s3:groupmap revert to tdb storage
[ira/wip.git] / source3 / groupdb / mapping.c
1 /* 
2  *  Unix SMB/CIFS implementation.
3  *  RPC Pipe client / server routines
4  *  Copyright (C) Andrew Tridgell              1992-2000,
5  *  Copyright (C) Jean Fran├žois Micouleau      1998-2001.
6  *  Copyright (C) Volker Lendecke              2006.
7  *  Copyright (C) Gerald Carter                2006.
8  *  
9  *  This program is free software; you can redistribute it and/or modify
10  *  it under the terms of the GNU General Public License as published by
11  *  the Free Software Foundation; either version 3 of the License, or
12  *  (at your option) any later version.
13  *  
14  *  This program is distributed in the hope that it will be useful,
15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17  *  GNU General Public License for more details.
18  *  
19  *  You should have received a copy of the GNU General Public License
20  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
21  */
22
23 #include "includes.h"
24 #include "groupdb/mapping.h"
25
26 static const struct mapping_backend *backend;
27
28 /*
29   initialise a group mapping backend
30  */
31 static bool init_group_mapping(void)
32 {
33         if (backend != NULL) {
34                 /* already initialised */
35                 return True;
36         }
37
38         backend = groupdb_tdb_init();
39
40         return backend != NULL;
41 }
42
43 /****************************************************************************
44 initialise first time the mapping list
45 ****************************************************************************/
46 NTSTATUS add_initial_entry(gid_t gid, const char *sid, enum lsa_SidType sid_name_use, const char *nt_name, const char *comment)
47 {
48         GROUP_MAP map;
49
50         if(!init_group_mapping()) {
51                 DEBUG(0,("failed to initialize group mapping\n"));
52                 return NT_STATUS_UNSUCCESSFUL;
53         }
54         
55         map.gid=gid;
56         if (!string_to_sid(&map.sid, sid)) {
57                 DEBUG(0, ("string_to_sid failed: %s", sid));
58                 return NT_STATUS_UNSUCCESSFUL;
59         }
60         
61         map.sid_name_use=sid_name_use;
62         fstrcpy(map.nt_name, nt_name);
63         fstrcpy(map.comment, comment);
64
65         return pdb_add_group_mapping_entry(&map);
66 }
67
68 static NTSTATUS alias_memberships(const DOM_SID *members, size_t num_members,
69                                   DOM_SID **sids, size_t *num)
70 {
71         size_t i;
72
73         *num = 0;
74         *sids = NULL;
75
76         for (i=0; i<num_members; i++) {
77                 NTSTATUS status = backend->one_alias_membership(&members[i], sids, num);
78                 if (!NT_STATUS_IS_OK(status))
79                         return status;
80         }
81         return NT_STATUS_OK;
82 }
83
84 struct aliasmem_closure {
85         const DOM_SID *alias;
86         DOM_SID **sids;
87         size_t *num;
88 };
89
90
91
92 /*
93  *
94  * High level functions
95  * better to use them than the lower ones.
96  *
97  * we are checking if the group is in the mapping file
98  * and if the group is an existing unix group
99  *
100  */
101
102 /* get a domain group from it's SID */
103
104 bool get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map)
105 {
106         struct group *grp;
107         bool ret;
108         
109         if(!init_group_mapping()) {
110                 DEBUG(0,("failed to initialize group mapping\n"));
111                 return(False);
112         }
113
114         DEBUG(10, ("get_domain_group_from_sid\n"));
115
116         /* if the group is NOT in the database, it CAN NOT be a domain group */
117         
118         become_root();
119         ret = pdb_getgrsid(map, sid);
120         unbecome_root();
121         
122         /* special case check for rid 513 */
123         
124         if ( !ret ) {
125                 uint32 rid;
126                 
127                 sid_peek_rid( &sid, &rid );
128                 
129                 if ( rid == DOMAIN_GROUP_RID_USERS ) {
130                         fstrcpy( map->nt_name, "None" );
131                         fstrcpy( map->comment, "Ordinary Users" );
132                         sid_copy( &map->sid, &sid );
133                         map->sid_name_use = SID_NAME_DOM_GRP;
134                         map->gid = (gid_t)-1;
135                         
136                         return True;
137                 }
138                 
139                 return False;
140         }
141
142         DEBUG(10, ("get_domain_group_from_sid: SID found in the TDB\n"));
143
144         /* if it's not a domain group, continue */
145         if (map->sid_name_use!=SID_NAME_DOM_GRP) {
146                 return False;
147         }
148
149         DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
150         
151         if (map->gid==-1) {
152                 return False;
153         }
154
155         DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid));
156         
157         grp = getgrgid(map->gid);
158         if ( !grp ) {
159                 DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n"));
160                 return False;
161         }
162
163         DEBUG(10, ("get_domain_group_from_sid: gid exists in UNIX security\n"));
164
165         return True;
166 }
167
168 /****************************************************************************
