2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-2000,
5 * Copyright (C) Jean François Micouleau 1998-2001.
6 * Copyright (C) Gerald Carter 2003,
7 * Copyright (C) Volker Lendecke 2004
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 3 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, see <http://www.gnu.org/licenses/>.
25 #include "system/passwd.h"
26 #include "utils/net.h"
27 #include "../libcli/security/security.h"
30 /*********************************************************
31 Figure out if the input was an NT group or a SID string.
33 **********************************************************/
34 static bool get_sid_from_input(struct dom_sid *sid, char *input)
38 map = talloc_zero(NULL, GROUP_MAP);
43 if (strncasecmp_m( input, "S-", 2)) {
44 /* Perhaps its the NT group name? */
45 if (!pdb_getgrnam(map, input)) {
46 printf(_("NT Group %s doesn't exist in mapping DB\n"),
54 if (!string_to_sid(sid, input)) {
55 printf(_("converting sid %s from a string failed!\n"),
65 /*********************************************************
66 Dump a GROUP_MAP entry to stdout (long or short listing)
67 **********************************************************/
69 static void print_map_entry (const GROUP_MAP *map, bool long_list)
72 d_printf("%s (%s) -> %s\n", map->nt_name,
73 sid_string_tos(&map->sid), gidtoname(map->gid));
75 d_printf("%s\n", map->nt_name);
76 d_printf(_("\tSID : %s\n"), sid_string_tos(&map->sid));
77 d_printf(_("\tUnix gid : %u\n"), (unsigned int)map->gid);
78 d_printf(_("\tUnix group: %s\n"), gidtoname(map->gid));
79 d_printf(_("\tGroup type: %s\n"),
80 sid_type_lookup(map->sid_name_use));
81 d_printf(_("\tComment : %s\n"), map->comment);
85 /*********************************************************
87 **********************************************************/
88 static int net_groupmap_list(struct net_context *c, int argc, const char **argv)
91 bool long_list = false;
94 fstring sid_string = "";
95 const char list_usage_str[] = N_("net groupmap list [verbose] "
96 "[ntgroup=NT group] [sid=SID]\n"
97 " verbose\tPrint verbose list\n"
98 " ntgroup\tNT group to list\n"
99 " sid\tSID of group to list");
101 if (c->display_usage) {
102 d_printf("%s\n%s\n", _("Usage: "), list_usage_str);
106 if (c->opt_verbose || c->opt_long_list_entries)
109 /* get the options */
110 for ( i=0; i<argc; i++ ) {
111 if ( !strcasecmp_m(argv[i], "verbose")) {
114 else if ( !strncasecmp_m(argv[i], "ntgroup", strlen("ntgroup")) ) {
115 fstrcpy( ntgroup, get_string_param( argv[i] ) );
117 d_fprintf(stderr, _("must supply a name\n"));
121 else if ( !strncasecmp_m(argv[i], "sid", strlen("sid")) ) {
122 fstrcpy( sid_string, get_string_param( argv[i] ) );
123 if ( !sid_string[0] ) {
124 d_fprintf(stderr, _("must supply a SID\n"));
129 d_fprintf(stderr, _("Bad option: %s\n"), argv[i]);
130 d_printf("%s\n%s\n", _("Usage:"), list_usage_str);
135 /* list a single group is given a name */
136 if ( ntgroup[0] || sid_string[0] ) {
141 strlcpy(ntgroup, sid_string, sizeof(ntgroup));
143 if (!get_sid_from_input(&sid, ntgroup)) {
