2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-2000,
5 * Copyright (C) Jean François Micouleau 1998-2001.
6 * Copyright (C) Volker Lendecke 2006.
7 * Copyright (C) Gerald Carter 2006.
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 3 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, see <http://www.gnu.org/licenses/>.
24 #include "system/passwd.h"
26 #include "groupdb/mapping.h"
27 #include "../libcli/security/security.h"
28 #include "lib/winbind_util.h"
31 static const struct mapping_backend *backend;
34 initialise a group mapping backend
36 static bool init_group_mapping(void)
38 if (backend != NULL) {
39 /* already initialised */
43 backend = groupdb_tdb_init();
45 return backend != NULL;
48 /****************************************************************************
49 initialise first time the mapping list
50 ****************************************************************************/
51 NTSTATUS add_initial_entry(gid_t gid, const char *sid, enum lsa_SidType sid_name_use, const char *nt_name, const char *comment)
55 if(!init_group_mapping()) {
56 DEBUG(0,("failed to initialize group mapping\n"));
57 return NT_STATUS_UNSUCCESSFUL;
61 if (!string_to_sid(&map.sid, sid)) {
62 DEBUG(0, ("string_to_sid failed: %s", sid));
63 return NT_STATUS_UNSUCCESSFUL;
66 map.sid_name_use=sid_name_use;
67 fstrcpy(map.nt_name, nt_name);
68 fstrcpy(map.comment, comment);
70 return pdb_add_group_mapping_entry(&map);
73 static NTSTATUS alias_memberships(const struct dom_sid *members, size_t num_members,
74 struct dom_sid **sids, size_t *num)
81 for (i=0; i<num_members; i++) {
82 NTSTATUS status = backend->one_alias_membership(&members[i], sids, num);
83 if (!NT_STATUS_IS_OK(status))
89 struct aliasmem_closure {
90 const struct dom_sid *alias;
91 struct dom_sid **sids;
99 * High level functions
100 * better to use them than the lower ones.
102 * we are checking if the group is in the mapping file
103 * and if the group is an existing unix group
107 /* get a domain group from it's SID */
109 bool get_domain_group_from_sid(struct dom_sid sid, GROUP_MAP *map)
114 if(!init_group_mapping()) {
115 DEBUG(0,("failed to initialize group mapping\n"));
119 DEBUG(10, ("get_domain_group_from_sid\n"));
121 /* if the group is NOT in the database, it CAN NOT be a domain group */
124 ret = pdb_getgrsid(map, sid);
127 /* special case check for rid 513 */
132 sid_peek_rid( &sid, &rid );
134 if ( rid == DOMAIN_RID_USERS ) {
135 fstrcpy( map->nt_name, "None" );
136 fstrcpy( map->comment, "Ordinary Users" );
137 sid_copy( &map->sid, &sid );
138 map->sid_name_use = SID_NAME_DOM_GRP;
139 map->gid = (gid_t)-1;
145 DEBUG(10, ("get_domain_group_from_sid: SID found in passdb\n"));
147 /* if it's not a domain group, continue */
148 if (map->sid_name_use!=SID_NAME_DOM_GRP) {
152 DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
158 DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid));
160 grp = getgrgid(map->gid);
162 DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n"));
166 DEBUG(10, ("get_domain_group_from_sid: gid exists in UNIX security\n"));
171 /****************************************************************************
172 Create a UNIX group on demand.
173 ****************************************************************************/
175 int smb_create_group(const char *unix_group, gid_t *new_gid)
177 char *add_script = NULL;
183 /* defer to scripts */
185 if ( *lp_addgroup_script() ) {
186 TALLOC_CTX *ctx = talloc_tos();
188 add_script = talloc_strdup(ctx,
189 lp_addgroup_script());
193 add_script = talloc_string_sub(ctx,
194 add_script, "%g", unix_group);
199 ret = smbrun(add_script, &fd);
200 DEBUG(ret ? 0 : 3,("smb_create_group: Running the command `%s' gave %d\n",add_script,ret));
202 smb_nscd_flush_group_cache();
211 if (read(fd, output, sizeof(output)) > 0) {
212 *new_gid = (gid_t)strtoul(output, NULL, 10);
221 struct group *grp = getgrnam(unix_group);
224 *new_gid = grp->gr_gid;
230 /****************************************************************************
231 Delete a UNIX group on demand.
232 ****************************************************************************/
234 int smb_delete_group(const char *unix_group)
236 char *del_script = NULL;
239 /* defer to scripts */
241 if ( *lp_delgroup_script() ) {
242 TALLOC_CTX *ctx = talloc_tos();
244 del_script = talloc_strdup(ctx,
245 lp_delgroup_script());
249 del_script = talloc_string_sub(ctx,
250 del_script, "%g", unix_group);
254 ret = smbrun(del_script,NULL);
255 DEBUG(ret ? 0 : 3,("smb_delete_group: Running the command `%s' gave %d\n",del_script,ret));
257 smb_nscd_flush_group_cache();
265 /****************************************************************************