169  Create a UNIX group on demand.
170 ****************************************************************************/
171
172 int smb_create_group(const char *unix_group, gid_t *new_gid)
173 {
174         char *add_script = NULL;
175         int     ret = -1;
176         int     fd = 0;
177
178         *new_gid = 0;
179
180         /* defer to scripts */
181
182         if ( *lp_addgroup_script() ) {
183                 TALLOC_CTX *ctx = talloc_tos();
184
185                 add_script = talloc_strdup(ctx,
186                                         lp_addgroup_script());
187                 if (!add_script) {
188                         return -1;
189                 }
190                 add_script = talloc_string_sub(ctx,
191                                 add_script, "%g", unix_group);
192                 if (!add_script) {
193                         return -1;
194                 }
195
196                 ret = smbrun(add_script, &fd);
197                 DEBUG(ret ? 0 : 3,("smb_create_group: Running the command `%s' gave %d\n",add_script,ret));
198                 if (ret == 0) {
199                         smb_nscd_flush_group_cache();
200                 }
201                 if (ret != 0)
202                         return ret;
203
204                 if (fd != 0) {
205                         fstring output;
206
207                         *new_gid = 0;
208                         if (read(fd, output, sizeof(output)) > 0) {
209                                 *new_gid = (gid_t)strtoul(output, NULL, 10);
210                         }
211
212                         close(fd);
213                 }
214
215         }
216
217         if (*new_gid == 0) {
218                 struct group *grp = getgrnam(unix_group);
219
220                 if (grp != NULL)
221                         *new_gid = grp->gr_gid;
222         }
223
224         return ret;
225 }
226
227 /****************************************************************************
228  Delete a UNIX group on demand.
229 ****************************************************************************/
230
231 int smb_delete_group(const char *unix_group)
232 {
233         char *del_script = NULL;
234         int ret = -1;
235
236         /* defer to scripts */
237
238         if ( *lp_delgroup_script() ) {
239                 TALLOC_CTX *ctx = talloc_tos();
240
241                 del_script = talloc_strdup(ctx,
242                                 lp_delgroup_script());
243                 if (!del_script) {
244                         return -1;
245                 }
246                 del_script = talloc_string_sub(ctx,
247                                 del_script, "%g", unix_group);
248                 if (!del_script) {
249                         return -1;
250                 }
251                 ret = smbrun(del_script,NULL);
252                 DEBUG(ret ? 0 : 3,("smb_delete_group: Running the command `%s' gave %d\n",del_script,ret));
253                 if (ret == 0) {
254                         smb_nscd_flush_group_cache();
255                 }
256                 return ret;
257         }
258
259         return -1;
260 }
261
262 /****************************************************************************
263  Set a user's primary UNIX group.
264 ****************************************************************************/
265
266 int smb_set_primary_group(const char *unix_group, const char* unix_user)
267 {
268         char *add_script = NULL;
269         int ret = -1;
270
271         /* defer to scripts */
272
273         if ( *lp_setprimarygroup_script() ) {
274                 TALLOC_CTX *ctx = talloc_tos();
275
276                 add_script = talloc_strdup(ctx,
277                                 lp_setprimarygroup_script());
278                 if (!add_script) {
279                         return -1;
280                 }
281                 add_script = talloc_all_string_sub(ctx,
282                                 add_script, "%g", unix_group);
283                 if (!add_script) {
284                         return -1;
285                 }
286                 add_script = talloc_string_sub(ctx,
287                                 add_script, "%u", unix_user);
288                 if (!add_script) {
289                         return -1;
290                 }
291                 ret = smbrun(add_script,NULL);
292                 flush_pwnam_cache();
293                 DEBUG(ret ? 0 : 3,("smb_set_primary_group: "
294                          "Running the command `%s' gave %d\n",add_script,ret));
295                 if (ret == 0) {
296                         smb_nscd_flush_group_cache();
297                 }
298                 return ret;
299         }
300
301         return -1;
302 }
303
304 /****************************************************************************