147 map = talloc_zero(NULL, GROUP_MAP);
152 /* Get the current mapping from the database */
153 if(!pdb_getgrsid(map, sid)) {
155 _("Failure to local group SID in the "
161 print_map_entry(map, long_list );
165 GROUP_MAP **maps = NULL;
167 /* enumerate all group mappings */
168 ok = pdb_enum_group_mapping(NULL, SID_NAME_UNKNOWN,
175 for (i=0; i<entries; i++) {
176 print_map_entry(maps[i], long_list);
185 /*********************************************************
186 Add a new group mapping entry
187 **********************************************************/
189 static int net_groupmap_add(struct net_context *c, int argc, const char **argv)
192 fstring ntgroup = "";
193 fstring unixgrp = "";
194 fstring string_sid = "";
196 fstring ntcomment = "";
197 enum lsa_SidType sid_type = SID_NAME_DOM_GRP;
203 const char *name_type;
204 const char add_usage_str[] = N_("net groupmap add "
205 "{rid=<int>|sid=<string>}"
206 " unixgroup=<string> "
207 "[type=<domain|local|builtin>] "
208 "[ntgroup=<string>] "
209 "[comment=<string>]");
211 name_type = "domain group";
213 if (c->display_usage) {
214 d_printf("%s\n%s\n", _("Usage:\n"), add_usage_str);
218 /* get the options */
219 for ( i=0; i<argc; i++ ) {
220 if ( !strncasecmp_m(argv[i], "rid", strlen("rid")) ) {
221 rid = get_int_param(argv[i]);
222 if ( rid < DOMAIN_RID_ADMINS ) {
224 _("RID must be greater than %d\n"),
225 (uint32)DOMAIN_RID_ADMINS-1);
229 else if ( !strncasecmp_m(argv[i], "unixgroup", strlen("unixgroup")) ) {
230 fstrcpy( unixgrp, get_string_param( argv[i] ) );
232 d_fprintf(stderr,_( "must supply a name\n"));
236 else if ( !strncasecmp_m(argv[i], "ntgroup", strlen("ntgroup")) ) {
237 fstrcpy( ntgroup, get_string_param( argv[i] ) );
239 d_fprintf(stderr, _("must supply a name\n"));
243 else if ( !strncasecmp_m(argv[i], "sid", strlen("sid")) ) {
244 fstrcpy( string_sid, get_string_param( argv[i] ) );
245 if ( !string_sid[0] ) {
246 d_fprintf(stderr, _("must supply a SID\n"));
250 else if ( !strncasecmp_m(argv[i], "comment", strlen("comment")) ) {
251 fstrcpy( ntcomment, get_string_param( argv[i] ) );
252 if ( !ntcomment[0] ) {
254 _("must supply a comment string\n"));
258 else if ( !strncasecmp_m(argv[i], "type", strlen("type")) ) {
259 fstrcpy( type, get_string_param( argv[i] ) );
263 sid_type = SID_NAME_WKN_GRP;
264 name_type = "wellknown group";
268 sid_type = SID_NAME_DOM_GRP;
269 name_type = "domain group";
273 sid_type = SID_NAME_ALIAS;
274 name_type = "alias (local) group";
278 _("unknown group type %s\n"),
284 d_fprintf(stderr, _("Bad option: %s\n"), argv[i]);
290 d_printf("%s\n%s\n", _("Usage:\n"), add_usage_str);
294 if ( (gid = nametogid(unixgrp)) == (gid_t)-1 ) {
295 d_fprintf(stderr, _("Can't lookup UNIX group %s\n"), unixgrp);
299 map = talloc_zero(NULL, GROUP_MAP);
303 /* Default is domain group. */
304 map->sid_name_use = SID_NAME_DOM_GRP;
305 if (pdb_getgrgid(map, gid)) {
306 d_printf(_("Unix group %s already mapped to SID %s\n"),
307 unixgrp, sid_string_tos(&map->sid));
313 if ( (rid == 0) && (string_sid[0] == '\0') ) {
