2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-2000,
5 * Copyright (C) Jean François Micouleau 1998-2001.
6 * Copyright (C) Volker Lendecke 2006.
7 * Copyright (C) Gerald Carter 2006.
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 3 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, see <http://www.gnu.org/licenses/>.
24 #include "system/passwd.h"
26 #include "groupdb/mapping.h"
27 #include "../libcli/security/security.h"
28 #include "lib/winbind_util.h"
29 #include "tdb_compat.h"
30 #include "groupdb/mapping_tdb.h"
32 static const struct mapping_backend *backend;
35 initialise a group mapping backend
37 static bool init_group_mapping(void)
39 if (backend != NULL) {
40 /* already initialised */
44 backend = groupdb_tdb_init();
46 return backend != NULL;
49 /****************************************************************************
50 initialise first time the mapping list
51 ****************************************************************************/
52 NTSTATUS add_initial_entry(gid_t gid, const char *sid, enum lsa_SidType sid_name_use, const char *nt_name, const char *comment)
56 if(!init_group_mapping()) {
57 DEBUG(0,("failed to initialize group mapping\n"));
58 return NT_STATUS_UNSUCCESSFUL;
62 if (!string_to_sid(&map.sid, sid)) {
63 DEBUG(0, ("string_to_sid failed: %s", sid));
64 return NT_STATUS_UNSUCCESSFUL;
67 map.sid_name_use=sid_name_use;
68 fstrcpy(map.nt_name, nt_name);
69 fstrcpy(map.comment, comment);
71 return pdb_add_group_mapping_entry(&map);
74 static NTSTATUS alias_memberships(const struct dom_sid *members, size_t num_members,
75 struct dom_sid **sids, size_t *num)
82 for (i=0; i<num_members; i++) {
83 NTSTATUS status = backend->one_alias_membership(&members[i], sids, num);
84 if (!NT_STATUS_IS_OK(status))
90 struct aliasmem_closure {
91 const struct dom_sid *alias;
92 struct dom_sid **sids;
100 * High level functions
101 * better to use them than the lower ones.
103 * we are checking if the group is in the mapping file
104 * and if the group is an existing unix group
108 /* get a domain group from it's SID */
110 bool get_domain_group_from_sid(struct dom_sid sid, GROUP_MAP *map)
115 if(!init_group_mapping()) {
116 DEBUG(0,("failed to initialize group mapping\n"));
120 DEBUG(10, ("get_domain_group_from_sid\n"));
122 /* if the group is NOT in the database, it CAN NOT be a domain group */
125 ret = pdb_getgrsid(map, sid);
128 /* special case check for rid 513 */
133 sid_peek_rid( &sid, &rid );
135 if ( rid == DOMAIN_RID_USERS ) {
136 fstrcpy( map->nt_name, "None" );
137 fstrcpy( map->comment, "Ordinary Users" );
138 sid_copy( &map->sid, &sid );
139 map->sid_name_use = SID_NAME_DOM_GRP;
140 map->gid = (gid_t)-1;
146 DEBUG(10, ("get_domain_group_from_sid: SID found in passdb\n"));
148 /* if it's not a domain group, continue */
149 if (map->sid_name_use!=SID_NAME_DOM_GRP) {
153 DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
159 DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid));
161 grp = getgrgid(map->gid);
163 DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n"));
167 DEBUG(10, ("get_domain_group_from_sid: gid exists in UNIX security\n"));
172 /****************************************************************************
173 Create a UNIX group on demand.
174 ****************************************************************************/
176 int smb_create_group(const char *unix_group, gid_t *new_gid)
178 char *add_script = NULL;
184 /* defer to scripts */
186 if ( *lp_addgroup_script() ) {
187 TALLOC_CTX *ctx = talloc_tos();
189 add_script = talloc_strdup(ctx,
190 lp_addgroup_script());
194 add_script = talloc_string_sub(ctx,
195 add_script, "%g", unix_group);
200 ret = smbrun(add_script, &fd);
201 DEBUG(ret ? 0 : 3,("smb_create_group: Running the command `%s' gave %d\n",add_script,ret));
203 smb_nscd_flush_group_cache();
212 if (read(fd, output, sizeof(output)) > 0) {
213 *new_gid = (gid_t)strtoul(output, NULL, 10);
222 struct group *grp = getgrnam(unix_group);
225 *new_gid = grp->gr_gid;
231 /****************************************************************************