305  Add a user to a UNIX group.
306 ****************************************************************************/
307
308 int smb_add_user_group(const char *unix_group, const char *unix_user)
309 {
310         char *add_script = NULL;
311         int ret = -1;
312
313         /* defer to scripts */
314
315         if ( *lp_addusertogroup_script() ) {
316                 TALLOC_CTX *ctx = talloc_tos();
317
318                 add_script = talloc_strdup(ctx,
319                                 lp_addusertogroup_script());
320                 if (!add_script) {
321                         return -1;
322                 }
323                 add_script = talloc_string_sub(ctx,
324                                 add_script, "%g", unix_group);
325                 if (!add_script) {
326                         return -1;
327                 }
328                 add_script = talloc_string_sub(ctx,
329                                 add_script, "%u", unix_user);
330                 if (!add_script) {
331                         return -1;
332                 }
333                 ret = smbrun(add_script,NULL);
334                 DEBUG(ret ? 0 : 3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script,ret));
335                 if (ret == 0) {
336                         smb_nscd_flush_group_cache();
337                 }
338                 return ret;
339         }
340
341         return -1;
342 }
343
344 /****************************************************************************
345  Delete a user from a UNIX group
346 ****************************************************************************/
347
348 int smb_delete_user_group(const char *unix_group, const char *unix_user)
349 {
350         char *del_script = NULL;
351         int ret = -1;
352
353         /* defer to scripts */
354
355         if ( *lp_deluserfromgroup_script() ) {
356                 TALLOC_CTX *ctx = talloc_tos();
357
358                 del_script = talloc_strdup(ctx,
359                                 lp_deluserfromgroup_script());
360                 if (!del_script) {
361                         return -1;
362                 }
363                 del_script = talloc_string_sub(ctx,
364                                 del_script, "%g", unix_group);
365                 if (!del_script) {
366                         return -1;
367                 }
368                 del_script = talloc_string_sub(ctx,
369                                 del_script, "%u", unix_user);
370                 if (!del_script) {
371                         return -1;
372                 }
373                 ret = smbrun(del_script,NULL);
374                 DEBUG(ret ? 0 : 3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script,ret));
375                 if (ret == 0) {
376                         smb_nscd_flush_group_cache();
377                 }
378                 return ret;
379         }
380
381         return -1;
382 }
383
384
385 NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
386                                  DOM_SID sid)
387 {
388         if (!init_group_mapping()) {
389                 DEBUG(0,("failed to initialize group mapping\n"));
390                 return NT_STATUS_UNSUCCESSFUL;
391         }
392         return backend->get_group_map_from_sid(sid, map) ?
393                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
394 }
395
396 NTSTATUS pdb_default_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
397                                  gid_t gid)
398 {
399         if (!init_group_mapping()) {
400                 DEBUG(0,("failed to initialize group mapping\n"));
401                 return NT_STATUS_UNSUCCESSFUL;
402         }
403         return backend->get_group_map_from_gid(gid, map) ?
404                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
405 }
406
407 NTSTATUS pdb_default_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
408                                  const char *name)
409 {
410         if (!init_group_mapping()) {
411                 DEBUG(0,("failed to initialize group mapping\n"));
412                 return NT_STATUS_UNSUCCESSFUL;
413         }
414         return backend->get_group_map_from_ntname(name, map) ?
415                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
416 }
417
418 NTSTATUS pdb_default_add_group_mapping_entry(struct pdb_methods *methods,
419                                                 GROUP_MAP *map)
420 {
421         if (!init_group_mapping()) {
422                 DEBUG(0,("failed to initialize group mapping\n"));
423                 return NT_STATUS_UNSUCCESSFUL;
424         }
425         return backend->add_mapping_entry(map, TDB_INSERT) ?
426                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
427 }
428
429 NTSTATUS pdb_default_update_group_mapping_entry(struct pdb_methods *methods,
430                                                    GROUP_MAP *map)
431 {
432         if (!init_group_mapping()) {
433                 DEBUG(0,("failed to initialize group mapping\n"));
434                 return NT_STATUS_UNSUCCESSFUL;
435         }
436         return backend->add_mapping_entry(map, TDB_REPLACE) ?
