = smbrun(add_script, &fd);
196 DEBUG(ret ? 0 : 3,("smb_create_group: Running the command `%s' gave %d\n",add_script,ret));
198 smb_nscd_flush_group_cache();
207 if (read(fd, output, sizeof(output)) > 0) {
208 *new_gid = (gid_t)strtoul(output, NULL, 10);
217 struct group *grp = getgrnam(unix_group);
220 *new_gid = grp->gr_gid;
226 /****************************************************************************
227 Delete a UNIX group on demand.
228 ****************************************************************************/
230 int smb_delete_group(const char *unix_group)
232 char *del_script = NULL;
235 /* defer to scripts */
237 if ( *lp_delgroup_script() ) {
238 TALLOC_CTX *ctx = talloc_tos();
240 del_script = talloc_strdup(ctx,
241 lp_delgroup_script());
245 del_script = talloc_string_sub(ctx,
246 del_script, "%g", unix_group);
250 ret = smbrun(del_script,NULL);
251 DEBUG(ret ? 0 : 3,("smb_delete_group: Running the command `%s' gave %d\n",del_script,ret));
253 smb_nscd_flush_group_cache();
261 /****************************************************************************
262 Set a user's primary UNIX group.
263 ****************************************************************************/
265 int smb_set_primary_group(const char *unix_group, const char* unix_user)
267 char *add_script = NULL;
270 /* defer to scripts */
272 if ( *lp_setprimarygroup_script() ) {
273 TALLOC_CTX *ctx = talloc_tos();
275 add_script = talloc_strdup(ctx,
276 lp_setprimarygroup_script());
280 add_script = talloc_all_string_sub(ctx,
281 add_script, "%g", unix_group);
285 add_script = talloc_string_sub(ctx,
286 add_script, "%u", unix_user);
290 ret = smbrun(add_script,NULL);
292 DEBUG(ret ? 0 : 3,("smb_set_primary_group: "
293 "Running the command `%s' gave %d\n",add_script,ret));
295 smb_nscd_flush_group_cache();
303 /****************************************************************************
304 Add a user to a UNIX group.
305 ****************************************************************************/
307 int smb_add_user_group(const char *unix_group, const char *unix_user)
309 char *add_script = NULL;
312 /* defer to scripts */
314 if ( *lp_addusertogroup_script() ) {
315 TALLOC_CTX *ctx = talloc_tos();
317 add_script = talloc_strdup(ctx,
318 lp_addusertogroup_script());
322 add_script = talloc_string_sub(ctx,
323 add_script, "%g", unix_group);
327 add_script = talloc_string_sub2(ctx,
328 add_script, "%u", unix_user, true, false, true);
332 ret = smbrun(add_script,NULL);
333 DEBUG(ret ? 0 : 3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script,ret));
335 smb_nscd_flush_group_cache();
343 /****************************************************************************
344 Delete a user from a UNIX group
345 ****************************************************************************/
347 int smb_delete_user_group(const char *unix_group, const char *unix_user)
349 char *del_script = NULL;
352 /* defer to scripts */
354 if ( *lp_deluserfromgroup_script() ) {
355 TALLOC_CTX *ctx = talloc_tos();
357 del_script = talloc_strdup(ctx,
358 lp_deluserfromgroup_script());
362 del_script = talloc_string_sub(ctx,
363 del_script, "%g", unix_group);
367 del_script = talloc_string_sub2(ctx,
368 del_script, "%u", unix_user, true, false, true);
372 ret = smbrun(del_script,NULL);
373 DEBUG(ret ? 0 : 3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script,ret));
375 smb_nscd_flush_group_cache();
384 NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
387 if (!init_group_mapping()) {
388 DEBUG(0,("failed to initialize group mapping\n"));
389 return NT_STATUS_UNSUCCESSFUL;
391 return backend->get_group_map_from_sid(sid, map) ?
392 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
395 NTSTATUS pdb_default_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
398 if (!init_group_mapping()) {
399 DEBUG(0,("failed to initialize group mapping\n"));
400 return NT_STATUS_UNSUCCESSFUL;
402 return backend->get_group_map_from_gid(gid, map) ?
403 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
406 NTSTATUS pdb_default_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
409 if (!init_group_mapping()) {
410 DEBUG(0,("failed to initialize group mapping\n"));
411 return NT_STATUS_UNSUCCESSFUL;
413 return backend->get_group_map_from_ntname(name, map) ?
414 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
417 NTSTATUS pdb_default_add_group_mapping_entry(struct pdb_methods *methods,
420 if (!init_group_mapping()) {
421 DEBUG(0,("failed to initialize group mapping\n"));
422 return NT_STATUS_UNSUCCESSFUL;
424 return backend->add_mapping_entry(map, TDB_INSERT) ?
425 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
428 NTSTATUS pdb_default_update_group_mapping_entry(struct pdb_methods *methods,
431 if (!init_group_mapping()) {
432 DEBUG(0,("failed to initialize group mapping\n"));
433 return NT_STATUS_UNSUCCESSFUL;
435 return backend->add_mapping_entry(map, TDB_REPLACE) ?
