source3/groupdb/mapping.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-2000,
   5  *  Copyright (C) Jean François Micouleau      1998-2001.
   6  *  Copyright (C) Volker Lendecke              2006.
   7  *  Copyright (C) Gerald Carter                2006.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 3 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  21  */
  22
  23 #include "includes.h"
  24 #include "groupdb/mapping.h"
  25
  26 static const struct mapping_backend *backend;
  27
  28 /*
  29   initialise a group mapping backend
  30  */
  31 static BOOL init_group_mapping(void)
  32 {
  33         const char *backend_string;
  34
  35         if (backend != NULL) {
  36                 /* already initialised */
  37                 return True;
  38         }
  39
  40         backend = groupdb_ldb_init();
  41
  42         return backend != NULL;
  43 }
  44
  45 /****************************************************************************
  46 initialise first time the mapping list
  47 ****************************************************************************/
  48 NTSTATUS add_initial_entry(gid_t gid, const char *sid, enum lsa_SidType sid_name_use, const char *nt_name, const char *comment)
  49 {
  50         GROUP_MAP map;
  51
  52         if(!init_group_mapping()) {
  53                 DEBUG(0,("failed to initialize group mapping\n"));
  54                 return NT_STATUS_UNSUCCESSFUL;
  55         }
  56
  57         map.gid=gid;
  58         if (!string_to_sid(&map.sid, sid)) {
  59                 DEBUG(0, ("string_to_sid failed: %s", sid));
  60                 return NT_STATUS_UNSUCCESSFUL;
  61         }
  62
  63         map.sid_name_use=sid_name_use;
  64         fstrcpy(map.nt_name, nt_name);
  65         fstrcpy(map.comment, comment);
  66
  67         return pdb_add_group_mapping_entry(&map);
  68 }
  69
  70 static NTSTATUS alias_memberships(const DOM_SID *members, size_t num_members,
  71                                   DOM_SID **sids, size_t *num)
  72 {
  73         size_t i;
  74
  75         *num = 0;
  76         *sids = NULL;
  77
  78         for (i=0; i<num_members; i++) {
  79                 NTSTATUS status = backend->one_alias_membership(&members[i], sids, num);
  80                 if (!NT_STATUS_IS_OK(status))
  81                         return status;
  82         }
  83         return NT_STATUS_OK;
  84 }
  85
  86 struct aliasmem_closure {
  87         const DOM_SID *alias;
  88         DOM_SID **sids;
  89         size_t *num;
  90 };
  91
  92
  93
  94 /*
  95  *
  96  * High level functions
  97  * better to use them than the lower ones.
  98  *
  99  * we are checking if the group is in the mapping file
 100  * and if the group is an existing unix group
 101  *
 102  */
 103
 104 /* get a domain group from it's SID */
 105
 106 BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map)
 107 {
 108         struct group *grp;
 109         BOOL ret;
 110
 111         if(!init_group_mapping()) {
 112                 DEBUG(0,("failed to initialize group mapping\n"));
 113                 return(False);
 114         }
 115
 116         DEBUG(10, ("get_domain_group_from_sid\n"));
 117
 118         /* if the group is NOT in the database, it CAN NOT be a domain group */
 119
 120         become_root();
 121         ret = pdb_getgrsid(map, sid);
 122         unbecome_root();
 123
 124         /* special case check for rid 513 */
 125
 126         if ( !ret ) {
 127                 uint32 rid;
 128
 129                 sid_peek_rid( &sid, &rid );
 130
 131                 if ( rid == DOMAIN_GROUP_RID_USERS ) {
 132                         fstrcpy( map->nt_name, "None" );
 133                         fstrcpy( map->comment, "Ordinary Users" );
 134                         sid_copy( &map->sid, &sid );
 135                         map->sid_name_use = SID_NAME_DOM_GRP;
 136                         map->gid = (gid_t)-1;
 137
 138                         return True;
 139                 }
 140
 141                 return False;
 142         }
 143
 144         DEBUG(10, ("get_domain_group_from_sid: SID found in the TDB\n"));
 145
 146         /* if it's not a domain group, continue */
 147         if (map->sid_name_use!=SID_NAME_DOM_GRP) {
 148                 return False;
 149         }
 150
 151         DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
 152
 153         if (map->gid==-1) {
 154                 return False;
 155         }
 156
 157         DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid));
 158
 159         grp = getgrgid(map->gid);
 160         if ( !grp ) {
 161                 DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n"));
 162                 return False;
 163         }
 164
 165         DEBUG(10, ("get_domain_group_from_sid: gid exists in UNIX security\n"));
 166
 167         return True;
 168 }
 169
 170 /****************************************************************************
