Fix a bunch of compiler warnings about wrong format types.
[ira/wip.git] / source3 / utils / net_groupmap.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  RPC Pipe client / server routines
4  *  Copyright (C) Andrew Tridgell              1992-2000,
5  *  Copyright (C) Jean Fran├žois Micouleau      1998-2001.
6  *  Copyright (C) Gerald Carter                2003,
7  *  Copyright (C) Volker Lendecke              2004
8  *
9  *  This program is free software; you can redistribute it and/or modify
10  *  it under the terms of the GNU General Public License as published by
11  *  the Free Software Foundation; either version 3 of the License, or
12  *  (at your option) any later version.
13  *
14  *  This program is distributed in the hope that it will be useful,
15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17  *  GNU General Public License for more details.
18  *
19  *  You should have received a copy of the GNU General Public License
20  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
21  */
22
23
24 #include "includes.h"
25 #include "utils/net.h"
26
27 /*********************************************************
28  Figure out if the input was an NT group or a SID string.
29  Return the SID.
30 **********************************************************/
31 static bool get_sid_from_input(DOM_SID *sid, char *input)
32 {
33         GROUP_MAP map;
34
35         if (StrnCaseCmp( input, "S-", 2)) {
36                 /* Perhaps its the NT group name? */
37                 if (!pdb_getgrnam(&map, input)) {
38                         printf("NT Group %s doesn't exist in mapping DB\n", input);
39                         return false;
40                 } else {
41                         *sid = map.sid;
42                 }
43         } else {
44                 if (!string_to_sid(sid, input)) {
45                         printf("converting sid %s from a string failed!\n", input);
46                         return false;
47                 }
48         }
49         return true;
50 }
51
52 /*********************************************************
53  Dump a GROUP_MAP entry to stdout (long or short listing)
54 **********************************************************/
55
56 static void print_map_entry ( GROUP_MAP map, bool long_list )
57 {
58         if (!long_list)
59                 d_printf("%s (%s) -> %s\n", map.nt_name,
60                          sid_string_tos(&map.sid), gidtoname(map.gid));
61         else {
62                 d_printf("%s\n", map.nt_name);
63                 d_printf("\tSID       : %s\n", sid_string_tos(&map.sid));
64                 d_printf("\tUnix gid  : %u\n", (unsigned int)map.gid);
65                 d_printf("\tUnix group: %s\n", gidtoname(map.gid));
66                 d_printf("\tGroup type: %s\n",
67                          sid_type_lookup(map.sid_name_use));
68                 d_printf("\tComment   : %s\n", map.comment);
69         }
70
71 }
72 /*********************************************************
73  List the groups.
74 **********************************************************/
75 static int net_groupmap_list(struct net_context *c, int argc, const char **argv)
76 {
77         size_t entries;
78         bool long_list = false;
79         size_t i;
80         fstring ntgroup = "";
81         fstring sid_string = "";
82         const char list_usage_str[] = "net groupmap list [verbose] "
83                                       "[ntgroup=NT group] [sid=SID]\n"
84                                       "    verbose\tPrint verbose list\n"
85                                       "    ntgroup\tNT group to list\n"
86                                       "    sid\tSID of group to list";
87
88         if (c->display_usage) {
89                 d_printf("Usage:\n%s\n", list_usage_str);
90                 return 0;
91         }
92
93         if (c->opt_verbose || c->opt_long_list_entries)
94                 long_list = true;
95
96         /* get the options */
97         for ( i=0; i<argc; i++ ) {
98                 if ( !StrCaseCmp(argv[i], "verbose")) {
99                         long_list = true;
100                 }
101                 else if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
102                         fstrcpy( ntgroup, get_string_param( argv[i] ) );
103                         if ( !ntgroup[0] ) {
104                                 d_fprintf(stderr, "must supply a name\n");
105                                 return -1;
106                         }
107                 }
108                 else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
109                         fstrcpy( sid_string, get_string_param( argv[i] ) );
110                         if ( !sid_string[0] ) {
111                                 d_fprintf(stderr, "must supply a SID\n");
112                                 return -1;
113                         }
114                 }
115                 else {