232 Delete a UNIX group on demand.
233 ****************************************************************************/
235 int smb_delete_group(const char *unix_group)
237 char *del_script = NULL;
240 /* defer to scripts */
242 if ( *lp_delgroup_script() ) {
243 TALLOC_CTX *ctx = talloc_tos();
245 del_script = talloc_strdup(ctx,
246 lp_delgroup_script());
250 del_script = talloc_string_sub(ctx,
251 del_script, "%g", unix_group);
255 ret = smbrun(del_script,NULL);
256 DEBUG(ret ? 0 : 3,("smb_delete_group: Running the command `%s' gave %d\n",del_script,ret));
258 smb_nscd_flush_group_cache();
266 /****************************************************************************
267 Set a user's primary UNIX group.
268 ****************************************************************************/
270 int smb_set_primary_group(const char *unix_group, const char* unix_user)
272 char *add_script = NULL;
275 /* defer to scripts */
277 if ( *lp_setprimarygroup_script() ) {
278 TALLOC_CTX *ctx = talloc_tos();
280 add_script = talloc_strdup(ctx,
281 lp_setprimarygroup_script());
285 add_script = talloc_all_string_sub(ctx,
286 add_script, "%g", unix_group);
290 add_script = talloc_string_sub(ctx,
291 add_script, "%u", unix_user);
295 ret = smbrun(add_script,NULL);
297 DEBUG(ret ? 0 : 3,("smb_set_primary_group: "
298 "Running the command `%s' gave %d\n",add_script,ret));
300 smb_nscd_flush_group_cache();
308 /****************************************************************************
309 Add a user to a UNIX group.
310 ****************************************************************************/
312 int smb_add_user_group(const char *unix_group, const char *unix_user)
314 char *add_script = NULL;
317 /* defer to scripts */
319 if ( *lp_addusertogroup_script() ) {
320 TALLOC_CTX *ctx = talloc_tos();
322 add_script = talloc_strdup(ctx,
323 lp_addusertogroup_script());
327 add_script = talloc_string_sub(ctx,
328 add_script, "%g", unix_group);
332 add_script = talloc_string_sub2(ctx,
333 add_script, "%u", unix_user, true, false, true);
337 ret = smbrun(add_script,NULL);
338 DEBUG(ret ? 0 : 3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script,ret));
340 smb_nscd_flush_group_cache();
348 /****************************************************************************
349 Delete a user from a UNIX group
350 ****************************************************************************/
352 int smb_delete_user_group(const char *unix_group, const char *unix_user)
354 char *del_script = NULL;
357 /* defer to scripts */
359 if ( *lp_deluserfromgroup_script() ) {
360 TALLOC_CTX *ctx = talloc_tos();
362 del_script = talloc_strdup(ctx,
363 lp_deluserfromgroup_script());
367 del_script = talloc_string_sub(ctx,
368 del_script, "%g", unix_group);
372 del_script = talloc_string_sub2(ctx,
373 del_script, "%u", unix_user, true, false, true);
377 ret = smbrun(del_script,NULL);
378 DEBUG(ret ? 0 : 3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script,ret));
380 smb_nscd_flush_group_cache();
389 NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
392 if (!init_group_mapping()) {
393 DEBUG(0,("failed to initialize group mapping\n"));
394 return NT_STATUS_UNSUCCESSFUL;
396 return backend->get_group_map_from_sid(sid, map) ?
397 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
400 NTSTATUS pdb_default_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
403 if (!init_group_mapping()) {
404 DEBUG(0,("failed to initialize group mapping\n"));
405 return NT_STATUS_UNSUCCESSFUL;
407 return backend->get_group_map_from_gid(gid, map) ?
408 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
411 NTSTATUS pdb_default_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
414 if (!init_group_mapping()) {
415 DEBUG(0,("failed to initialize group mapping\n"));
416 return NT_STATUS_UNSUCCESSFUL;
418 return backend->get_group_map_from_ntname(name, map) ?
419 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
422 NTSTATUS pdb_default_add_group_mapping_entry(struct pdb_methods *methods,
425 if (!init_group_mapping()) {
426 DEBUG(0,("failed to initialize group mapping\n"));
427 return NT_STATUS_UNSUCCESSFUL;
429 return backend->add_mapping_entry(map, TDB_INSERT) ?
430 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
433 NTSTATUS pdb_default_update_group_mapping_entry(struct pdb_methods *methods,
436 if (!init_group_mapping()) {
437 DEBUG(0,("failed to initialize group mapping\n"));
438 return NT_STATUS_UNSUCCESSFUL;
440 return backend->add_mapping_entry(map, TDB_REPLACE) ?
441 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
444 NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods,
447 if (!init_group_mapping()) {
448 DEBUG(0,("failed to initialize group mapping\n"));
449 return NT_STATUS_UNSUCCESSFUL;
451 return backend->group_map_remove(&sid) ?