314 d_printf(_("No rid or sid specified, choosing a RID\n"));
315 if (pdb_capabilities() & PDB_CAP_STORE_RIDS) {
316 if (!pdb_new_rid(&rid)) {
317 d_printf(_("Could not get new RID\n"));
320 rid = algorithmic_pdb_gid_to_group_rid(gid);
322 d_printf(_("Got RID %d\n"), rid);
325 /* append the rid to our own domain/machine SID if we don't have a full SID */
326 if ( !string_sid[0] ) {
327 sid_compose(&sid, get_global_sam_sid(), rid);
328 sid_to_fstring(string_sid, &sid);
333 case SID_NAME_WKN_GRP:
334 fstrcpy(ntcomment, "Wellknown Unix group");
336 case SID_NAME_DOM_GRP:
337 fstrcpy(ntcomment, "Domain Unix group");
340 fstrcpy(ntcomment, "Local Unix group");
343 fstrcpy(ntcomment, "Unix group");
349 strlcpy(ntgroup, unixgrp, sizeof(ntgroup));
351 if (!NT_STATUS_IS_OK(add_initial_entry(gid, string_sid, sid_type, ntgroup, ntcomment))) {
352 d_fprintf(stderr, _("adding entry for group %s failed!\n"), ntgroup);
356 d_printf(_("Successfully added group %s to the mapping db as a %s\n"),
361 static int net_groupmap_modify(struct net_context *c, int argc, const char **argv)
364 GROUP_MAP *map = NULL;
365 fstring ntcomment = "";
367 fstring ntgroup = "";
368 fstring unixgrp = "";
369 fstring sid_string = "";
370 enum lsa_SidType sid_type = SID_NAME_UNKNOWN;
373 const char modify_usage_str[] = N_("net groupmap modify "
374 "{ntgroup=<string>|sid=<SID>} "
375 "[comment=<string>] "
376 "[unixgroup=<string>] "
377 "[type=<domain|local>]");
379 if (c->display_usage) {
380 d_printf("%s\n%s\n", _("Usage:\n"), modify_usage_str);
384 /* get the options */
385 for ( i=0; i<argc; i++ ) {
386 if ( !strncasecmp_m(argv[i], "ntgroup", strlen("ntgroup")) ) {
387 fstrcpy( ntgroup, get_string_param( argv[i] ) );
389 d_fprintf(stderr, _("must supply a name\n"));
393 else if ( !strncasecmp_m(argv[i], "sid", strlen("sid")) ) {
394 fstrcpy( sid_string, get_string_param( argv[i] ) );
395 if ( !sid_string[0] ) {
396 d_fprintf(stderr, _("must supply a name\n"));
400 else if ( !strncasecmp_m(argv[i], "comment", strlen("comment")) ) {
401 fstrcpy( ntcomment, get_string_param( argv[i] ) );
402 if ( !ntcomment[0] ) {
404 _("must supply a comment string\n"));
408 else if ( !strncasecmp_m(argv[i], "unixgroup", strlen("unixgroup")) ) {
409 fstrcpy( unixgrp, get_string_param( argv[i] ) );
412 _("must supply a group name\n"));
416 else if ( !strncasecmp_m(argv[i], "type", strlen("type")) ) {
417 fstrcpy( type, get_string_param( argv[i] ) );
421 sid_type = SID_NAME_DOM_GRP;
425 sid_type = SID_NAME_ALIAS;
430 d_fprintf(stderr, _("Bad option: %s\n"), argv[i]);
435 if ( !ntgroup[0] && !sid_string[0] ) {
436 d_printf("%s\n%s\n", _("Usage:\n"), modify_usage_str);
440 /* give preference to the SID; if both the ntgroup name and SID
441 are defined, use the SID and assume that the group name could be a
444 if ( sid_string[0] ) {
445 if (!get_sid_from_input(&sid, sid_string)) {
450 if (!get_sid_from_input(&sid, ntgroup)) {
455 map = talloc_zero(NULL, GROUP_MAP);
460 /* Get the current mapping from the database */
461 if(!pdb_getgrsid(map, sid)) {
463 _("Failed to find local group SID in the database\n"));
