source4/lib/samba3/group.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-2000,
   5  *  Copyright (C) Jean François Micouleau      1998-2001.
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License as published by
   9  *  the Free Software Foundation; either version 2 of the License, or
  10  *  (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU General Public License
  18  *  along with this program; if not, write to the Free Software
  19  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20  */
  21
  22 #include "includes.h"
  23 #include "system/iconv.h"
  24 #include "lib/samba3/samba3.h"
  25 #include "lib/tdb/include/tdbutil.h"
  26 #include "system/filesys.h"
  27
  28 #define DATABASE_VERSION_V1 1 /* native byte format. */
  29 #define DATABASE_VERSION_V2 2 /* le format. */
  30
  31 #define GROUP_PREFIX "UNIXGROUP/"
  32
  33 /* Alias memberships are stored reverse, as memberships. The performance
  34  * critical operation is to determine the aliases a SID is member of, not
  35  * listing alias members. So we store a list of alias SIDs a SID is member of
  36  * hanging of the member as key.
  37  */
  38 #define MEMBEROF_PREFIX "MEMBEROF/"
  39
  40 #define ENUM_ONLY_MAPPED True
  41 #define ENUM_ALL_MAPPED False
  42
  43
  44 /****************************************************************************
  45 dump the mapping group mapping to a text file
  46 ****************************************************************************/
  47 static const char *decode_sid_name_use(enum SID_NAME_USE name_use)
  48 {
  49         switch(name_use) {
  50                 case SID_NAME_USER:
  51                         return "User";
  52                 case SID_NAME_DOM_GRP:
  53                         return "Domain group";
  54                 case SID_NAME_DOMAIN:
  55                         return "Domain";
  56                 case SID_NAME_ALIAS:
  57                         return "Local group";
  58                 case SID_NAME_WKN_GRP:
  59                         return "Builtin group";
  60                 case SID_NAME_DELETED:
  61                         return "Deleted";
  62                 case SID_NAME_INVALID:
  63                         return "Invalid";
  64                 case SID_NAME_UNKNOWN:
  65                 default:
  66                         return "Unknown type";
  67         }
  68 }
  69
  70 /****************************************************************************
  71  Open the group mapping tdb.
  72 ****************************************************************************/
  73 static TDB_CONTEXT *tdbgroup_open(const char *file)
  74 {
  75         int32_t vers_id;
  76
  77         TDB_CONTEXT *tdb = tdb_open(file, 0, TDB_DEFAULT, O_RDONLY, 0600);
  78         if (!tdb) {
  79                 DEBUG(0,("Failed to open group mapping database\n"));
  80                 return NULL;
  81         }
  82
  83         /* Cope with byte-reversed older versions of the db. */
  84         vers_id = tdb_fetch_int32(tdb, "INFO/version");
  85         if ((vers_id == DATABASE_VERSION_V1) || (IREV(vers_id) == DATABASE_VERSION_V1)) {
  86                 /* Written on a bigendian machine with old fetch_int code. Save as le. */
  87                 vers_id = DATABASE_VERSION_V2;
  88         }
  89
  90         if (vers_id != DATABASE_VERSION_V2) {
  91                 return NULL;
  92         }
  93
  94         return tdb;
  95 }
  96
  97 /****************************************************************************
  98  Return the sid and the type of the unix group.
  99 ****************************************************************************/
 100
 101 static BOOL get_group_map_from_sid(TDB_CONTEXT *tdb, struct dom_sid sid, struct samba3_groupmapping *map)
 102 {
 103         TDB_DATA kbuf, dbuf;
 104         const char *key;
 105         int ret = 0;
 106
 107         /* the key is the SID, retrieving is direct */
 108
 109         kbuf.dptr = talloc_asprintf(tdb, "%s%s", GROUP_PREFIX, dom_sid_string(tdb, &sid));
 110         kbuf.dsize = strlen(key)+1;
 111
 112         dbuf = tdb_fetch(tdb, kbuf);
 113         if (!dbuf.dptr)
 114                 return False;
 115
 116         ret = tdb_unpack(tdb, dbuf.dptr, dbuf.dsize, "ddff",
 117                 &map->gid, &map->sid_name_use, &map->nt_name, &map->comment);
 118
 119         SAFE_FREE(dbuf.dptr);
 120
 121         if ( ret == -1 ) {
 122                 DEBUG(3,("get_group_map_from_sid: tdb_unpack failure\n"));
 123                 return False;
 124         }
 125
 126         map->sid = dom_sid_dup(tdb, &sid);
 127
 128         return True;
 129 }
 130
 131 /****************************************************************************