 171  Create a UNIX group on demand.
 172 ****************************************************************************/
 173
 174 int smb_create_group(const char *unix_group, gid_t *new_gid)
 175 {
 176         pstring add_script;
 177         int     ret = -1;
 178         int     fd = 0;
 179
 180         *new_gid = 0;
 181
 182         /* defer to scripts */
 183
 184         if ( *lp_addgroup_script() ) {
 185                 pstrcpy(add_script, lp_addgroup_script());
 186                 pstring_sub(add_script, "%g", unix_group);
 187                 ret = smbrun(add_script, &fd);
 188                 DEBUG(ret ? 0 : 3,("smb_create_group: Running the command `%s' gave %d\n",add_script,ret));
 189                 if (ret == 0) {
 190                         smb_nscd_flush_group_cache();
 191                 }
 192                 if (ret != 0)
 193                         return ret;
 194
 195                 if (fd != 0) {
 196                         fstring output;
 197
 198                         *new_gid = 0;
 199                         if (read(fd, output, sizeof(output)) > 0) {
 200                                 *new_gid = (gid_t)strtoul(output, NULL, 10);
 201                         }
 202
 203                         close(fd);
 204                 }
 205
 206         }
 207
 208         if (*new_gid == 0) {
 209                 struct group *grp = getgrnam(unix_group);
 210
 211                 if (grp != NULL)
 212                         *new_gid = grp->gr_gid;
 213         }
 214
 215         return ret;
 216 }
 217
 218 /****************************************************************************
 219  Delete a UNIX group on demand.
 220 ****************************************************************************/
 221
 222 int smb_delete_group(const char *unix_group)
 223 {
 224         pstring del_script;
 225         int ret;
 226
 227         /* defer to scripts */
 228
 229         if ( *lp_delgroup_script() ) {
 230                 pstrcpy(del_script, lp_delgroup_script());
 231                 pstring_sub(del_script, "%g", unix_group);
 232                 ret = smbrun(del_script,NULL);
 233                 DEBUG(ret ? 0 : 3,("smb_delete_group: Running the command `%s' gave %d\n",del_script,ret));
 234                 if (ret == 0) {
 235                         smb_nscd_flush_group_cache();
 236                 }
 237                 return ret;
 238         }
 239
 240         return -1;
 241 }
 242
 243 /****************************************************************************
 244  Set a user's primary UNIX group.
 245 ****************************************************************************/
 246 int smb_set_primary_group(const char *unix_group, const char* unix_user)
 247 {
 248         pstring add_script;
 249         int ret;
 250
 251         /* defer to scripts */
 252
 253         if ( *lp_setprimarygroup_script() ) {
 254                 pstrcpy(add_script, lp_setprimarygroup_script());
 255                 all_string_sub(add_script, "%g", unix_group, sizeof(add_script));
 256                 all_string_sub(add_script, "%u", unix_user, sizeof(add_script));
 257                 ret = smbrun(add_script,NULL);
 258                 flush_pwnam_cache();
 259                 DEBUG(ret ? 0 : 3,("smb_set_primary_group: "
 260                          "Running the command `%s' gave %d\n",add_script,ret));
 261                 if (ret == 0) {
 262                         smb_nscd_flush_group_cache();
 263                 }
 264                 return ret;
 265         }
 266
 267         return -1;
 268 }
 269
 270 /****************************************************************************