469 * Allow changing of group type only between domain and local
470 * We disallow changing Builtin groups !!! (SID problem)
472 if (sid_type == SID_NAME_UNKNOWN) {
473 d_fprintf(stderr, _("Can't map to an unknown group type.\n"));
478 if (map->sid_name_use == SID_NAME_WKN_GRP) {
480 _("You can only change between domain and local "
486 map->sid_name_use = sid_type;
488 /* Change comment if new one */
490 map->comment = talloc_strdup(map, ntcomment);
492 d_fprintf(stderr, _("Out of memory!\n"));
498 map->nt_name = talloc_strdup(map, ntgroup);
500 d_fprintf(stderr, _("Out of memory!\n"));
506 gid = nametogid( unixgrp );
508 d_fprintf(stderr, _("Unable to lookup UNIX group %s. "
509 "Make sure the group exists.\n"),
518 if (!NT_STATUS_IS_OK(pdb_update_group_mapping_entry(map))) {
519 d_fprintf(stderr, _("Could not update group database\n"));
524 d_printf(_("Updated mapping entry for %s\n"), map->nt_name);
530 static int net_groupmap_delete(struct net_context *c, int argc, const char **argv)
533 fstring ntgroup = "";
534 fstring sid_string = "";
536 const char delete_usage_str[] = N_("net groupmap delete "
537 "{ntgroup=<string>|sid=<SID>}");
539 if (c->display_usage) {
540 d_printf("%s\n%s\n", _("Usage:\n"), delete_usage_str);
544 /* get the options */
545 for ( i=0; i<argc; i++ ) {
546 if ( !strncasecmp_m(argv[i], "ntgroup", strlen("ntgroup")) ) {
547 fstrcpy( ntgroup, get_string_param( argv[i] ) );
549 d_fprintf(stderr, _("must supply a name\n"));
553 else if ( !strncasecmp_m(argv[i], "sid", strlen("sid")) ) {
554 fstrcpy( sid_string, get_string_param( argv[i] ) );
555 if ( !sid_string[0] ) {
556 d_fprintf(stderr, _("must supply a SID\n"));
561 d_fprintf(stderr, _("Bad option: %s\n"), argv[i]);
566 if ( !ntgroup[0] && !sid_string[0]) {
567 d_printf("%s\n%s\n", _("Usage:\n"), delete_usage_str);
571 /* give preference to the SID if we have that */
574 strlcpy(ntgroup, sid_string, sizeof(ntgroup));
576 if ( !get_sid_from_input(&sid, ntgroup) ) {
577 d_fprintf(stderr, _("Unable to resolve group %s to a SID\n"),
582 if ( !NT_STATUS_IS_OK(pdb_delete_group_mapping_entry(sid)) ) {
584 _("Failed to remove group %s from the mapping db!\n"),
589 d_printf(_("Successfully removed %s from the mapping db\n"), ntgroup);
594 static int net_groupmap_set(struct net_context *c, int argc, const char **argv)
596 const char *ntgroup = NULL;
597 struct group *grp = NULL;
599 bool have_map = false;
601 if ((argc < 1) || (argc > 2) || c->display_usage) {
604 _(" net groupmap set \"NT Group\" "
605 "[\"unix group\"] [-C \"comment\"] [-L] [-D]\n"));
609 if ( c->opt_localgroup && c->opt_domaingroup ) {
610 d_printf(_("Can only specify -L or -D, not both\n"));
617 grp = getgrnam(argv[1]);
620 d_fprintf(stderr, _("Could not find unix group %s\n"),
626 map = talloc_zero(NULL, GROUP_MAP);
628 d_printf(_("Out of memory!\n"));
632 have_map = pdb_getgrnam(map, ntgroup);
636 have_map = ( (strncmp(ntgroup, "S-", 2) == 0) &&
637 string_to_sid(&sid, ntgroup) &&
638 pdb_getgrsid(map, sid) );
647 _("Could not find group mapping for %s\n"),