266 Set a user's primary UNIX group.
267 ****************************************************************************/
269 int smb_set_primary_group(const char *unix_group, const char* unix_user)
271 char *add_script = NULL;
274 /* defer to scripts */
276 if ( *lp_setprimarygroup_script() ) {
277 TALLOC_CTX *ctx = talloc_tos();
279 add_script = talloc_strdup(ctx,
280 lp_setprimarygroup_script());
284 add_script = talloc_all_string_sub(ctx,
285 add_script, "%g", unix_group);
289 add_script = talloc_string_sub(ctx,
290 add_script, "%u", unix_user);
294 ret = smbrun(add_script,NULL);
296 DEBUG(ret ? 0 : 3,("smb_set_primary_group: "
297 "Running the command `%s' gave %d\n",add_script,ret));
299 smb_nscd_flush_group_cache();
307 /****************************************************************************
308 Add a user to a UNIX group.
309 ****************************************************************************/
311 int smb_add_user_group(const char *unix_group, const char *unix_user)
313 char *add_script = NULL;
316 /* defer to scripts */
318 if ( *lp_addusertogroup_script() ) {
319 TALLOC_CTX *ctx = talloc_tos();
321 add_script = talloc_strdup(ctx,
322 lp_addusertogroup_script());
326 add_script = talloc_string_sub(ctx,
327 add_script, "%g", unix_group);
331 add_script = talloc_string_sub2(ctx,
332 add_script, "%u", unix_user, true, false, true);
336 ret = smbrun(add_script,NULL);
337 DEBUG(ret ? 0 : 3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script,ret));
339 smb_nscd_flush_group_cache();
347 /****************************************************************************
348 Delete a user from a UNIX group
349 ****************************************************************************/
351 int smb_delete_user_group(const char *unix_group, const char *unix_user)
353 char *del_script = NULL;
356 /* defer to scripts */
358 if ( *lp_deluserfromgroup_script() ) {
359 TALLOC_CTX *ctx = talloc_tos();
361 del_script = talloc_strdup(ctx,
362 lp_deluserfromgroup_script());
366 del_script = talloc_string_sub(ctx,
367 del_script, "%g", unix_group);
371 del_script = talloc_string_sub2(ctx,
372 del_script, "%u", unix_user, true, false, true);
376 ret = smbrun(del_script,NULL);
377 DEBUG(ret ? 0 : 3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script,ret));
379 smb_nscd_flush_group_cache();
388 NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
391 if (!init_group_mapping()) {
392 DEBUG(0,("failed to initialize group mapping\n"));
393 return NT_STATUS_UNSUCCESSFUL;
395 return backend->get_group_map_from_sid(sid, map) ?
396 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
399 NTSTATUS pdb_default_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
402 if (!init_group_mapping()) {
403 DEBUG(0,("failed to initialize group mapping\n"));
404 return NT_STATUS_UNSUCCESSFUL;
406 return backend->get_group_map_from_gid(gid, map) ?
407 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
410 NTSTATUS pdb_default_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
413 if (!init_group_mapping()) {
414 DEBUG(0,("failed to initialize group mapping\n"));
415 return NT_STATUS_UNSUCCESSFUL;
417 return backend->get_group_map_from_ntname(name, map) ?
418 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
421 NTSTATUS pdb_default_add_group_mapping_entry(struct pdb_methods *methods,
424 if (!init_group_mapping()) {
425 DEBUG(0,("failed to initialize group mapping\n"));
426 return NT_STATUS_UNSUCCESSFUL;
428 return backend->add_mapping_entry(map, TDB_INSERT) ?
429 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
432 NTSTATUS pdb_default_update_group_mapping_entry(struct pdb_methods *methods,
435 if (!init_group_mapping()) {
436 DEBUG(0,("failed to initialize group mapping\n"));
437 return NT_STATUS_UNSUCCESSFUL;
439 return backend->add_mapping_entry(map, TDB_REPLACE) ?
440 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
443 NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods,
446 if (!init_group_mapping()) {
447 DEBUG(0,("failed to initialize group mapping\n"));
448 return NT_STATUS_UNSUCCESSFUL;
450 return backend->group_map_remove(&sid) ?
451 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
454 NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
455 const struct dom_sid *sid, enum lsa_SidType sid_name_use,
456 GROUP_MAP **pp_rmap, size_t *p_num_entries,
459 if (!init_group_mapping()) {
460 DEBUG(0,("failed to initialize group mapping\n"));
461 return NT_STATUS_UNSUCCESSFUL;
463 return backend->enum_group_mapping(sid, sid_name_use, pp_rmap, p_num_entries, unix_only) ?
