2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-2000,
5 * Copyright (C) Jean François Micouleau 1998-2001.
6 * Copyright (C) Volker Lendecke 2006.
7 * Copyright (C) Gerald Carter 2006.
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 3 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, see <http://www.gnu.org/licenses/>.
24 #include "groupdb/mapping.h"
26 static const struct mapping_backend *backend;
29 initialise a group mapping backend
31 static BOOL init_group_mapping(void)
33 if (backend != NULL) {
34 /* already initialised */
38 backend = groupdb_ldb_init();
40 return backend != NULL;
43 /****************************************************************************
44 initialise first time the mapping list
45 ****************************************************************************/
46 NTSTATUS add_initial_entry(gid_t gid, const char *sid, enum lsa_SidType sid_name_use, const char *nt_name, const char *comment)
50 if(!init_group_mapping()) {
51 DEBUG(0,("failed to initialize group mapping\n"));
52 return NT_STATUS_UNSUCCESSFUL;
56 if (!string_to_sid(&map.sid, sid)) {
57 DEBUG(0, ("string_to_sid failed: %s", sid));
58 return NT_STATUS_UNSUCCESSFUL;
61 map.sid_name_use=sid_name_use;
62 fstrcpy(map.nt_name, nt_name);
63 fstrcpy(map.comment, comment);
65 return pdb_add_group_mapping_entry(&map);
68 static NTSTATUS alias_memberships(const DOM_SID *members, size_t num_members,
69 DOM_SID **sids, size_t *num)
76 for (i=0; i<num_members; i++) {
77 NTSTATUS status = backend->one_alias_membership(&members[i], sids, num);
78 if (!NT_STATUS_IS_OK(status))
84 struct aliasmem_closure {
94 * High level functions
95 * better to use them than the lower ones.
97 * we are checking if the group is in the mapping file
98 * and if the group is an existing unix group
102 /* get a domain group from it's SID */
104 BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map)
109 if(!init_group_mapping()) {
110 DEBUG(0,("failed to initialize group mapping\n"));
114 DEBUG(10, ("get_domain_group_from_sid\n"));
116 /* if the group is NOT in the database, it CAN NOT be a domain group */
119 ret = pdb_getgrsid(map, sid);
122 /* special case check for rid 513 */
127 sid_peek_rid( &sid, &rid );
129 if ( rid == DOMAIN_GROUP_RID_USERS ) {
130 fstrcpy( map->nt_name, "None" );
131 fstrcpy( map->comment, "Ordinary Users" );
132 sid_copy( &map->sid, &sid );
133 map->sid_name_use = SID_NAME_DOM_GRP;
134 map->gid = (gid_t)-1;
142 DEBUG(10, ("get_domain_group_from_sid: SID found in the TDB\n"));
144 /* if it's not a domain group, continue */
145 if (map->sid_name_use!=SID_NAME_DOM_GRP) {
149 DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
155 DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid));
157 grp = getgrgid(map->gid);
159 DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n"));
163 DEBUG(10, ("get_domain_group_from_sid: gid exists in UNIX security\n"));
168 /****************************************************************************
169 Create a UNIX group on demand.
170 ****************************************************************************/
172 int smb_create_group(const char *unix_group, gid_t *new_gid)
180 /* defer to scripts */
182 if ( *lp_addgroup_script() ) {
183 pstrcpy(add_script, lp_addgroup_script());
184 pstring_sub(add_script, "%g", unix_group);
185 ret = smbrun(add_script, &fd);
186 DEBUG(ret ? 0 : 3,("smb_create_group: Running the command `%s' gave %d\n",add_script,ret));
188 smb_nscd_flush_group_cache();
197 if (read(fd, output, sizeof(output)) > 0) {
198 *new_gid = (gid_t)strtoul(output, NULL, 10);
207 struct group *grp = getgrnam(unix_group);
210 *new_gid = grp->gr_gid;
216 /****************************************************************************
217 Delete a UNIX group on demand.
218 ****************************************************************************/
220 int smb_delete_group(const char *unix_group)
225 /* defer to scripts */
227 if ( *lp_delgroup_script() ) {
228 pstrcpy(del_script, lp_delgroup_script());
229 pstring_sub(del_script, "%g", unix_group);
230 ret = smbrun(del_script,NULL);
231 DEBUG(ret ? 0 : 3,("smb_delete_group: Running the command `%s' gave %d\n",del_script,ret));
233 smb_nscd_flush_group_cache();
241 /****************************************************************************