436 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
439 NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods,
442 if (!init_group_mapping()) {
443 DEBUG(0,("failed to initialize group mapping\n"));
444 return NT_STATUS_UNSUCCESSFUL;
446 return backend->group_map_remove(&sid) ?
447 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
450 NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
451 const struct dom_sid *sid, enum lsa_SidType sid_name_use,
452 GROUP_MAP **pp_rmap, size_t *p_num_entries,
455 if (!init_group_mapping()) {
456 DEBUG(0,("failed to initialize group mapping\n"));
457 return NT_STATUS_UNSUCCESSFUL;
459 return backend->enum_group_mapping(sid, sid_name_use, pp_rmap, p_num_entries, unix_only) ?
460 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
463 NTSTATUS pdb_default_create_alias(struct pdb_methods *methods,
464 const char *name, uint32 *rid)
467 enum lsa_SidType type;
475 DEBUG(10, ("Trying to create alias %s\n", name));
477 mem_ctx = talloc_new(NULL);
478 if (mem_ctx == NULL) {
479 return NT_STATUS_NO_MEMORY;
482 exists = lookup_name(mem_ctx, name, LOOKUP_NAME_LOCAL,
483 NULL, NULL, &sid, &type);
484 TALLOC_FREE(mem_ctx);
487 return NT_STATUS_ALIAS_EXISTS;
490 if (!pdb_new_rid(&new_rid)) {
491 DEBUG(0, ("Could not allocate a RID.\n"));
492 return NT_STATUS_ACCESS_DENIED;
495 sid_compose(&sid, get_global_sam_sid(), new_rid);
497 if (!winbind_allocate_gid(&gid)) {
498 DEBUG(3, ("Could not get a gid out of winbind - "
499 "wasted a rid :-(\n"));
500 return NT_STATUS_ACCESS_DENIED;
503 DEBUG(10, ("Creating alias %s with gid %u and rid %u\n",
504 name, (unsigned int)gid, (unsigned int)new_rid));
507 sid_copy(&map.sid, &sid);
508 map.sid_name_use = SID_NAME_ALIAS;
509 fstrcpy(map.nt_name, name);
510 fstrcpy(map.comment, "");
512 status = pdb_add_group_mapping_entry(&map);
514 if (!NT_STATUS_IS_OK(status)) {
515 DEBUG(0, ("Could not add group mapping entry for alias %s "
516 "(%s)\n", name, nt_errstr(status)));
525 NTSTATUS pdb_default_delete_alias(struct pdb_methods *methods,
526 const struct dom_sid *sid)
528 return pdb_delete_group_mapping_entry(*sid);
531 NTSTATUS pdb_default_get_aliasinfo(struct pdb_methods *methods,
532 const struct dom_sid *sid,
533 struct acct_info *info)
537 if (!pdb_getgrsid(&map, *sid))
538 return NT_STATUS_NO_SUCH_ALIAS;
540 if ((map.sid_name_use != SID_NAME_ALIAS) &&
541 (map.sid_name_use != SID_NAME_WKN_GRP)) {
542 DEBUG(2, ("%s is a %s, expected an alias\n",
544 sid_type_lookup(map.sid_name_use)));
545 return NT_STATUS_NO_SUCH_ALIAS;
548 fstrcpy(info->acct_name, map.nt_name);
549 fstrcpy(info->acct_desc, map.comment);
550 sid_peek_rid(&map.sid, &info->rid);
554 NTSTATUS pdb_default_set_aliasinfo(struct pdb_methods *methods,
555 const struct dom_sid *sid,
556 struct acct_info *info)
560 if (!pdb_getgrsid(&map, *sid))
561 return NT_STATUS_NO_SUCH_ALIAS;
563 fstrcpy(map.nt_name, info->acct_name);
564 fstrcpy(map.comment, info->acct_desc);
566 return pdb_update_group_mapping_entry(&map);
569 NTSTATUS pdb_default_add_aliasmem(struct pdb_methods *methods,
570 const struct dom_sid *alias, const struct dom_sid *member)
572 if (!init_group_mapping()) {
573 DEBUG(0,("failed to initialize group mapping\n"));
574 return NT_STATUS_UNSUCCESSFUL;
576 return backend->add_aliasmem(alias, member);
579 NTSTATUS pdb_default_del_aliasmem(struct pdb_methods *methods,
580 const struct dom_sid *alias, const struct dom_sid *member)
582 if (!init_group_mapping()) {
583 DEBUG(0,("failed to initialize group mapping\n"));
584 return NT_STATUS_UNSUCCESSFUL;
586 return backend->del_aliasmem(alias, member);
589 NTSTATUS pdb_default_enum_aliasmem(struct pdb_methods *methods,
590 const struct dom_sid *alias, TALLOC_CTX *mem_ctx,
591 struct dom_sid **pp_members, size_t *p_num_members)
593 if (!init_group_mapping()) {
594 DEBUG(0,("failed to initialize group mapping\n"));
595 return NT_STATUS_UNSUCCESSFUL;
597 return backend->enum_aliasmem(alias, mem_ctx, pp_members,
601 NTSTATUS pdb_default_alias_memberships(struct pdb_methods *methods,