464 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
467 NTSTATUS pdb_default_create_alias(struct pdb_methods *methods,
468 const char *name, uint32 *rid)
471 enum lsa_SidType type;
479 DEBUG(10, ("Trying to create alias %s\n", name));
481 mem_ctx = talloc_new(NULL);
482 if (mem_ctx == NULL) {
483 return NT_STATUS_NO_MEMORY;
486 exists = lookup_name(mem_ctx, name, LOOKUP_NAME_LOCAL,
487 NULL, NULL, &sid, &type);
488 TALLOC_FREE(mem_ctx);
491 return NT_STATUS_ALIAS_EXISTS;
494 if (!pdb_new_rid(&new_rid)) {
495 DEBUG(0, ("Could not allocate a RID.\n"));
496 return NT_STATUS_ACCESS_DENIED;
499 sid_compose(&sid, get_global_sam_sid(), new_rid);
501 if (!winbind_allocate_gid(&gid)) {
502 DEBUG(3, ("Could not get a gid out of winbind - "
503 "wasted a rid :-(\n"));
504 return NT_STATUS_ACCESS_DENIED;
507 DEBUG(10, ("Creating alias %s with gid %u and rid %u\n",
508 name, (unsigned int)gid, (unsigned int)new_rid));
511 sid_copy(&map.sid, &sid);
512 map.sid_name_use = SID_NAME_ALIAS;
513 fstrcpy(map.nt_name, name);
514 fstrcpy(map.comment, "");
516 status = pdb_add_group_mapping_entry(&map);
518 if (!NT_STATUS_IS_OK(status)) {
519 DEBUG(0, ("Could not add group mapping entry for alias %s "
520 "(%s)\n", name, nt_errstr(status)));
529 NTSTATUS pdb_default_delete_alias(struct pdb_methods *methods,
530 const struct dom_sid *sid)
532 return pdb_delete_group_mapping_entry(*sid);
535 NTSTATUS pdb_default_get_aliasinfo(struct pdb_methods *methods,
536 const struct dom_sid *sid,
537 struct acct_info *info)
541 if (!pdb_getgrsid(&map, *sid))
542 return NT_STATUS_NO_SUCH_ALIAS;
544 if ((map.sid_name_use != SID_NAME_ALIAS) &&
545 (map.sid_name_use != SID_NAME_WKN_GRP)) {
546 DEBUG(2, ("%s is a %s, expected an alias\n",
548 sid_type_lookup(map.sid_name_use)));
549 return NT_STATUS_NO_SUCH_ALIAS;
552 fstrcpy(info->acct_name, map.nt_name);
553 fstrcpy(info->acct_desc, map.comment);
554 sid_peek_rid(&map.sid, &info->rid);
558 NTSTATUS pdb_default_set_aliasinfo(struct pdb_methods *methods,
559 const struct dom_sid *sid,
560 struct acct_info *info)
564 if (!pdb_getgrsid(&map, *sid))
565 return NT_STATUS_NO_SUCH_ALIAS;
567 fstrcpy(map.nt_name, info->acct_name);
568 fstrcpy(map.comment, info->acct_desc);
570 return pdb_update_group_mapping_entry(&map);
573 NTSTATUS pdb_default_add_aliasmem(struct pdb_methods *methods,
574 const struct dom_sid *alias, const struct dom_sid *member)
576 if (!init_group_mapping()) {
577 DEBUG(0,("failed to initialize group mapping\n"));
578 return NT_STATUS_UNSUCCESSFUL;
580 return backend->add_aliasmem(alias, member);
583 NTSTATUS pdb_default_del_aliasmem(struct pdb_methods *methods,
584 const struct dom_sid *alias, const struct dom_sid *member)
586 if (!init_group_mapping()) {
587 DEBUG(0,("failed to initialize group mapping\n"));
588 return NT_STATUS_UNSUCCESSFUL;
590 return backend->del_aliasmem(alias, member);
593 NTSTATUS pdb_default_enum_aliasmem(struct pdb_methods *methods,
594 const struct dom_sid *alias, TALLOC_CTX *mem_ctx,
595 struct dom_sid **pp_members, size_t *p_num_members)
597 if (!init_group_mapping()) {
598 DEBUG(0,("failed to initialize group mapping\n"));
599 return NT_STATUS_UNSUCCESSFUL;
601 return backend->enum_aliasmem(alias, mem_ctx, pp_members,
605 NTSTATUS pdb_default_alias_memberships(struct pdb_methods *methods,
607 const struct dom_sid *domain_sid,
608 const struct dom_sid *members,
610 uint32 **pp_alias_rids,
611 size_t *p_num_alias_rids)
613 struct dom_sid *alias_sids;
614 size_t i, num_alias_sids;
617 if (!init_group_mapping()) {
618 DEBUG(0,("failed to initialize group mapping\n"));
619 return NT_STATUS_UNSUCCESSFUL;
625 result = alias_memberships(members, num_members,