242 Set a user's primary UNIX group.
243 ****************************************************************************/
244 int smb_set_primary_group(const char *unix_group, const char* unix_user)
249 /* defer to scripts */
251 if ( *lp_setprimarygroup_script() ) {
252 pstrcpy(add_script, lp_setprimarygroup_script());
253 all_string_sub(add_script, "%g", unix_group, sizeof(add_script));
254 all_string_sub(add_script, "%u", unix_user, sizeof(add_script));
255 ret = smbrun(add_script,NULL);
257 DEBUG(ret ? 0 : 3,("smb_set_primary_group: "
258 "Running the command `%s' gave %d\n",add_script,ret));
260 smb_nscd_flush_group_cache();
268 /****************************************************************************
269 Add a user to a UNIX group.
270 ****************************************************************************/
272 int smb_add_user_group(const char *unix_group, const char *unix_user)
277 /* defer to scripts */
279 if ( *lp_addusertogroup_script() ) {
280 pstrcpy(add_script, lp_addusertogroup_script());
281 pstring_sub(add_script, "%g", unix_group);
282 pstring_sub(add_script, "%u", unix_user);
283 ret = smbrun(add_script,NULL);
284 DEBUG(ret ? 0 : 3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script,ret));
286 smb_nscd_flush_group_cache();
294 /****************************************************************************
295 Delete a user from a UNIX group
296 ****************************************************************************/
298 int smb_delete_user_group(const char *unix_group, const char *unix_user)
303 /* defer to scripts */
305 if ( *lp_deluserfromgroup_script() ) {
306 pstrcpy(del_script, lp_deluserfromgroup_script());
307 pstring_sub(del_script, "%g", unix_group);
308 pstring_sub(del_script, "%u", unix_user);
309 ret = smbrun(del_script,NULL);
310 DEBUG(ret ? 0 : 3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script,ret));
312 smb_nscd_flush_group_cache();
321 NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
324 if (!init_group_mapping()) {
325 DEBUG(0,("failed to initialize group mapping\n"));
326 return NT_STATUS_UNSUCCESSFUL;
328 return backend->get_group_map_from_sid(sid, map) ?
329 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
332 NTSTATUS pdb_default_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
335 if (!init_group_mapping()) {
336 DEBUG(0,("failed to initialize group mapping\n"));
337 return NT_STATUS_UNSUCCESSFUL;
339 return backend->get_group_map_from_gid(gid, map) ?
340 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
343 NTSTATUS pdb_default_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
346 if (!init_group_mapping()) {
347 DEBUG(0,("failed to initialize group mapping\n"));
348 return NT_STATUS_UNSUCCESSFUL;
350 return backend->get_group_map_from_ntname(name, map) ?
351 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
354 NTSTATUS pdb_default_add_group_mapping_entry(struct pdb_methods *methods,
357 if (!init_group_mapping()) {
358 DEBUG(0,("failed to initialize group mapping\n"));
359 return NT_STATUS_UNSUCCESSFUL;
361 return backend->add_mapping_entry(map, TDB_INSERT) ?
362 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
365 NTSTATUS pdb_default_update_group_mapping_entry(struct pdb_methods *methods,
368 if (!init_group_mapping()) {
369 DEBUG(0,("failed to initialize group mapping\n"));
370 return NT_STATUS_UNSUCCESSFUL;
372 return backend->add_mapping_entry(map, TDB_REPLACE) ?
373 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
376 NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods,
379 if (!init_group_mapping()) {
380 DEBUG(0,("failed to initialize group mapping\n"));
381 return NT_STATUS_UNSUCCESSFUL;
383 return backend->group_map_remove(&sid) ?
384 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
387 NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
388 const DOM_SID *sid, enum lsa_SidType sid_name_use,
389 GROUP_MAP **pp_rmap, size_t *p_num_entries,
392 if (!init_group_mapping()) {
393 DEBUG(0,("failed to initialize group mapping\n"));
394 return NT_STATUS_UNSUCCESSFUL;
396 return backend->enum_group_mapping(sid, sid_name_use, pp_rmap, p_num_entries, unix_only) ?