 271  Add a user to a UNIX group.
 272 ****************************************************************************/
 273
 274 int smb_add_user_group(const char *unix_group, const char *unix_user)
 275 {
 276         pstring add_script;
 277         int ret;
 278
 279         /* defer to scripts */
 280
 281         if ( *lp_addusertogroup_script() ) {
 282                 pstrcpy(add_script, lp_addusertogroup_script());
 283                 pstring_sub(add_script, "%g", unix_group);
 284                 pstring_sub(add_script, "%u", unix_user);
 285                 ret = smbrun(add_script,NULL);
 286                 DEBUG(ret ? 0 : 3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script,ret));
 287                 if (ret == 0) {
 288                         smb_nscd_flush_group_cache();
 289                 }
 290                 return ret;
 291         }
 292
 293         return -1;
 294 }
 295
 296 /****************************************************************************
 297  Delete a user from a UNIX group
 298 ****************************************************************************/
 299
 300 int smb_delete_user_group(const char *unix_group, const char *unix_user)
 301 {
 302         pstring del_script;
 303         int ret;
 304
 305         /* defer to scripts */
 306
 307         if ( *lp_deluserfromgroup_script() ) {
 308                 pstrcpy(del_script, lp_deluserfromgroup_script());
 309                 pstring_sub(del_script, "%g", unix_group);
 310                 pstring_sub(del_script, "%u", unix_user);
 311                 ret = smbrun(del_script,NULL);
 312                 DEBUG(ret ? 0 : 3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script,ret));
 313                 if (ret == 0) {
 314                         smb_nscd_flush_group_cache();
 315                 }
 316                 return ret;
 317         }
 318
 319         return -1;
 320 }
 321
 322
 323 NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
 324                                  DOM_SID sid)
 325 {
 326         if (!init_group_mapping()) {
 327                 DEBUG(0,("failed to initialize group mapping\n"));
 328                 return NT_STATUS_UNSUCCESSFUL;
 329         }
 330         return backend->get_group_map_from_sid(sid, map) ?
 331                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 332 }
 333
 334 NTSTATUS pdb_default_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
 335                                  gid_t gid)
 336 {
 337         if (!init_group_mapping()) {
 338                 DEBUG(0,("failed to initialize group mapping\n"));
 339                 return NT_STATUS_UNSUCCESSFUL;
 340         }
 341         return backend->get_group_map_from_gid(gid, map) ?
 342                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 343 }
 344
 345 NTSTATUS pdb_default_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
 346                                  const char *name)
 347 {
 348         if (!init_group_mapping()) {
 349                 DEBUG(0,("failed to initialize group mapping\n"));
 350                 return NT_STATUS_UNSUCCESSFUL;
 351         }
 352         return backend->get_group_map_from_ntname(name, map) ?
 353                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 354 }
 355
 356 NTSTATUS pdb_default_add_group_mapping_entry(struct pdb_methods *methods,
 357                                                 GROUP_MAP *map)
 358 {
 359         if (!init_group_mapping()) {
 360                 DEBUG(0,("failed to initialize group mapping\n"));
 361                 return NT_STATUS_UNSUCCESSFUL;
 362         }
 363         return backend->add_mapping_entry(map, TDB_INSERT) ?
 364                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 365 }
 366
 367 NTSTATUS pdb_default_update_group_mapping_entry(struct pdb_methods *methods,
 368                                                    GROUP_MAP *map)
 369 {
 370         if (!init_group_mapping()) {
 371                 DEBUG(0,("failed to initialize group mapping\n"));
 372                 return NT_STATUS_UNSUCCESSFUL;
 373         }
 374         return backend->add_mapping_entry(map, TDB_REPLACE) ?
 375                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 376 }
 377
 378 NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods,
 379                                                    DOM_SID sid)
 380 {
 381         if (!init_group_mapping()) {
 382                 DEBUG(0,("failed to initialize group mapping\n"));
 383                 return NT_STATUS_UNSUCCESSFUL;
 384         }
 385         return backend->group_map_remove(&sid) ?
 386                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 387 }
 388
 389 NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
 390                                            const DOM_SID *sid, enum lsa_SidType sid_name_use,
 391                                            GROUP_MAP **pp_rmap, size_t *p_num_entries,
 392                                            BOOL unix_only)
 393 {
 394         if (!init_group_mapping()) {
 395                 DEBUG(0,("failed to initialize group mapping\n"));
 396                 return NT_STATUS_UNSUCCESSFUL;
 397         }
 398         return backend->enum_group_mapping(sid, sid_name_use, pp_rmap, p_num_entries, unix_only) ?