 132  Return the sid and the type of the unix group.
 133 ****************************************************************************/
 134
 135 static BOOL get_group_map_from_gid(TDB_CONTEXT *tdb, gid_t gid, struct samba3_groupmapping *map)
 136 {
 137         TDB_DATA kbuf, dbuf, newkey;
 138         int ret;
 139
 140         /* we need to enumerate the TDB to find the GID */
 141
 142         for (kbuf = tdb_firstkey(tdb);
 143              kbuf.dptr;
 144              newkey = tdb_nextkey(tdb, kbuf), safe_free(kbuf.dptr), kbuf=newkey) {
 145
 146                 if (strncmp(kbuf.dptr, GROUP_PREFIX, strlen(GROUP_PREFIX)) != 0) continue;
 147
 148                 dbuf = tdb_fetch(tdb, kbuf);
 149                 if (!dbuf.dptr)
 150                         continue;
 151
 152
 153                 map->sid = dom_sid_parse_talloc(tdb, kbuf.dptr+strlen(GROUP_PREFIX));
 154
 155                 ret = tdb_unpack(tdb, dbuf.dptr, dbuf.dsize, "ddff",
 156                                  &map->gid, &map->sid_name_use, &map->nt_name, &map->comment);
 157
 158                 SAFE_FREE(dbuf.dptr);
 159
 160                 if ( ret == -1 ) {
 161                         DEBUG(3,("get_group_map_from_gid: tdb_unpack failure\n"));
 162                         return False;
 163                 }
 164
 165                 if (gid==map->gid) {
 166                         SAFE_FREE(kbuf.dptr);
 167                         return True;
 168                 }
 169         }
 170
 171         return False;
 172 }
 173
 174 /****************************************************************************
 175  Return the sid and the type of the unix group.
 176 ****************************************************************************/
 177
 178 static BOOL get_group_map_from_ntname(TDB_CONTEXT *tdb, const char *name, struct samba3_groupmapping *map)
 179 {
 180         TDB_DATA kbuf, dbuf, newkey;
 181         int ret;
 182
 183         /* we need to enumerate the TDB to find the name */
 184
 185         for (kbuf = tdb_firstkey(tdb);
 186              kbuf.dptr;
 187              newkey = tdb_nextkey(tdb, kbuf), safe_free(kbuf.dptr), kbuf=newkey) {
 188
 189                 if (strncmp(kbuf.dptr, GROUP_PREFIX, strlen(GROUP_PREFIX)) != 0) continue;
 190
 191                 dbuf = tdb_fetch(tdb, kbuf);
 192                 if (!dbuf.dptr)
 193                         continue;
 194
 195                 map->sid = dom_sid_parse_talloc(tdb, kbuf.dptr+strlen(GROUP_PREFIX));
 196
 197                 ret = tdb_unpack(tdb, dbuf.dptr, dbuf.dsize, "ddff",
 198                                  &map->gid, &map->sid_name_use, &map->nt_name, &map->comment);
 199
 200                 SAFE_FREE(dbuf.dptr);
 201
 202                 if ( ret == -1 ) {
 203                         DEBUG(3,("get_group_map_from_ntname: tdb_unpack failure\n"));
 204                         return False;
 205                 }
 206
 207                 if (StrCaseCmp(name, map->nt_name)==0) {
 208                         SAFE_FREE(kbuf.dptr);
 209                         return True;
 210                 }
 211         }
 212
 213         return False;
 214 }
 215
 216 /****************************************************************************