437                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
438 }
439
440 NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods,
441                                                    DOM_SID sid)
442 {
443         if (!init_group_mapping()) {
444                 DEBUG(0,("failed to initialize group mapping\n"));
445                 return NT_STATUS_UNSUCCESSFUL;
446         }
447         return backend->group_map_remove(&sid) ?
448                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
449 }
450
451 NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
452                                            const DOM_SID *sid, enum lsa_SidType sid_name_use,
453                                            GROUP_MAP **pp_rmap, size_t *p_num_entries,
454                                            bool unix_only)
455 {
456         if (!init_group_mapping()) {
457                 DEBUG(0,("failed to initialize group mapping\n"));
458                 return NT_STATUS_UNSUCCESSFUL;
459         }
460         return backend->enum_group_mapping(sid, sid_name_use, pp_rmap, p_num_entries, unix_only) ?
461                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
462 }
463
464 NTSTATUS pdb_default_create_alias(struct pdb_methods *methods,
465                                   const char *name, uint32 *rid)
466 {
467         DOM_SID sid;
468         enum lsa_SidType type;
469         uint32 new_rid;
470         gid_t gid;
471         bool exists;
472         GROUP_MAP map;
473         TALLOC_CTX *mem_ctx;
474         NTSTATUS status;
475
476         DEBUG(10, ("Trying to create alias %s\n", name));
477
478         mem_ctx = talloc_new(NULL);
479         if (mem_ctx == NULL) {
480                 return NT_STATUS_NO_MEMORY;
481         }
482
483         exists = lookup_name(mem_ctx, name, LOOKUP_NAME_LOCAL,
484                              NULL, NULL, &sid, &type);
485         TALLOC_FREE(mem_ctx);
486
487         if (exists) {
488                 return NT_STATUS_ALIAS_EXISTS;
489         }
490
491         if (!winbind_allocate_gid(&gid)) {
492                 DEBUG(3, ("Could not get a gid out of winbind\n"));
493                 return NT_STATUS_ACCESS_DENIED;
494         }
495
496         if (!pdb_new_rid(&new_rid)) {
497                 DEBUG(0, ("Could not allocate a RID -- wasted a gid :-(\n"));
498                 return NT_STATUS_ACCESS_DENIED;
499         }
500
501         DEBUG(10, ("Creating alias %s with gid %u and rid %u\n",
502                    name, (unsigned int)gid, (unsigned int)new_rid));
503
504         sid_compose(&sid, get_global_sam_sid(), new_rid);
505
506         map.gid = gid;
507         sid_copy(&map.sid, &sid);
508         map.sid_name_use = SID_NAME_ALIAS;
509         fstrcpy(map.nt_name, name);
510         fstrcpy(map.comment, "");
511
512         status = pdb_add_group_mapping_entry(&map);
513
514         if (!NT_STATUS_IS_OK(status)) {
515                 DEBUG(0, ("Could not add group mapping entry for alias %s "
516                           "(%s)\n", name, nt_errstr(status)));
517                 return status;
518         }
519
520         *rid = new_rid;
521
522         return NT_STATUS_OK;
523 }
524
525 NTSTATUS pdb_default_delete_alias(struct pdb_methods *methods,
526                                   const DOM_SID *sid)
527 {
528         return pdb_delete_group_mapping_entry(*sid);
529 }
530
531 NTSTATUS pdb_default_get_aliasinfo(struct pdb_methods *methods,
532                                    const DOM_SID *sid,
533                                    struct acct_info *info)
534 {
535         GROUP_MAP map;
536
537         if (!pdb_getgrsid(&map, *sid))
538                 return NT_STATUS_NO_SUCH_ALIAS;
539
540         if ((map.sid_name_use != SID_NAME_ALIAS) &&
541             (map.sid_name_use != SID_NAME_WKN_GRP)) {
542                 DEBUG(2, ("%s is a %s, expected an alias\n",
543                           sid_string_dbg(sid),
544                           sid_type_lookup(map.sid_name_use)));
545                 return NT_STATUS_NO_SUCH_ALIAS;
546         }
547
548         fstrcpy(info->acct_name, map.nt_name);
549         fstrcpy(info->acct_desc, map.comment);
550         sid_peek_rid(&map.sid, &info->rid);