 399                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 400 }
 401
 402 NTSTATUS pdb_default_create_alias(struct pdb_methods *methods,
 403                                   const char *name, uint32 *rid)
 404 {
 405         DOM_SID sid;
 406         enum lsa_SidType type;
 407         uint32 new_rid;
 408         gid_t gid;
 409         BOOL exists;
 410         GROUP_MAP map;
 411         TALLOC_CTX *mem_ctx;
 412         NTSTATUS status;
 413
 414         DEBUG(10, ("Trying to create alias %s\n", name));
 415
 416         mem_ctx = talloc_new(NULL);
 417         if (mem_ctx == NULL) {
 418                 return NT_STATUS_NO_MEMORY;
 419         }
 420
 421         exists = lookup_name(mem_ctx, name, LOOKUP_NAME_ISOLATED,
 422                              NULL, NULL, &sid, &type);
 423         TALLOC_FREE(mem_ctx);
 424
 425         if (exists) {
 426                 return NT_STATUS_ALIAS_EXISTS;
 427         }
 428
 429         if (!winbind_allocate_gid(&gid)) {
 430                 DEBUG(3, ("Could not get a gid out of winbind\n"));
 431                 return NT_STATUS_ACCESS_DENIED;
 432         }
 433
 434         if (!pdb_new_rid(&new_rid)) {
 435                 DEBUG(0, ("Could not allocate a RID -- wasted a gid :-(\n"));
 436                 return NT_STATUS_ACCESS_DENIED;
 437         }
 438
 439         DEBUG(10, ("Creating alias %s with gid %d and rid %d\n",
 440                    name, gid, new_rid));
 441
 442         sid_copy(&sid, get_global_sam_sid());
 443         sid_append_rid(&sid, new_rid);
 444
 445         map.gid = gid;
 446         sid_copy(&map.sid, &sid);
 447         map.sid_name_use = SID_NAME_ALIAS;
 448         fstrcpy(map.nt_name, name);
 449         fstrcpy(map.comment, "");
 450
 451         status = pdb_add_group_mapping_entry(&map);
 452
 453         if (!NT_STATUS_IS_OK(status)) {
 454                 DEBUG(0, ("Could not add group mapping entry for alias %s "
 455                           "(%s)\n", name, nt_errstr(status)));
 456                 return status;
 457         }
 458
 459         *rid = new_rid;
 460
 461         return NT_STATUS_OK;
 462 }
 463
 464 NTSTATUS pdb_default_delete_alias(struct pdb_methods *methods,
 465                                   const DOM_SID *sid)
 466 {
 467         return pdb_delete_group_mapping_entry(*sid);
 468 }
 469
 470 NTSTATUS pdb_default_get_aliasinfo(struct pdb_methods *methods,
 471                                    const DOM_SID *sid,
 472                                    struct acct_info *info)
 473 {
 474         GROUP_MAP map;
 475
 476         if (!pdb_getgrsid(&map, *sid))
 477                 return NT_STATUS_NO_SUCH_ALIAS;
 478
 479         if ((map.sid_name_use != SID_NAME_ALIAS) &&
 480             (map.sid_name_use != SID_NAME_WKN_GRP)) {
 481                 DEBUG(2, ("%s is a %s, expected an alias\n",
 482                           sid_string_static(sid),
 483                           sid_type_lookup(map.sid_name_use)));
 484                 return NT_STATUS_NO_SUCH_ALIAS;
 485         }
 486
 487         fstrcpy(info->acct_name, map.nt_name);
 488         fstrcpy(info->acct_desc, map.comment);
 489         sid_peek_rid(&map.sid, &info->rid);
 490         return NT_STATUS_OK;
 491 }
 492
 493 NTSTATUS pdb_default_set_aliasinfo(struct pdb_methods *methods,
 494                                    const DOM_SID *sid,
 495                                    struct acct_info *info)
 496 {
 497         GROUP_MAP map;
 498
 499         if (!pdb_getgrsid(&map, *sid))
 500                 return NT_STATUS_NO_SUCH_ALIAS;
 501
 502         fstrcpy(map.nt_name, info->acct_name);
 503         fstrcpy(map.comment, info->acct_desc);
 504
 505         return pdb_update_group_mapping_entry(&map);
 506 }
 507
 508 NTSTATUS pdb_default_add_aliasmem(struct pdb_methods *methods,
 509                                   const DOM_SID *alias, const DOM_SID *member)
 510 {