603 const struct dom_sid *domain_sid,
604 const struct dom_sid *members,
606 uint32 **pp_alias_rids,
607 size_t *p_num_alias_rids)
609 struct dom_sid *alias_sids;
610 size_t i, num_alias_sids;
613 if (!init_group_mapping()) {
614 DEBUG(0,("failed to initialize group mapping\n"));
615 return NT_STATUS_UNSUCCESSFUL;
621 result = alias_memberships(members, num_members,
622 &alias_sids, &num_alias_sids);
624 if (!NT_STATUS_IS_OK(result))
627 *p_num_alias_rids = 0;
629 if (num_alias_sids == 0) {
630 TALLOC_FREE(alias_sids);
634 *pp_alias_rids = TALLOC_ARRAY(mem_ctx, uint32, num_alias_sids);
635 if (*pp_alias_rids == NULL)
636 return NT_STATUS_NO_MEMORY;
638 for (i=0; i<num_alias_sids; i++) {
639 if (!sid_peek_check_rid(domain_sid, &alias_sids[i],
640 &(*pp_alias_rids)[*p_num_alias_rids]))
642 *p_num_alias_rids += 1;
645 TALLOC_FREE(alias_sids);
650 /**********************************************************************
651 no ops for passdb backends that don't implement group mapping
652 *********************************************************************/
654 NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
657 return NT_STATUS_UNSUCCESSFUL;
660 NTSTATUS pdb_nop_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
663 return NT_STATUS_UNSUCCESSFUL;
666 NTSTATUS pdb_nop_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
669 return NT_STATUS_UNSUCCESSFUL;
672 NTSTATUS pdb_nop_add_group_mapping_entry(struct pdb_methods *methods,
675 return NT_STATUS_UNSUCCESSFUL;
678 NTSTATUS pdb_nop_update_group_mapping_entry(struct pdb_methods *methods,
681 return NT_STATUS_UNSUCCESSFUL;
684 NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods,
687 return NT_STATUS_UNSUCCESSFUL;
690 NTSTATUS pdb_nop_enum_group_mapping(struct pdb_methods *methods,
691 enum lsa_SidType sid_name_use,
692 GROUP_MAP **rmap, size_t *num_entries,
695 return NT_STATUS_UNSUCCESSFUL;
698 /****************************************************************************
699 These need to be redirected through pdb_interface.c
700 ****************************************************************************/
701 bool pdb_get_dom_grp_info(const struct dom_sid *sid, struct acct_info *info)
707 res = get_domain_group_from_sid(*sid, &map);
713 fstrcpy(info->acct_name, map.nt_name);
714 fstrcpy(info->acct_desc, map.comment);
715 sid_peek_rid(sid, &info->rid);
719 bool pdb_set_dom_grp_info(const struct dom_sid *sid, const struct acct_info *info)
723 if (!get_domain_group_from_sid(*sid, &map))
726 fstrcpy(map.nt_name, info->acct_name);
727 fstrcpy(map.comment, info->acct_desc);
729 return NT_STATUS_IS_OK(pdb_update_group_mapping_entry(&map));
732 /********************************************************************
733 Really just intended to be called by smbd
734 ********************************************************************/
736 NTSTATUS pdb_create_builtin_alias(uint32 rid)
739 enum lsa_SidType type;
744 const char *name = NULL;
747 DEBUG(10, ("Trying to create builtin alias %d\n", rid));
749 if ( !sid_compose( &sid, &global_sid_Builtin, rid ) ) {
750 return NT_STATUS_NO_SUCH_ALIAS;
753 if ( (mem_ctx = talloc_new(NULL)) == NULL ) {
754 return NT_STATUS_NO_MEMORY;
757 if ( !lookup_sid(mem_ctx, &sid, NULL, &name, &type) ) {
758 TALLOC_FREE( mem_ctx );
759 return NT_STATUS_NO_SUCH_ALIAS;
762 /* validate RID so copy the name and move on */
764 fstrcpy( groupname, name );
765 TALLOC_FREE( mem_ctx );
767 if (!winbind_allocate_gid(&gid)) {
768 DEBUG(3, ("pdb_create_builtin_alias: Could not get a gid out of winbind\n"));
769 return NT_STATUS_ACCESS_DENIED;
772 DEBUG(10,("Creating alias %s with gid %u\n", groupname, (unsigned int)gid));
775 sid_copy(&map.sid, &sid);
776 map.sid_name_use = SID_NAME_ALIAS;
777 fstrcpy(map.nt_name, groupname);
778 fstrcpy(map.comment, "");
780 status = pdb_add_group_mapping_entry(&map);
782 if (!NT_STATUS_IS_OK(status)) {
783 DEBUG(0, ("pdb_create_builtin_alias: Could not add group mapping entry for alias %d "
784 "(%s)\n", rid, nt_errstr(status)));