653 map->gid = grp->gr_gid;
655 if (c->opt_rid == 0) {
656 if ( pdb_capabilities() & PDB_CAP_STORE_RIDS ) {
657 if ( !pdb_new_rid((uint32*)&c->opt_rid) ) {
659 _("Could not allocate new RID\n"));
664 c->opt_rid = algorithmic_pdb_gid_to_group_rid(map->gid);
668 sid_compose(&map->sid, get_global_sam_sid(), c->opt_rid);
670 map->sid_name_use = SID_NAME_DOM_GRP;
671 map->nt_name = talloc_strdup(map, ntgroup);
672 map->comment = talloc_strdup(map, "");
673 if (!map->nt_name || !map->comment) {
674 d_printf(_("Out of memory!\n"));
679 if (!NT_STATUS_IS_OK(pdb_add_group_mapping_entry(map))) {
681 _("Could not add mapping entry for %s\n"),
688 /* Now we have a mapping entry, update that stuff */
690 if ( c->opt_localgroup || c->opt_domaingroup ) {
691 if (map->sid_name_use == SID_NAME_WKN_GRP) {
693 _("Can't change type of the BUILTIN "
701 if (c->opt_localgroup)
702 map->sid_name_use = SID_NAME_ALIAS;
704 if (c->opt_domaingroup)
705 map->sid_name_use = SID_NAME_DOM_GRP;
707 /* The case (opt_domaingroup && opt_localgroup) was tested for above */
709 if ((c->opt_comment != NULL) && (strlen(c->opt_comment) > 0)) {
710 map->comment = talloc_strdup(map, c->opt_comment);
712 d_printf(_("Out of memory!\n"));
718 if ((c->opt_newntname != NULL) && (strlen(c->opt_newntname) > 0)) {
719 map->nt_name = talloc_strdup(map, c->opt_newntname);
721 d_printf(_("Out of memory!\n"));
728 map->gid = grp->gr_gid;
730 if (!NT_STATUS_IS_OK(pdb_update_group_mapping_entry(map))) {
731 d_fprintf(stderr, _("Could not update group mapping for %s\n"),
741 static int net_groupmap_cleanup(struct net_context *c, int argc, const char **argv)
743 GROUP_MAP **maps = NULL;
746 if (c->display_usage) {
748 "net groupmap cleanup\n"
751 _("Delete all group mappings"));
755 if (!pdb_enum_group_mapping(NULL, SID_NAME_UNKNOWN, &maps, &entries,
757 d_fprintf(stderr, _("Could not list group mappings\n"));
761 for (i=0; i<entries; i++) {
763 if (maps[i]->gid == -1)
764 printf(_("Group %s is not mapped\n"),
767 if (!sid_check_is_in_our_sam(&maps[i]->sid)) {
768 printf(_("Deleting mapping for NT Group %s, sid %s\n"),
770 sid_string_tos(&maps[i]->sid));
771 pdb_delete_group_mapping_entry(maps[i]->sid);
779 static int net_groupmap_addmem(struct net_context *c, int argc, const char **argv)
781 struct dom_sid alias, member;
785 !string_to_sid(&alias, argv[0]) ||
786 !string_to_sid(&member, argv[1]) ) {
789 _("net groupmap addmem alias-sid member-sid\n"));
793 if (!NT_STATUS_IS_OK(pdb_add_aliasmem(&alias, &member))) {
794 d_fprintf(stderr, _("Could not add sid %s to alias %s\n"),
802 static int net_groupmap_delmem(struct net_context *c, int argc, const char **argv)
804 struct dom_sid alias, member;
808 !string_to_sid(&alias, argv[0]) ||
809 !string_to_sid(&member, argv[1]) ) {
812 _("net groupmap delmem alias-sid member-sid\n"));
816 if (!NT_STATUS_IS_OK(pdb_del_aliasmem(&alias, &member))) {
817 d_fprintf(stderr, _("Could not delete sid %s from alias %s\n"),
825 static int net_groupmap_listmem(struct net_context *c, int argc, const char **argv)
827 struct dom_sid alias;