 511         if (!init_group_mapping()) {
 512                 DEBUG(0,("failed to initialize group mapping\n"));
 513                 return NT_STATUS_UNSUCCESSFUL;
 514         }
 515         return backend->add_aliasmem(alias, member);
 516 }
 517
 518 NTSTATUS pdb_default_del_aliasmem(struct pdb_methods *methods,
 519                                   const DOM_SID *alias, const DOM_SID *member)
 520 {
 521         if (!init_group_mapping()) {
 522                 DEBUG(0,("failed to initialize group mapping\n"));
 523                 return NT_STATUS_UNSUCCESSFUL;
 524         }
 525         return backend->del_aliasmem(alias, member);
 526 }
 527
 528 NTSTATUS pdb_default_enum_aliasmem(struct pdb_methods *methods,
 529                                    const DOM_SID *alias, DOM_SID **pp_members,
 530                                    size_t *p_num_members)
 531 {
 532         if (!init_group_mapping()) {
 533                 DEBUG(0,("failed to initialize group mapping\n"));
 534                 return NT_STATUS_UNSUCCESSFUL;
 535         }
 536         return backend->enum_aliasmem(alias, pp_members, p_num_members);
 537 }
 538
 539 NTSTATUS pdb_default_alias_memberships(struct pdb_methods *methods,
 540                                        TALLOC_CTX *mem_ctx,
 541                                        const DOM_SID *domain_sid,
 542                                        const DOM_SID *members,
 543                                        size_t num_members,
 544                                        uint32 **pp_alias_rids,
 545                                        size_t *p_num_alias_rids)
 546 {
 547         DOM_SID *alias_sids;
 548         size_t i, num_alias_sids;
 549         NTSTATUS result;
 550
 551         if (!init_group_mapping()) {
 552                 DEBUG(0,("failed to initialize group mapping\n"));
 553                 return NT_STATUS_UNSUCCESSFUL;
 554         }
 555
 556         alias_sids = NULL;
 557         num_alias_sids = 0;
 558
 559         result = alias_memberships(members, num_members,
 560                                    &alias_sids, &num_alias_sids);
 561
 562         if (!NT_STATUS_IS_OK(result))
 563                 return result;
 564
 565         *p_num_alias_rids = 0;
 566
 567         if (num_alias_sids == 0) {
 568                 TALLOC_FREE(alias_sids);
 569                 return NT_STATUS_OK;
 570         }
 571
 572         *pp_alias_rids = TALLOC_ARRAY(mem_ctx, uint32, num_alias_sids);
 573         if (*pp_alias_rids == NULL)
 574                 return NT_STATUS_NO_MEMORY;
 575
 576         for (i=0; i<num_alias_sids; i++) {
 577                 if (!sid_peek_check_rid(domain_sid, &alias_sids[i],
 578                                         &(*pp_alias_rids)[*p_num_alias_rids]))
 579                         continue;
 580                 *p_num_alias_rids += 1;
 581         }
 582
 583         TALLOC_FREE(alias_sids);
 584
 585         return NT_STATUS_OK;
 586 }
 587
 588 /**********************************************************************
 589  no ops for passdb backends that don't implement group mapping
 590  *********************************************************************/
 591
 592 NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
 593                                  DOM_SID sid)
 594 {
 595         return NT_STATUS_UNSUCCESSFUL;
 596 }
 597
 598 NTSTATUS pdb_nop_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
 599                                  gid_t gid)
 600 {
 601         return NT_STATUS_UNSUCCESSFUL;
 602 }
 603
 604 NTSTATUS pdb_nop_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
 605                                  const char *name)
 606 {
 607         return NT_STATUS_UNSUCCESSFUL;
 608 }
 609
 610 NTSTATUS pdb_nop_add_group_mapping_entry(struct pdb_methods *methods,
 611                                                 GROUP_MAP *map)
 612 {
 613         return NT_STATUS_UNSUCCESSFUL;
 614 }