452 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
455 NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
456 const struct dom_sid *sid, enum lsa_SidType sid_name_use,
457 GROUP_MAP **pp_rmap, size_t *p_num_entries,
460 if (!init_group_mapping()) {
461 DEBUG(0,("failed to initialize group mapping\n"));
462 return NT_STATUS_UNSUCCESSFUL;
464 return backend->enum_group_mapping(sid, sid_name_use, pp_rmap, p_num_entries, unix_only) ?
465 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
468 NTSTATUS pdb_default_create_alias(struct pdb_methods *methods,
469 const char *name, uint32 *rid)
472 enum lsa_SidType type;
480 DEBUG(10, ("Trying to create alias %s\n", name));
482 mem_ctx = talloc_new(NULL);
483 if (mem_ctx == NULL) {
484 return NT_STATUS_NO_MEMORY;
487 exists = lookup_name(mem_ctx, name, LOOKUP_NAME_LOCAL,
488 NULL, NULL, &sid, &type);
489 TALLOC_FREE(mem_ctx);
492 return NT_STATUS_ALIAS_EXISTS;
495 if (!pdb_new_rid(&new_rid)) {
496 DEBUG(0, ("Could not allocate a RID.\n"));
497 return NT_STATUS_ACCESS_DENIED;
500 sid_compose(&sid, get_global_sam_sid(), new_rid);
502 if (!winbind_allocate_gid(&gid)) {
503 DEBUG(3, ("Could not get a gid out of winbind - "
504 "wasted a rid :-(\n"));
505 return NT_STATUS_ACCESS_DENIED;
508 DEBUG(10, ("Creating alias %s with gid %u and rid %u\n",
509 name, (unsigned int)gid, (unsigned int)new_rid));
512 sid_copy(&map.sid, &sid);
513 map.sid_name_use = SID_NAME_ALIAS;
514 fstrcpy(map.nt_name, name);
515 fstrcpy(map.comment, "");
517 status = pdb_add_group_mapping_entry(&map);
519 if (!NT_STATUS_IS_OK(status)) {
520 DEBUG(0, ("Could not add group mapping entry for alias %s "
521 "(%s)\n", name, nt_errstr(status)));
530 NTSTATUS pdb_default_delete_alias(struct pdb_methods *methods,
531 const struct dom_sid *sid)
533 return pdb_delete_group_mapping_entry(*sid);
536 NTSTATUS pdb_default_get_aliasinfo(struct pdb_methods *methods,
537 const struct dom_sid *sid,
538 struct acct_info *info)
542 if (!pdb_getgrsid(&map, *sid))
543 return NT_STATUS_NO_SUCH_ALIAS;
545 if ((map.sid_name_use != SID_NAME_ALIAS) &&
546 (map.sid_name_use != SID_NAME_WKN_GRP)) {
547 DEBUG(2, ("%s is a %s, expected an alias\n",
549 sid_type_lookup(map.sid_name_use)));
550 return NT_STATUS_NO_SUCH_ALIAS;
553 info->acct_name = talloc_strdup(info, map.nt_name);
554 if (!info->acct_name) {
555 return NT_STATUS_NO_MEMORY;
557 info->acct_desc = talloc_strdup(info, map.comment);
558 if (!info->acct_desc) {
559 return NT_STATUS_NO_MEMORY;
561 sid_peek_rid(&map.sid, &info->rid);
565 NTSTATUS pdb_default_set_aliasinfo(struct pdb_methods *methods,
566 const struct dom_sid *sid,
567 struct acct_info *info)
571 if (!pdb_getgrsid(&map, *sid))
572 return NT_STATUS_NO_SUCH_ALIAS;
574 fstrcpy(map.nt_name, info->acct_name);
575 fstrcpy(map.comment, info->acct_desc);
577 return pdb_update_group_mapping_entry(&map);
580 NTSTATUS pdb_default_add_aliasmem(struct pdb_methods *methods,
581 const struct dom_sid *alias, const struct dom_sid *member)
583 if (!init_group_mapping()) {
584 DEBUG(0,("failed to initialize group mapping\n"));
585 return NT_STATUS_UNSUCCESSFUL;
587 return backend->add_aliasmem(alias, member);
590 NTSTATUS pdb_default_del_aliasmem(struct pdb_methods *methods,
591 const struct dom_sid *alias, const struct dom_sid *member)
593 if (!init_group_mapping()) {
594 DEBUG(0,("failed to initialize group mapping\n"));
595 return NT_STATUS_UNSUCCESSFUL;
597 return backend->del_aliasmem(alias, member);
600 NTSTATUS pdb_default_enum_aliasmem(struct pdb_methods *methods,
601 const struct dom_sid *alias, TALLOC_CTX *mem_ctx,