551         return NT_STATUS_OK;
552 }
553
554 NTSTATUS pdb_default_set_aliasinfo(struct pdb_methods *methods,
555                                    const DOM_SID *sid,
556                                    struct acct_info *info)
557 {
558         GROUP_MAP map;
559
560         if (!pdb_getgrsid(&map, *sid))
561                 return NT_STATUS_NO_SUCH_ALIAS;
562
563         fstrcpy(map.nt_name, info->acct_name);
564         fstrcpy(map.comment, info->acct_desc);
565
566         return pdb_update_group_mapping_entry(&map);
567 }
568
569 NTSTATUS pdb_default_add_aliasmem(struct pdb_methods *methods,
570                                   const DOM_SID *alias, const DOM_SID *member)
571 {
572         if (!init_group_mapping()) {
573                 DEBUG(0,("failed to initialize group mapping\n"));
574                 return NT_STATUS_UNSUCCESSFUL;
575         }
576         return backend->add_aliasmem(alias, member);
577 }
578
579 NTSTATUS pdb_default_del_aliasmem(struct pdb_methods *methods,
580                                   const DOM_SID *alias, const DOM_SID *member)
581 {
582         if (!init_group_mapping()) {
583                 DEBUG(0,("failed to initialize group mapping\n"));
584                 return NT_STATUS_UNSUCCESSFUL;
585         }
586         return backend->del_aliasmem(alias, member);
587 }
588
589 NTSTATUS pdb_default_enum_aliasmem(struct pdb_methods *methods,
590                                    const DOM_SID *alias, TALLOC_CTX *mem_ctx,
591                                    DOM_SID **pp_members, size_t *p_num_members)
592 {
593         if (!init_group_mapping()) {
594                 DEBUG(0,("failed to initialize group mapping\n"));
595                 return NT_STATUS_UNSUCCESSFUL;
596         }
597         return backend->enum_aliasmem(alias, mem_ctx, pp_members,
598                                       p_num_members);
599 }
600
601 NTSTATUS pdb_default_alias_memberships(struct pdb_methods *methods,
602                                        TALLOC_CTX *mem_ctx,
603                                        const DOM_SID *domain_sid,
604                                        const DOM_SID *members,
605                                        size_t num_members,
606                                        uint32 **pp_alias_rids,
607                                        size_t *p_num_alias_rids)
608 {
609         DOM_SID *alias_sids;
610         size_t i, num_alias_sids;
611         NTSTATUS result;
612
613         if (!init_group_mapping()) {
614                 DEBUG(0,("failed to initialize group mapping\n"));
615                 return NT_STATUS_UNSUCCESSFUL;
616         }
617
618         alias_sids = NULL;
619         num_alias_sids = 0;
620
621         result = alias_memberships(members, num_members,
622                                    &alias_sids, &num_alias_sids);
623
624         if (!NT_STATUS_IS_OK(result))
625                 return result;
626
627         *p_num_alias_rids = 0;
628
629         if (num_alias_sids == 0) {
630                 TALLOC_FREE(alias_sids);
631                 return NT_STATUS_OK;
632         }
633
634         *pp_alias_rids = TALLOC_ARRAY(mem_ctx, uint32, num_alias_sids);
635         if (*pp_alias_rids == NULL)
636                 return NT_STATUS_NO_MEMORY;
637
638         for (i=0; i<num_alias_sids; i++) {
639                 if (!sid_peek_check_rid(domain_sid, &alias_sids[i],
640                                         &(*pp_alias_rids)[*p_num_alias_rids]))
641                         continue;
642                 *p_num_alias_rids += 1;
643         }
644
645         TALLOC_FREE(alias_sids);
646
647         return NT_STATUS_OK;
648 }
649
650 /**********************************************************************
651  no ops for passdb backends that don't implement group mapping
652  *********************************************************************/
653
654 NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
655                                  DOM_SID sid)
656 {
657         return NT_STATUS_UNSUCCESSFUL;
658 }
659
660 NTSTATUS pdb_nop_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
661                                  gid_t gid)
662 {
663         return NT_STATUS_UNSUCCESSFUL;
664 }
665