116                         d_fprintf(stderr, "Bad option: %s\n", argv[i]);
117                         d_printf("Usage:\n%s\n", list_usage_str);
118                         return -1;
119                 }
120         }
121
122         /* list a single group is given a name */
123         if ( ntgroup[0] || sid_string[0] ) {
124                 DOM_SID sid;
125                 GROUP_MAP map;
126
127                 if ( sid_string[0] )
128                         fstrcpy( ntgroup, sid_string);
129
130                 if (!get_sid_from_input(&sid, ntgroup)) {
131                         return -1;
132                 }
133
134                 /* Get the current mapping from the database */
135                 if(!pdb_getgrsid(&map, sid)) {
136                         d_fprintf(stderr, "Failure to local group SID in the database\n");
137                         return -1;
138                 }
139
140                 print_map_entry( map, long_list );
141         }
142         else {
143                 GROUP_MAP *map=NULL;
144                 /* enumerate all group mappings */
145                 if (!pdb_enum_group_mapping(NULL, SID_NAME_UNKNOWN, &map, &entries, ENUM_ALL_MAPPED))
146                         return -1;
147
148                 for (i=0; i<entries; i++) {
149                         print_map_entry( map[i], long_list );
150                 }
151
152                 SAFE_FREE(map);
153         }
154
155         return 0;
156 }
157
158 /*********************************************************
159  Add a new group mapping entry
160 **********************************************************/
161
162 static int net_groupmap_add(struct net_context *c, int argc, const char **argv)
163 {
164         DOM_SID sid;
165         fstring ntgroup = "";
166         fstring unixgrp = "";
167         fstring string_sid = "";
168         fstring type = "";
169         fstring ntcomment = "";
170         enum lsa_SidType sid_type = SID_NAME_DOM_GRP;
171         uint32 rid = 0;
172         gid_t gid;
173         int i;
174         GROUP_MAP map;
175
176         const char *name_type;
177         const char add_usage_str[] = "net groupmap add {rid=<int>|sid=<string>}"
178                                      " unixgroup=<string> "
179                                      "[type=<domain|local|builtin>] "
180                                      "[ntgroup=<string>] [comment=<string>]";
181
182         ZERO_STRUCT(map);
183
184         /* Default is domain group. */
185         map.sid_name_use = SID_NAME_DOM_GRP;
186         name_type = "domain group";
187
188         if (c->display_usage) {
189                 d_printf("Usage\n%s\n", add_usage_str);
190                 return 0;
191         }
192
193         /* get the options */
194         for ( i=0; i<argc; i++ ) {
195                 if ( !StrnCaseCmp(argv[i], "rid", strlen("rid")) ) {
196                         rid = get_int_param(argv[i]);
197                         if ( rid < DOMAIN_GROUP_RID_ADMINS ) {
198                                 d_fprintf(stderr, "RID must be greater than %d\n", (uint32)DOMAIN_GROUP_RID_ADMINS-1);
199                                 return -1;
200                         }
201                 }
202                 else if ( !StrnCaseCmp(argv[i], "unixgroup", strlen("unixgroup")) ) {
203                         fstrcpy( unixgrp, get_string_param( argv[i] ) );
204                         if ( !unixgrp[0] ) {
205                                 d_fprintf(stderr, "must supply a name\n");
206                                 return -1;
207                         }
208                 }
209                 else if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
210                         fstrcpy( ntgroup, get_string_param( argv[i] ) );
211                         if ( !ntgroup[0] ) {
212                                 d_fprintf(stderr, "must supply a name\n");
213                                 return -1;
214                         }
215                 }
216                 else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
217                         fstrcpy( string_sid, get_string_param( argv[i] ) );
218                         if ( !string_sid[0] ) {
219                                 d_fprintf(stderr, "must supply a SID\n");
220                                 return -1;
221                         }
222                 }
223                 else if ( !StrnCaseCmp(argv[i], "comment", strlen("comment")) ) {
224                         fstrcpy( ntcomment, get_string_param( argv[i] ) );
225                         if ( !ntcomment[0] ) {
226                                 d_fprintf(stderr, "must supply a comment string\n");
227                                 return -1;
228                         }
229                 }
230                 else if ( !StrnCaseCmp(argv[i], "type", strlen("type")) )  {
231                         fstrcpy( type, get_string_param( argv[i] ) );