602 struct dom_sid **pp_members, size_t *p_num_members)
604 if (!init_group_mapping()) {
605 DEBUG(0,("failed to initialize group mapping\n"));
606 return NT_STATUS_UNSUCCESSFUL;
608 return backend->enum_aliasmem(alias, mem_ctx, pp_members,
612 NTSTATUS pdb_default_alias_memberships(struct pdb_methods *methods,
614 const struct dom_sid *domain_sid,
615 const struct dom_sid *members,
617 uint32 **pp_alias_rids,
618 size_t *p_num_alias_rids)
620 struct dom_sid *alias_sids;
621 size_t i, num_alias_sids;
624 if (!init_group_mapping()) {
625 DEBUG(0,("failed to initialize group mapping\n"));
626 return NT_STATUS_UNSUCCESSFUL;
632 result = alias_memberships(members, num_members,
633 &alias_sids, &num_alias_sids);
635 if (!NT_STATUS_IS_OK(result))
638 *p_num_alias_rids = 0;
640 if (num_alias_sids == 0) {
641 TALLOC_FREE(alias_sids);
645 *pp_alias_rids = talloc_array(mem_ctx, uint32, num_alias_sids);
646 if (*pp_alias_rids == NULL)
647 return NT_STATUS_NO_MEMORY;
649 for (i=0; i<num_alias_sids; i++) {
650 if (!sid_peek_check_rid(domain_sid, &alias_sids[i],
651 &(*pp_alias_rids)[*p_num_alias_rids]))
653 *p_num_alias_rids += 1;
656 TALLOC_FREE(alias_sids);
661 /**********************************************************************
662 no ops for passdb backends that don't implement group mapping
663 *********************************************************************/
665 NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
668 return NT_STATUS_UNSUCCESSFUL;
671 NTSTATUS pdb_nop_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
674 return NT_STATUS_UNSUCCESSFUL;
677 NTSTATUS pdb_nop_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
680 return NT_STATUS_UNSUCCESSFUL;
683 NTSTATUS pdb_nop_add_group_mapping_entry(struct pdb_methods *methods,
686 return NT_STATUS_UNSUCCESSFUL;
689 NTSTATUS pdb_nop_update_group_mapping_entry(struct pdb_methods *methods,
692 return NT_STATUS_UNSUCCESSFUL;
695 NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods,
698 return NT_STATUS_UNSUCCESSFUL;
701 NTSTATUS pdb_nop_enum_group_mapping(struct pdb_methods *methods,
702 enum lsa_SidType sid_name_use,
703 GROUP_MAP **rmap, size_t *num_entries,
706 return NT_STATUS_UNSUCCESSFUL;
709 /********************************************************************
710 Really just intended to be called by smbd
711 ********************************************************************/
713 NTSTATUS pdb_create_builtin_alias(uint32 rid)
716 enum lsa_SidType type;
721 const char *name = NULL;
724 DEBUG(10, ("Trying to create builtin alias %d\n", rid));
726 if ( !sid_compose( &sid, &global_sid_Builtin, rid ) ) {
727 return NT_STATUS_NO_SUCH_ALIAS;
730 if ( (mem_ctx = talloc_new(NULL)) == NULL ) {
731 return NT_STATUS_NO_MEMORY;
734 if ( !lookup_sid(mem_ctx, &sid, NULL, &name, &type) ) {
735 TALLOC_FREE( mem_ctx );
736 return NT_STATUS_NO_SUCH_ALIAS;
739 /* validate RID so copy the name and move on */
741 fstrcpy( groupname, name );
742 TALLOC_FREE( mem_ctx );
744 if (!winbind_allocate_gid(&gid)) {
745 DEBUG(3, ("pdb_create_builtin_alias: Could not get a gid out of winbind\n"));
746 return NT_STATUS_ACCESS_DENIED;
749 DEBUG(10,("Creating alias %s with gid %u\n", groupname, (unsigned int)gid));
752 sid_copy(&map.sid, &sid);
753 map.sid_name_use = SID_NAME_ALIAS;
754 strlcpy(map.nt_name, groupname, sizeof(map.nt_name));
755 strlcpy(map.comment, "", sizeof(map.comment));
757 status = pdb_add_group_mapping_entry(&map);
759 if (!NT_STATUS_IS_OK(status)) {
760 DEBUG(0, ("pdb_create_builtin_alias: Could not add group mapping entry for alias %d "
761 "(%s)\n", rid, nt_errstr(status)));