626 &alias_sids, &num_alias_sids);
628 if (!NT_STATUS_IS_OK(result))
631 *p_num_alias_rids = 0;
633 if (num_alias_sids == 0) {
634 TALLOC_FREE(alias_sids);
638 *pp_alias_rids = talloc_array(mem_ctx, uint32, num_alias_sids);
639 if (*pp_alias_rids == NULL)
640 return NT_STATUS_NO_MEMORY;
642 for (i=0; i<num_alias_sids; i++) {
643 if (!sid_peek_check_rid(domain_sid, &alias_sids[i],
644 &(*pp_alias_rids)[*p_num_alias_rids]))
646 *p_num_alias_rids += 1;
649 TALLOC_FREE(alias_sids);
654 /**********************************************************************
655 no ops for passdb backends that don't implement group mapping
656 *********************************************************************/
658 NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
661 return NT_STATUS_UNSUCCESSFUL;
664 NTSTATUS pdb_nop_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
667 return NT_STATUS_UNSUCCESSFUL;
670 NTSTATUS pdb_nop_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
673 return NT_STATUS_UNSUCCESSFUL;
676 NTSTATUS pdb_nop_add_group_mapping_entry(struct pdb_methods *methods,
679 return NT_STATUS_UNSUCCESSFUL;
682 NTSTATUS pdb_nop_update_group_mapping_entry(struct pdb_methods *methods,
685 return NT_STATUS_UNSUCCESSFUL;
688 NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods,
691 return NT_STATUS_UNSUCCESSFUL;
694 NTSTATUS pdb_nop_enum_group_mapping(struct pdb_methods *methods,
695 enum lsa_SidType sid_name_use,
696 GROUP_MAP **rmap, size_t *num_entries,
699 return NT_STATUS_UNSUCCESSFUL;
702 /****************************************************************************
703 These need to be redirected through pdb_interface.c
704 ****************************************************************************/
705 bool pdb_get_dom_grp_info(const struct dom_sid *sid, struct acct_info *info)
711 res = get_domain_group_from_sid(*sid, &map);
717 fstrcpy(info->acct_name, map.nt_name);
718 fstrcpy(info->acct_desc, map.comment);
719 sid_peek_rid(sid, &info->rid);
723 bool pdb_set_dom_grp_info(const struct dom_sid *sid, const struct acct_info *info)
727 if (!get_domain_group_from_sid(*sid, &map))
730 fstrcpy(map.nt_name, info->acct_name);
731 fstrcpy(map.comment, info->acct_desc);
733 return NT_STATUS_IS_OK(pdb_update_group_mapping_entry(&map));
736 /********************************************************************
737 Really just intended to be called by smbd
738 ********************************************************************/
740 NTSTATUS pdb_create_builtin_alias(uint32 rid)
743 enum lsa_SidType type;
748 const char *name = NULL;
751 DEBUG(10, ("Trying to create builtin alias %d\n", rid));
753 if ( !sid_compose( &sid, &global_sid_Builtin, rid ) ) {
754 return NT_STATUS_NO_SUCH_ALIAS;
757 if ( (mem_ctx = talloc_new(NULL)) == NULL ) {
758 return NT_STATUS_NO_MEMORY;
761 if ( !lookup_sid(mem_ctx, &sid, NULL, &name, &type) ) {
762 TALLOC_FREE( mem_ctx );
763 return NT_STATUS_NO_SUCH_ALIAS;
766 /* validate RID so copy the name and move on */
768 fstrcpy( groupname, name );
769 TALLOC_FREE( mem_ctx );
771 if (!winbind_allocate_gid(&gid)) {
772 DEBUG(3, ("pdb_create_builtin_alias: Could not get a gid out of winbind\n"));
773 return NT_STATUS_ACCESS_DENIED;
776 DEBUG(10,("Creating alias %s with gid %u\n", groupname, (unsigned int)gid));
779 sid_copy(&map.sid, &sid);
780 map.sid_name_use = SID_NAME_ALIAS;
781 strlcpy(map.nt_name, groupname, sizeof(map.nt_name));
782 strlcpy(map.comment, "", sizeof(map.comment));
784 status = pdb_add_group_mapping_entry(&map);
786 if (!NT_STATUS_IS_OK(status)) {
787 DEBUG(0, ("pdb_create_builtin_alias: Could not add group mapping entry for alias %d "
788 "(%s)\n", rid, nt_errstr(status)));