232                         switch ( type[0] ) {
233                                 case 'b':
234                                 case 'B':
235                                         sid_type = SID_NAME_WKN_GRP;
236                                         name_type = "wellknown group";
237                                         break;
238                                 case 'd':
239                                 case 'D':
240                                         sid_type = SID_NAME_DOM_GRP;
241                                         name_type = "domain group";
242                                         break;
243                                 case 'l':
244                                 case 'L':
245                                         sid_type = SID_NAME_ALIAS;
246                                         name_type = "alias (local) group";
247                                         break;
248                                 default:
249                                         d_fprintf(stderr, "unknown group type %s\n", type);
250                                         return -1;
251                         }
252                 }
253                 else {
254                         d_fprintf(stderr, "Bad option: %s\n", argv[i]);
255                         return -1;
256                 }
257         }
258
259         if ( !unixgrp[0] ) {
260                 d_printf("Usage:\n%s\n", add_usage_str);
261                 return -1;
262         }
263
264         if ( (gid = nametogid(unixgrp)) == (gid_t)-1 ) {
265                 d_fprintf(stderr, "Can't lookup UNIX group %s\n", unixgrp);
266                 return -1;
267         }
268
269         {
270                 if (pdb_getgrgid(&map, gid)) {
271                         d_printf("Unix group %s already mapped to SID %s\n",
272                                  unixgrp, sid_string_tos(&map.sid));
273                         return -1;
274                 }
275         }
276
277         if ( (rid == 0) && (string_sid[0] == '\0') ) {
278                 d_printf("No rid or sid specified, choosing a RID\n");
279                 if (pdb_rid_algorithm()) {
280                         rid = algorithmic_pdb_gid_to_group_rid(gid);
281                 } else {
282                         if (!pdb_new_rid(&rid)) {
283                                 d_printf("Could not get new RID\n");
284                         }
285                 }
286                 d_printf("Got RID %d\n", rid);
287         }
288
289         /* append the rid to our own domain/machine SID if we don't have a full SID */
290         if ( !string_sid[0] ) {
291                 sid_copy(&sid, get_global_sam_sid());
292                 sid_append_rid(&sid, rid);
293                 sid_to_fstring(string_sid, &sid);
294         }
295
296         if (!ntcomment[0]) {
297                 switch (sid_type) {
298                 case SID_NAME_WKN_GRP:
299                         fstrcpy(ntcomment, "Wellknown Unix group");
300                         break;
301                 case SID_NAME_DOM_GRP:
302                         fstrcpy(ntcomment, "Domain Unix group");
303                         break;
304                 case SID_NAME_ALIAS:
305                         fstrcpy(ntcomment, "Local Unix group");
306                         break;
307                 default:
308                         fstrcpy(ntcomment, "Unix group");
309                         break;
310                 }
311         }
312
313         if (!ntgroup[0] )
314                 fstrcpy( ntgroup, unixgrp );
315
316         if (!NT_STATUS_IS_OK(add_initial_entry(gid, string_sid, sid_type, ntgroup, ntcomment))) {
317                 d_fprintf(stderr, "adding entry for group %s failed!\n", ntgroup);
318                 return -1;
319         }
320
321         d_printf("Successfully added group %s to the mapping db as a %s\n",
322                  ntgroup, name_type);
323         return 0;
324 }
325
326 static int net_groupmap_modify(struct net_context *c, int argc, const char **argv)
327 {
328         DOM_SID sid;
329         GROUP_MAP map;
330         fstring ntcomment = "";
331         fstring type = "";
332         fstring ntgroup = "";
333         fstring unixgrp = "";
334         fstring sid_string = "";
335         enum lsa_SidType sid_type = SID_NAME_UNKNOWN;
336         int i;
337         gid_t gid;
338         const char modify_usage_str[] = "net groupmap modify "
339                                         "{ntgroup=<string>|sid=<SID>} "
340                                         "[comment=<string>] "
341                                         "[unixgroup=<string>] "
342                                         "[type=<domain|local>]";
343
344         if (c->display_usage) {
345                 d_printf("Usage:\n%s\n", modify_usage_str);
346                 return 0;
347         }
348
349         /* get the options */