397 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
400 NTSTATUS pdb_default_create_alias(struct pdb_methods *methods,
401 const char *name, uint32 *rid)
404 enum lsa_SidType type;
412 DEBUG(10, ("Trying to create alias %s\n", name));
414 mem_ctx = talloc_new(NULL);
415 if (mem_ctx == NULL) {
416 return NT_STATUS_NO_MEMORY;
419 exists = lookup_name(mem_ctx, name, LOOKUP_NAME_ISOLATED,
420 NULL, NULL, &sid, &type);
421 TALLOC_FREE(mem_ctx);
424 return NT_STATUS_ALIAS_EXISTS;
427 if (!winbind_allocate_gid(&gid)) {
428 DEBUG(3, ("Could not get a gid out of winbind\n"));
429 return NT_STATUS_ACCESS_DENIED;
432 if (!pdb_new_rid(&new_rid)) {
433 DEBUG(0, ("Could not allocate a RID -- wasted a gid :-(\n"));
434 return NT_STATUS_ACCESS_DENIED;
437 DEBUG(10, ("Creating alias %s with gid %d and rid %d\n",
438 name, gid, new_rid));
440 sid_copy(&sid, get_global_sam_sid());
441 sid_append_rid(&sid, new_rid);
444 sid_copy(&map.sid, &sid);
445 map.sid_name_use = SID_NAME_ALIAS;
446 fstrcpy(map.nt_name, name);
447 fstrcpy(map.comment, "");
449 status = pdb_add_group_mapping_entry(&map);
451 if (!NT_STATUS_IS_OK(status)) {
452 DEBUG(0, ("Could not add group mapping entry for alias %s "
453 "(%s)\n", name, nt_errstr(status)));
462 NTSTATUS pdb_default_delete_alias(struct pdb_methods *methods,
465 return pdb_delete_group_mapping_entry(*sid);
468 NTSTATUS pdb_default_get_aliasinfo(struct pdb_methods *methods,
470 struct acct_info *info)
474 if (!pdb_getgrsid(&map, *sid))
475 return NT_STATUS_NO_SUCH_ALIAS;
477 if ((map.sid_name_use != SID_NAME_ALIAS) &&
478 (map.sid_name_use != SID_NAME_WKN_GRP)) {
479 DEBUG(2, ("%s is a %s, expected an alias\n",
480 sid_string_static(sid),
481 sid_type_lookup(map.sid_name_use)));
482 return NT_STATUS_NO_SUCH_ALIAS;
485 fstrcpy(info->acct_name, map.nt_name);
486 fstrcpy(info->acct_desc, map.comment);
487 sid_peek_rid(&map.sid, &info->rid);
491 NTSTATUS pdb_default_set_aliasinfo(struct pdb_methods *methods,
493 struct acct_info *info)
497 if (!pdb_getgrsid(&map, *sid))
498 return NT_STATUS_NO_SUCH_ALIAS;
500 fstrcpy(map.nt_name, info->acct_name);
501 fstrcpy(map.comment, info->acct_desc);
503 return pdb_update_group_mapping_entry(&map);
506 NTSTATUS pdb_default_add_aliasmem(struct pdb_methods *methods,
507 const DOM_SID *alias, const DOM_SID *member)
509 if (!init_group_mapping()) {
510 DEBUG(0,("failed to initialize group mapping\n"));
511 return NT_STATUS_UNSUCCESSFUL;
513 return backend->add_aliasmem(alias, member);
516 NTSTATUS pdb_default_del_aliasmem(struct pdb_methods *methods,
517 const DOM_SID *alias, const DOM_SID *member)
519 if (!init_group_mapping()) {
520 DEBUG(0,("failed to initialize group mapping\n"));
521 return NT_STATUS_UNSUCCESSFUL;
523 return backend->del_aliasmem(alias, member);
526 NTSTATUS pdb_default_enum_aliasmem(struct pdb_methods *methods,
527 const DOM_SID *alias, DOM_SID **pp_members,
528 size_t *p_num_members)
530 if (!init_group_mapping()) {
531 DEBUG(0,("failed to initialize group mapping\n"));
532 return NT_STATUS_UNSUCCESSFUL;
534 return backend->enum_aliasmem(alias, pp_members, p_num_members);
537 NTSTATUS pdb_default_alias_memberships(struct pdb_methods *methods,
539 const DOM_SID *domain_sid,
540 const DOM_SID *members,
542 uint32 **pp_alias_rids,
543 size_t *p_num_alias_rids)
546 size_t i, num_alias_sids;
549 if (!init_group_mapping()) {
550 DEBUG(0,("failed to initialize group mapping\n"));
551 return NT_STATUS_UNSUCCESSFUL;
557 result = alias_memberships(members, num_members,
558 &alias_sids, &num_alias_sids);