666 NTSTATUS pdb_nop_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
667                                  const char *name)
668 {
669         return NT_STATUS_UNSUCCESSFUL;
670 }
671
672 NTSTATUS pdb_nop_add_group_mapping_entry(struct pdb_methods *methods,
673                                                 GROUP_MAP *map)
674 {
675         return NT_STATUS_UNSUCCESSFUL;
676 }
677
678 NTSTATUS pdb_nop_update_group_mapping_entry(struct pdb_methods *methods,
679                                                    GROUP_MAP *map)
680 {
681         return NT_STATUS_UNSUCCESSFUL;
682 }
683
684 NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods,
685                                                    DOM_SID sid)
686 {
687         return NT_STATUS_UNSUCCESSFUL;
688 }
689
690 NTSTATUS pdb_nop_enum_group_mapping(struct pdb_methods *methods,
691                                            enum lsa_SidType sid_name_use,
692                                            GROUP_MAP **rmap, size_t *num_entries,
693                                            bool unix_only)
694 {
695         return NT_STATUS_UNSUCCESSFUL;
696 }
697
698 /****************************************************************************
699  These need to be redirected through pdb_interface.c
700 ****************************************************************************/
701 bool pdb_get_dom_grp_info(const DOM_SID *sid, struct acct_info *info)
702 {
703         GROUP_MAP map;
704         bool res;
705
706         become_root();
707         res = get_domain_group_from_sid(*sid, &map);
708         unbecome_root();
709
710         if (!res)
711                 return False;
712
713         fstrcpy(info->acct_name, map.nt_name);
714         fstrcpy(info->acct_desc, map.comment);
715         sid_peek_rid(sid, &info->rid);
716         return True;
717 }
718
719 bool pdb_set_dom_grp_info(const DOM_SID *sid, const struct acct_info *info)
720 {
721         GROUP_MAP map;
722
723         if (!get_domain_group_from_sid(*sid, &map))
724                 return False;
725
726         fstrcpy(map.nt_name, info->acct_name);
727         fstrcpy(map.comment, info->acct_desc);
728
729         return NT_STATUS_IS_OK(pdb_update_group_mapping_entry(&map));
730 }
731
732 /********************************************************************
733  Really just intended to be called by smbd
734 ********************************************************************/
735
736 NTSTATUS pdb_create_builtin_alias(uint32 rid)
737 {
738         DOM_SID sid;
739         enum lsa_SidType type;
740         gid_t gid;
741         GROUP_MAP map;
742         TALLOC_CTX *mem_ctx;
743         NTSTATUS status;
744         const char *name = NULL;
745         fstring groupname;
746
747         DEBUG(10, ("Trying to create builtin alias %d\n", rid));
748         
749         if ( !sid_compose( &sid, &global_sid_Builtin, rid ) ) {
750                 return NT_STATUS_NO_SUCH_ALIAS;
751         }
752         
753         if ( (mem_ctx = talloc_new(NULL)) == NULL ) {
754                 return NT_STATUS_NO_MEMORY;
755         }
756         
757         if ( !lookup_sid(mem_ctx, &sid, NULL, &name, &type) ) {
758                 TALLOC_FREE( mem_ctx );
759                 return NT_STATUS_NO_SUCH_ALIAS;
760         }
761         
762         /* validate RID so copy the name and move on */
763                 
764         fstrcpy( groupname, name );
765         TALLOC_FREE( mem_ctx );
766
767         if (!winbind_allocate_gid(&gid)) {
768                 DEBUG(3, ("pdb_create_builtin_alias: Could not get a gid out of winbind\n"));
769                 return NT_STATUS_ACCESS_DENIED;
770         }
771
772         DEBUG(10,("Creating alias %s with gid %u\n", groupname, (unsigned int)gid));
773
774         map.gid = gid;
775         sid_copy(&map.sid, &sid);
776         map.sid_name_use = SID_NAME_ALIAS;
777         fstrcpy(map.nt_name, groupname);
778         fstrcpy(map.comment, "");
779
780         status = pdb_add_group_mapping_entry(&map);
781
782         if (!NT_STATUS_IS_OK(status)) {
783                 DEBUG(0, ("pdb_create_builtin_alias: Could not add group mapping entry for alias %d "
784                           "(%s)\n", rid, nt_errstr(status)));
785         }
786
787         return status;
788 }
789
790