350         for ( i=0; i<argc; i++ ) {
351                 if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
352                         fstrcpy( ntgroup, get_string_param( argv[i] ) );
353                         if ( !ntgroup[0] ) {
354                                 d_fprintf(stderr, "must supply a name\n");
355                                 return -1;
356                         }
357                 }
358                 else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
359                         fstrcpy( sid_string, get_string_param( argv[i] ) );
360                         if ( !sid_string[0] ) {
361                                 d_fprintf(stderr, "must supply a name\n");
362                                 return -1;
363                         }
364                 }
365                 else if ( !StrnCaseCmp(argv[i], "comment", strlen("comment")) ) {
366                         fstrcpy( ntcomment, get_string_param( argv[i] ) );
367                         if ( !ntcomment[0] ) {
368                                 d_fprintf(stderr, "must supply a comment string\n");
369                                 return -1;
370                         }
371                 }
372                 else if ( !StrnCaseCmp(argv[i], "unixgroup", strlen("unixgroup")) ) {
373                         fstrcpy( unixgrp, get_string_param( argv[i] ) );
374                         if ( !unixgrp[0] ) {
375                                 d_fprintf(stderr, "must supply a group name\n");
376                                 return -1;
377                         }
378                 }
379                 else if ( !StrnCaseCmp(argv[i], "type", strlen("type")) )  {
380                         fstrcpy( type, get_string_param( argv[i] ) );
381                         switch ( type[0] ) {
382                                 case 'd':
383                                 case 'D':
384                                         sid_type = SID_NAME_DOM_GRP;
385                                         break;
386                                 case 'l':
387                                 case 'L':
388                                         sid_type = SID_NAME_ALIAS;
389                                         break;
390                         }
391                 }
392                 else {
393                         d_fprintf(stderr, "Bad option: %s\n", argv[i]);
394                         return -1;
395                 }
396         }
397
398         if ( !ntgroup[0] && !sid_string[0] ) {
399                 d_printf("Usage:\n%s\n", modify_usage_str);
400                 return -1;
401         }
402
403         /* give preference to the SID; if both the ntgroup name and SID
404            are defined, use the SID and assume that the group name could be a
405            new name */
406
407         if ( sid_string[0] ) {
408                 if (!get_sid_from_input(&sid, sid_string)) {
409                         return -1;
410                 }
411         }
412         else {
413                 if (!get_sid_from_input(&sid, ntgroup)) {
414                         return -1;
415                 }
416         }
417
418         /* Get the current mapping from the database */
419         if(!pdb_getgrsid(&map, sid)) {
420                 d_fprintf(stderr, "Failure to local group SID in the database\n");
421                 return -1;
422         }
423
424         /*
425          * Allow changing of group type only between domain and local
426          * We disallow changing Builtin groups !!! (SID problem)
427          */
428         if (sid_type == SID_NAME_UNKNOWN) {
429                 d_fprintf(stderr, "Can't map to an unknown group type.\n");
430                 return -1;
431         }
432
433         if (map.sid_name_use == SID_NAME_WKN_GRP) {
434                 d_fprintf(stderr, "You can only change between domain and local groups.\n");
435                 return -1;
436         }
437
438         map.sid_name_use=sid_type;
439
440         /* Change comment if new one */
441         if ( ntcomment[0] )
442                 fstrcpy( map.comment, ntcomment );
443
444         if ( ntgroup[0] )
445                 fstrcpy( map.nt_name, ntgroup );
446
447         if ( unixgrp[0] ) {
448                 gid = nametogid( unixgrp );
449                 if ( gid == -1 ) {
450                         d_fprintf(stderr, "Unable to lookup UNIX group %s.  Make sure the group exists.\n",
451                                 unixgrp);
452                         return -1;
453                 }
454
455                 map.gid = gid;
456         }
457
458         if ( !NT_STATUS_IS_OK(pdb_update_group_mapping_entry(&map)) ) {
459                 d_fprintf(stderr, "Could not update group database\n");
460                 return -1;
461         }
462
463         d_printf("Updated mapping entry for %s\n", map.nt_name);
464
465         return 0;
466 }
467