 615
 616 NTSTATUS pdb_nop_update_group_mapping_entry(struct pdb_methods *methods,
 617                                                    GROUP_MAP *map)
 618 {
 619         return NT_STATUS_UNSUCCESSFUL;
 620 }
 621
 622 NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods,
 623                                                    DOM_SID sid)
 624 {
 625         return NT_STATUS_UNSUCCESSFUL;
 626 }
 627
 628 NTSTATUS pdb_nop_enum_group_mapping(struct pdb_methods *methods,
 629                                            enum lsa_SidType sid_name_use,
 630                                            GROUP_MAP **rmap, size_t *num_entries,
 631                                            BOOL unix_only)
 632 {
 633         return NT_STATUS_UNSUCCESSFUL;
 634 }
 635
 636 /****************************************************************************
 637  These need to be redirected through pdb_interface.c
 638 ****************************************************************************/
 639 BOOL pdb_get_dom_grp_info(const DOM_SID *sid, struct acct_info *info)
 640 {
 641         GROUP_MAP map;
 642         BOOL res;
 643
 644         become_root();
 645         res = get_domain_group_from_sid(*sid, &map);
 646         unbecome_root();
 647
 648         if (!res)
 649                 return False;
 650
 651         fstrcpy(info->acct_name, map.nt_name);
 652         fstrcpy(info->acct_desc, map.comment);
 653         sid_peek_rid(sid, &info->rid);
 654         return True;
 655 }
 656
 657 BOOL pdb_set_dom_grp_info(const DOM_SID *sid, const struct acct_info *info)
 658 {
 659         GROUP_MAP map;
 660
 661         if (!get_domain_group_from_sid(*sid, &map))
 662                 return False;
 663
 664         fstrcpy(map.nt_name, info->acct_name);
 665         fstrcpy(map.comment, info->acct_desc);
 666
 667         return NT_STATUS_IS_OK(pdb_update_group_mapping_entry(&map));
 668 }
 669
 670 /********************************************************************
 671  Really just intended to be called by smbd
 672 ********************************************************************/
 673
 674 NTSTATUS pdb_create_builtin_alias(uint32 rid)
 675 {
 676         DOM_SID sid;
 677         enum lsa_SidType type;
 678         gid_t gid;
 679         GROUP_MAP map;
 680         TALLOC_CTX *mem_ctx;
 681         NTSTATUS status;
 682         const char *name = NULL;
 683         fstring groupname;
 684
 685         DEBUG(10, ("Trying to create builtin alias %d\n", rid));
 686
 687         if ( !sid_compose( &sid, &global_sid_Builtin, rid ) ) {
 688                 return NT_STATUS_NO_SUCH_ALIAS;
 689         }
 690
 691         if ( (mem_ctx = talloc_new(NULL)) == NULL ) {
 692                 return NT_STATUS_NO_MEMORY;
 693         }
 694
 695         if ( !lookup_sid(mem_ctx, &sid, NULL, &name, &type) ) {
 696                 TALLOC_FREE( mem_ctx );
 697                 return NT_STATUS_NO_SUCH_ALIAS;
 698         }
 699
 700         /* validate RID so copy the name and move on */
 701
 702         fstrcpy( groupname, name );
 703         TALLOC_FREE( mem_ctx );
 704
 705         if (!winbind_allocate_gid(&gid)) {
 706                 DEBUG(3, ("pdb_create_builtin_alias: Could not get a gid out of winbind\n"));
 707                 return NT_STATUS_ACCESS_DENIED;
 708         }
 709
 710         DEBUG(10,("Creating alias %s with gid %d\n", name, gid));
 711
 712         map.gid = gid;
 713         sid_copy(&map.sid, &sid);
 714         map.sid_name_use = SID_NAME_ALIAS;
 715         fstrcpy(map.nt_name, name);
 716         fstrcpy(map.comment, "");
 717
 718         status = pdb_add_group_mapping_entry(&map);
 719
 720         if (!NT_STATUS_IS_OK(status)) {
 721                 DEBUG(0, ("pdb_create_builtin_alias: Could not add group mapping entry for alias %d "
 722                           "(%s)\n", rid, nt_errstr(status)));
 723         }
 724
 725         return status;
 726 }
 727
 728