 217  Enumerate the group mapping.
 218 ****************************************************************************/
 219
 220 static BOOL enum_group_mapping(TDB_CONTEXT *tdb, enum SID_NAME_USE sid_name_use, struct samba3_groupmapping **rmap,
 221                         int *num_entries, BOOL unix_only)
 222 {
 223         TDB_DATA kbuf, dbuf, newkey;
 224         struct samba3_groupmapping map;
 225         struct samba3_groupmapping *mapt;
 226         int ret;
 227         int entries=0;
 228
 229         *num_entries=0;
 230         *rmap=NULL;
 231
 232         for (kbuf = tdb_firstkey(tdb);
 233              kbuf.dptr;
 234              newkey = tdb_nextkey(tdb, kbuf), safe_free(kbuf.dptr), kbuf=newkey) {
 235
 236                 if (strncmp(kbuf.dptr, GROUP_PREFIX, strlen(GROUP_PREFIX)) != 0)
 237                         continue;
 238
 239                 dbuf = tdb_fetch(tdb, kbuf);
 240                 if (!dbuf.dptr)
 241                         continue;
 242
 243                 map.sid = dom_sid_parse_talloc(tdb, kbuf.dptr+strlen(GROUP_PREFIX));
 244
 245                 ret = tdb_unpack(tdb, dbuf.dptr, dbuf.dsize, "ddff",
 246                                  &map.gid, &map.sid_name_use, &map.nt_name, &map.comment);
 247
 248                 SAFE_FREE(dbuf.dptr);
 249
 250                 if ( ret == -1 ) {
 251                         DEBUG(3,("enum_group_mapping: tdb_unpack failure\n"));
 252                         continue;
 253                 }
 254
 255                 /* list only the type or everything if UNKNOWN */
 256                 if (sid_name_use!=SID_NAME_UNKNOWN  && sid_name_use!=map.sid_name_use) {
 257                         DEBUG(11,("enum_group_mapping: group %s is not of the requested type\n", map.nt_name));
 258                         continue;
 259                 }
 260
 261                 if (unix_only==ENUM_ONLY_MAPPED && map.gid==-1) {
 262                         DEBUG(11,("enum_group_mapping: group %s is non mapped\n", map.nt_name));
 263                         continue;
 264                 }
 265
 266                 DEBUG(11,("enum_group_mapping: returning group %s of type %s\n", map.nt_name ,decode_sid_name_use(map.sid_name_use)));
 267
 268                 mapt = talloc_realloc(tdb, *rmap, struct samba3_groupmapping, entries+1);
 269                 if (!mapt) {
 270                         DEBUG(0,("enum_group_mapping: Unable to enlarge group map!\n"));
 271                         SAFE_FREE(*rmap);
 272                         return False;
 273                 }
 274                 else
 275                         (*rmap) = mapt;
 276
 277                 mapt[entries].gid = map.gid;
 278                 mapt[entries].sid = dom_sid_dup(tdb, map.sid);
 279                 mapt[entries].sid_name_use = map.sid_name_use;
 280                 mapt[entries].nt_name = map.nt_name;
 281                 mapt[entries].comment = map.comment;
 282
 283                 entries++;
 284
 285         }
 286
 287         *num_entries=entries;
 288
 289         return True;
 290 }
 291
 292 /* This operation happens on session setup, so it should better be fast. We
 293  * store a list of aliases a SID is member of hanging off MEMBEROF/SID. */
 294
 295 static NTSTATUS one_alias_membership(TDB_CONTEXT *tdb,
 296                 const struct dom_sid *member, struct dom_sid **sids, int *num)
 297 {
 298         TDB_DATA kbuf, dbuf;
 299         const char *p;
 300
 301         char * key = talloc_asprintf(tdb, "%s%s", MEMBEROF_PREFIX, dom_sid_string(tdb, member));
 302
 303         kbuf.dsize = strlen(key)+1;
 304         kbuf.dptr = key;
 305
 306         dbuf = tdb_fetch(tdb, kbuf);
 307
 308         if (dbuf.dptr == NULL) {
 309                 return NT_STATUS_OK;
 310         }
 311
 312         p = dbuf.dptr;
 313
 314         while (next_token(&p, string_sid, " ", sizeof(string_sid))) {
 315
 316                 struct dom_sid alias;
 317
 318                 if (!string_to_sid(&alias, string_sid))
 319                         continue;
 320
 321                 add_sid_to_array_unique(NULL, &alias, sids, num);
 322
 323                 if (sids == NULL)
 324                         return NT_STATUS_NO_MEMORY;
 325         }
 326
 327         SAFE_FREE(dbuf.dptr);
 328         return NT_STATUS_OK;
 329 }
 330
 331 static NTSTATUS alias_memberships(TDB_CONTEXT *tdb, const struct dom_sid *members, int num_members,
 332                                   struct dom_sid **sids, int *num)
 333 {
 334         int i;
 335
 336         *num = 0;
 337         *sids = NULL;
 338
 339         for (i=0; i<num_members; i++) {
 340                 NTSTATUS status = one_alias_membership(tdb, &members[i], sids, num);