468 static int net_groupmap_delete(struct net_context *c, int argc, const char **argv)
469 {
470         DOM_SID sid;
471         fstring ntgroup = "";
472         fstring sid_string = "";
473         int i;
474         const char delete_usage_str[] = "net groupmap delete "
475                                         "{ntgroup=<string>|sid=<SID>}";
476
477         if (c->display_usage) {
478                 d_printf("Usage:\n%s\n", delete_usage_str);
479                 return 0;
480         }
481
482         /* get the options */
483         for ( i=0; i<argc; i++ ) {
484                 if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
485                         fstrcpy( ntgroup, get_string_param( argv[i] ) );
486                         if ( !ntgroup[0] ) {
487                                 d_fprintf(stderr, "must supply a name\n");
488                                 return -1;
489                         }
490                 }
491                 else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
492                         fstrcpy( sid_string, get_string_param( argv[i] ) );
493                         if ( !sid_string[0] ) {
494                                 d_fprintf(stderr, "must supply a SID\n");
495                                 return -1;
496                         }
497                 }
498                 else {
499                         d_fprintf(stderr, "Bad option: %s\n", argv[i]);
500                         return -1;
501                 }
502         }
503
504         if ( !ntgroup[0] && !sid_string[0]) {
505                 d_printf("Usage:\n%s\n", delete_usage_str);
506                 return -1;
507         }
508
509         /* give preference to the SID if we have that */
510
511         if ( sid_string[0] )
512                 fstrcpy( ntgroup, sid_string );
513
514         if ( !get_sid_from_input(&sid, ntgroup) ) {
515                 d_fprintf(stderr, "Unable to resolve group %s to a SID\n", ntgroup);
516                 return -1;
517         }
518
519         if ( !NT_STATUS_IS_OK(pdb_delete_group_mapping_entry(sid)) ) {
520                 d_fprintf(stderr, "Failed to removing group %s from the mapping db!\n", ntgroup);
521                 return -1;
522         }
523
524         d_printf("Sucessfully removed %s from the mapping db\n", ntgroup);
525
526         return 0;
527 }
528
529 static int net_groupmap_set(struct net_context *c, int argc, const char **argv)
530 {
531         const char *ntgroup = NULL;
532         struct group *grp = NULL;
533         GROUP_MAP map;
534         bool have_map = false;
535
536         if ((argc < 1) || (argc > 2) || c->display_usage) {
537                 d_printf("Usage: net groupmap set \"NT Group\" "
538                          "[\"unix group\"] [-C \"comment\"] [-L] [-D]\n");
539                 return -1;
540         }
541
542         if ( c->opt_localgroup && c->opt_domaingroup ) {
543                 d_printf("Can only specify -L or -D, not both\n");
544                 return -1;
545         }
546
547         ntgroup = argv[0];
548
549         if (argc == 2) {
550                 grp = getgrnam(argv[1]);
551
552                 if (grp == NULL) {
553                         d_fprintf(stderr, "Could not find unix group %s\n", argv[1]);
554                         return -1;
555                 }
556         }
557
558         have_map = pdb_getgrnam(&map, ntgroup);
559
560         if (!have_map) {
561                 DOM_SID sid;
562                 have_map = ( (strncmp(ntgroup, "S-", 2) == 0) &&
563                              string_to_sid(&sid, ntgroup) &&
564                              pdb_getgrsid(&map, sid) );
565         }
566
567         if (!have_map) {
568
569                 /* Ok, add it */
570
571                 if (grp == NULL) {
572                         d_fprintf(stderr, "Could not find group mapping for %s\n",
573                                  ntgroup);
574                         return -1;
575                 }
576
577                 map.gid = grp->gr_gid;
578
579                 if (c->opt_rid == 0) {
580                         if ( pdb_rid_algorithm() )
581                                 c->opt_rid = algorithmic_pdb_gid_to_group_rid(map.gid);
582                         else {
583                                 if ( !pdb_new_rid((uint32*)&c->opt_rid) ) {
584                                         d_fprintf( stderr, "Could not allocate new RID\n");
585                                         return -1;
586                                 }
587                         }
588                 }
589
590                 sid_copy(&map.sid, get_global_sam_sid());
591                 sid_append_rid(&map.sid, c->opt_rid);
592
593                 map.sid_name_use = SID_NAME_DOM_GRP;
594                 fstrcpy(map.nt_name, ntgroup);
595                 fstrcpy(map.comment, "");
596
597                 if (!NT_STATUS_IS_OK(pdb_add_group_mapping_entry(&map))) {