828 struct dom_sid *members;
833 !string_to_sid(&alias, argv[0]) ) {
836 _("net groupmap listmem alias-sid\n"));
843 if (!NT_STATUS_IS_OK(pdb_enum_aliasmem(&alias, talloc_tos(),
845 d_fprintf(stderr, _("Could not list members for sid %s\n"),
850 for (i = 0; i < num; i++) {
851 printf("%s\n", sid_string_tos(&(members[i])));
854 TALLOC_FREE(members);
859 static bool print_alias_memberships(TALLOC_CTX *mem_ctx,
860 const struct dom_sid *domain_sid,
861 const struct dom_sid *member)
864 size_t i, num_alias_rids;
869 if (!NT_STATUS_IS_OK(pdb_enum_alias_memberships(
870 mem_ctx, domain_sid, member, 1,
871 &alias_rids, &num_alias_rids))) {
872 d_fprintf(stderr, _("Could not list memberships for sid %s\n"),
873 sid_string_tos(member));
877 for (i = 0; i < num_alias_rids; i++) {
878 struct dom_sid alias;
879 sid_compose(&alias, domain_sid, alias_rids[i]);
880 printf("%s\n", sid_string_tos(&alias));
886 static int net_groupmap_memberships(struct net_context *c, int argc, const char **argv)
889 struct dom_sid *domain_sid, member;
893 !string_to_sid(&member, argv[0]) ) {
896 _("net groupmap memberships sid\n"));
900 mem_ctx = talloc_init("net_groupmap_memberships");
901 if (mem_ctx == NULL) {
902 d_fprintf(stderr, _("talloc_init failed\n"));
906 domain_sid = get_global_sam_sid();
907 if (domain_sid == NULL) {
908 d_fprintf(stderr, _("Could not get domain sid\n"));
912 if (!print_alias_memberships(mem_ctx, domain_sid, &member) ||
913 !print_alias_memberships(mem_ctx, &global_sid_Builtin, &member))
916 talloc_destroy(mem_ctx);
921 /***********************************************************
922 migrated functionality from smbgroupedit
923 **********************************************************/
924 int net_groupmap(struct net_context *c, int argc, const char **argv)
926 struct functable func[] = {
931 N_("Create a new group mapping"),
932 N_("net groupmap add\n"
933 " Create a new group mapping")
939 N_("Update a group mapping"),
940 N_("net groupmap modify\n"
941 " Modify an existing group mapping")
947 N_("Remove a group mapping"),
948 N_("net groupmap delete\n"
949 " Remove a group mapping")
955 N_("Set group mapping"),
956 N_("net groupmap set\n"
957 " Set a group mapping")
961 net_groupmap_cleanup,
963 N_("Remove foreign group mapping entries"),
964 N_("net groupmap cleanup\n"
965 " Remove foreign group mapping entries")
971 N_("Add a foreign alias member"),
972 N_("net groupmap addmem\n"
973 " Add a foreign alias member")
979 N_("Delete foreign alias member"),
980 N_("net groupmap delmem\n"
981 " Delete foreign alias member")
985 net_groupmap_listmem,
987 N_("List foreign group members"),
988 N_("net groupmap listmem\n"
989 " List foreign alias members")
993 net_groupmap_memberships,
995 N_("List foreign group memberships"),
996 N_("net groupmap memberships\n"
997 " List foreign group memberships")
1002 NET_TRANSPORT_LOCAL,
1003 N_("List current group map"),
1004 N_("net groupmap list\n"
1005 " List current group map")
1007 {NULL, NULL, 0, NULL, NULL}
1010 return net_run_function(c,argc, argv, "net groupmap", func);