 341                 if (!NT_STATUS_IS_OK(status))
 342                         return status;
 343         }
 344         return NT_STATUS_OK;
 345 }
 346
 347 struct aliasmem_closure {
 348         const struct dom_sid *alias;
 349         struct dom_sid **sids;
 350         int *num;
 351 };
 352
 353 static int collect_aliasmem(TDB_CONTEXT *tdb_ctx, TDB_DATA key, TDB_DATA data,
 354                             void *state)
 355 {
 356         struct aliasmem_closure *closure = (struct aliasmem_closure *)state;
 357         const char *p;
 358         fstring alias_string;
 359
 360         if (strncmp(key.dptr, MEMBEROF_PREFIX,
 361                     strlen(MEMBEROF_PREFIX)) != 0)
 362                 return 0;
 363
 364         p = data.dptr;
 365
 366         while (next_token(&p, alias_string, " ", sizeof(alias_string))) {
 367
 368                 struct dom_sid alias, member;
 369                 const char *member_string;
 370
 371
 372                 if (!string_to_sid(&alias, alias_string))
 373                         continue;
 374
 375                 if (sid_compare(closure->alias, &alias) != 0)
 376                         continue;
 377
 378                 /* Ok, we found the alias we're looking for in the membership
 379                  * list currently scanned. The key represents the alias
 380                  * member. Add that. */
 381
 382                 member_string = strchr(key.dptr, '/');
 383
 384                 /* Above we tested for MEMBEROF_PREFIX which includes the
 385                  * slash. */
 386
 387                 SMB_ASSERT(member_string != NULL);
 388                 member_string += 1;
 389
 390                 if (!string_to_sid(&member, member_string))
 391                         continue;
 392
 393                 add_sid_to_array(NULL, &member, closure->sids, closure->num);
 394         }
 395
 396         return 0;
 397 }
 398
 399 static NTSTATUS enum_aliasmem(TDB_CONTEXT *tdb, const struct dom_sid *alias, struct dom_sid **sids, int *num)
 400 {
 401         struct samba3_groupmapping map;
 402         struct aliasmem_closure closure;
 403
 404         if (!get_group_map_from_sid(*alias, &map))
 405                 return NT_STATUS_NO_SUCH_ALIAS;
 406
 407         if ( (map.sid_name_use != SID_NAME_ALIAS) &&
 408              (map.sid_name_use != SID_NAME_WKN_GRP) )
 409                 return NT_STATUS_NO_SUCH_ALIAS;
 410
 411         *sids = NULL;
 412         *num = 0;
 413
 414         closure.alias = alias;
 415         closure.sids = sids;
 416         closure.num = num;
 417
 418         tdb_traverse(tdb, collect_aliasmem, &closure);
 419         return NT_STATUS_OK;
 420 }
 421
 422 /*
 423  *
 424  * High level functions
 425  * better to use them than the lower ones.
 426  *
 427  * we are checking if the group is in the mapping file
 428  * and if the group is an existing unix group
 429  *
 430  */
 431
 432 /* get a domain group from it's SID */
 433
 434 /* get a local (alias) group from it's SID */
 435
 436 static BOOL get_local_group_from_sid(TDB_CONTEXT *tdb, struct dom_sid *sid, struct samba3_groupmapping *map)
 437 {
 438         BOOL ret;
 439
 440         /* The group is in the mapping table */
 441         ret = pdb_getgrsid(map, *sid);
 442
 443         if ( !ret )
 444                 return False;
 445
 446         if ( ( (map->sid_name_use != SID_NAME_ALIAS) &&
 447                (map->sid_name_use != SID_NAME_WKN_GRP) )
 448                 || (map->gid == -1)
 449                 || (getgrgid(map->gid) == NULL) )
 450         {
 451                 return False;
 452         }
 453
 454 #if 1   /* JERRY */
 455         /* local groups only exist in the group mapping DB so this
 456            is not necessary */
 457
 458         else {
 459                 /* the group isn't in the mapping table.
 460                  * make one based on the unix information */
 461                 uint32_t alias_rid;
 462                 struct group *grp;
 463
 464                 sid_peek_rid(sid, &alias_rid);
 465                 map->gid=pdb_group_rid_to_gid(alias_rid);
 466
 467                 grp = getgrgid(map->gid);
 468                 if ( !grp ) {
 469                         DEBUG(3,("get_local_group_from_sid: No unix group for [%ul]\n", map->gid));
 470                         return False;
 471                 }
 472
 473                 map->sid_name_use=SID_NAME_ALIAS;
 474
 475                 fstrcpy(map->nt_name, grp->gr_name);
 476                 fstrcpy(map->comment, "Local Unix Group");
 477
 478                 sid_copy(&map->sid, sid);
 479         }
 480 #endif
 481
 482         return True;
 483 }