560 if (!NT_STATUS_IS_OK(result))
563 *p_num_alias_rids = 0;
565 if (num_alias_sids == 0) {
566 TALLOC_FREE(alias_sids);
570 *pp_alias_rids = TALLOC_ARRAY(mem_ctx, uint32, num_alias_sids);
571 if (*pp_alias_rids == NULL)
572 return NT_STATUS_NO_MEMORY;
574 for (i=0; i<num_alias_sids; i++) {
575 if (!sid_peek_check_rid(domain_sid, &alias_sids[i],
576 &(*pp_alias_rids)[*p_num_alias_rids]))
578 *p_num_alias_rids += 1;
581 TALLOC_FREE(alias_sids);
586 /**********************************************************************
587 no ops for passdb backends that don't implement group mapping
588 *********************************************************************/
590 NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
593 return NT_STATUS_UNSUCCESSFUL;
596 NTSTATUS pdb_nop_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
599 return NT_STATUS_UNSUCCESSFUL;
602 NTSTATUS pdb_nop_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
605 return NT_STATUS_UNSUCCESSFUL;
608 NTSTATUS pdb_nop_add_group_mapping_entry(struct pdb_methods *methods,
611 return NT_STATUS_UNSUCCESSFUL;
614 NTSTATUS pdb_nop_update_group_mapping_entry(struct pdb_methods *methods,
617 return NT_STATUS_UNSUCCESSFUL;
620 NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods,
623 return NT_STATUS_UNSUCCESSFUL;
626 NTSTATUS pdb_nop_enum_group_mapping(struct pdb_methods *methods,
627 enum lsa_SidType sid_name_use,
628 GROUP_MAP **rmap, size_t *num_entries,
631 return NT_STATUS_UNSUCCESSFUL;
634 /****************************************************************************
635 These need to be redirected through pdb_interface.c
636 ****************************************************************************/
637 BOOL pdb_get_dom_grp_info(const DOM_SID *sid, struct acct_info *info)
643 res = get_domain_group_from_sid(*sid, &map);
649 fstrcpy(info->acct_name, map.nt_name);
650 fstrcpy(info->acct_desc, map.comment);
651 sid_peek_rid(sid, &info->rid);
655 BOOL pdb_set_dom_grp_info(const DOM_SID *sid, const struct acct_info *info)
659 if (!get_domain_group_from_sid(*sid, &map))
662 fstrcpy(map.nt_name, info->acct_name);
663 fstrcpy(map.comment, info->acct_desc);
665 return NT_STATUS_IS_OK(pdb_update_group_mapping_entry(&map));
668 /********************************************************************
669 Really just intended to be called by smbd
670 ********************************************************************/
672 NTSTATUS pdb_create_builtin_alias(uint32 rid)
675 enum lsa_SidType type;
680 const char *name = NULL;
683 DEBUG(10, ("Trying to create builtin alias %d\n", rid));
685 if ( !sid_compose( &sid, &global_sid_Builtin, rid ) ) {
686 return NT_STATUS_NO_SUCH_ALIAS;
689 if ( (mem_ctx = talloc_new(NULL)) == NULL ) {
690 return NT_STATUS_NO_MEMORY;
693 if ( !lookup_sid(mem_ctx, &sid, NULL, &name, &type) ) {
694 TALLOC_FREE( mem_ctx );
695 return NT_STATUS_NO_SUCH_ALIAS;
698 /* validate RID so copy the name and move on */
700 fstrcpy( groupname, name );
701 TALLOC_FREE( mem_ctx );
703 if (!winbind_allocate_gid(&gid)) {
704 DEBUG(3, ("pdb_create_builtin_alias: Could not get a gid out of winbind\n"));
705 return NT_STATUS_ACCESS_DENIED;
708 DEBUG(10,("Creating alias %s with gid %d\n", name, gid));
711 sid_copy(&map.sid, &sid);
712 map.sid_name_use = SID_NAME_ALIAS;
713 fstrcpy(map.nt_name, name);
714 fstrcpy(map.comment, "");
716 status = pdb_add_group_mapping_entry(&map);
718 if (!NT_STATUS_IS_OK(status)) {
719 DEBUG(0, ("pdb_create_builtin_alias: Could not add group mapping entry for alias %d "
720 "(%s)\n", rid, nt_errstr(status)));