598                         d_fprintf(stderr, "Could not add mapping entry for %s\n",
599                                  ntgroup);
600                         return -1;
601                 }
602         }
603
604         /* Now we have a mapping entry, update that stuff */
605
606         if ( c->opt_localgroup || c->opt_domaingroup ) {
607                 if (map.sid_name_use == SID_NAME_WKN_GRP) {
608                         d_fprintf(stderr, "Can't change type of the BUILTIN group %s\n",
609                                  map.nt_name);
610                         return -1;
611                 }
612         }
613
614         if (c->opt_localgroup)
615                 map.sid_name_use = SID_NAME_ALIAS;
616
617         if (c->opt_domaingroup)
618                 map.sid_name_use = SID_NAME_DOM_GRP;
619
620         /* The case (opt_domaingroup && opt_localgroup) was tested for above */
621
622         if ((c->opt_comment != NULL) && (strlen(c->opt_comment) > 0)) {
623                 fstrcpy(map.comment, c->opt_comment);
624         }
625
626         if ((c->opt_newntname != NULL) && (strlen(c->opt_newntname) > 0)) {
627                 fstrcpy(map.nt_name, c->opt_newntname);
628         }
629
630         if (grp != NULL)
631                 map.gid = grp->gr_gid;
632
633         if (!NT_STATUS_IS_OK(pdb_update_group_mapping_entry(&map))) {
634                 d_fprintf(stderr, "Could not update group mapping for %s\n", ntgroup);
635                 return -1;
636         }
637
638         return 0;
639 }
640
641 static int net_groupmap_cleanup(struct net_context *c, int argc, const char **argv)
642 {
643         GROUP_MAP *map = NULL;
644         size_t i, entries;
645
646         if (c->display_usage) {
647                 d_printf("Usage:\n"
648                          "net groupmap cleanup\n"
649                          "    Delete all group mappings\n");
650                 return 0;
651         }
652
653         if (!pdb_enum_group_mapping(NULL, SID_NAME_UNKNOWN, &map, &entries,
654                                     ENUM_ALL_MAPPED)) {
655                 d_fprintf(stderr, "Could not list group mappings\n");
656                 return -1;
657         }
658
659         for (i=0; i<entries; i++) {
660
661                 if (map[i].gid == -1)
662                         printf("Group %s is not mapped\n", map[i].nt_name);
663
664                 if (!sid_check_is_in_our_domain(&map[i].sid)) {
665                         printf("Deleting mapping for NT Group %s, sid %s\n",
666                                map[i].nt_name,
667                                sid_string_tos(&map[i].sid));
668                         pdb_delete_group_mapping_entry(map[i].sid);
669                 }
670         }
671
672         SAFE_FREE(map);
673
674         return 0;
675 }
676
677 static int net_groupmap_addmem(struct net_context *c, int argc, const char **argv)
678 {
679         DOM_SID alias, member;
680
681         if ( (argc != 2) ||
682              c->display_usage ||
683              !string_to_sid(&alias, argv[0]) ||
684              !string_to_sid(&member, argv[1]) ) {
685                 d_printf("Usage: net groupmap addmem alias-sid member-sid\n");
686                 return -1;
687         }
688
689         if (!NT_STATUS_IS_OK(pdb_add_aliasmem(&alias, &member))) {
690                 d_fprintf(stderr, "Could not add sid %s to alias %s\n",
691                          argv[1], argv[0]);
692                 return -1;
693         }
694
695         return 0;
696 }
697
698 static int net_groupmap_delmem(struct net_context *c, int argc, const char **argv)
699 {
700         DOM_SID alias, member;
701
702         if ( (argc != 2) ||
703              c->display_usage ||
704              !string_to_sid(&alias, argv[0]) ||
705              !string_to_sid(&member, argv[1]) ) {
706                 d_printf("Usage: net groupmap delmem alias-sid member-sid\n");
707                 return -1;
708         }
709
710         if (!NT_STATUS_IS_OK(pdb_del_aliasmem(&alias, &member))) {
711                 d_fprintf(stderr, "Could not delete sid %s from alias %s\n",
712                          argv[1], argv[0]);
713                 return -1;
714         }
715
716         return 0;
717 }
718
719 static int net_groupmap_listmem(struct net_context *c, int argc, const char **argv)
720 {
721         DOM_SID alias;
722         DOM_SID *members;
723         size_t i, num;
724
725         if ( (argc != 1) ||
726              c->display_usage ||
727              !string_to_sid(&alias, argv[0]) ) {
728                 d_printf("Usage: net groupmap listmem alias-sid\n");
729                 return -1;
730         }
731
732         members = NULL;
733         num = 0;
734
735         if (!NT_STATUS_IS_OK(pdb_enum_aliasmem(&alias, &members, &num))) {
736                 d_fprintf(stderr, "Could not list members for sid %s\n", argv[0]);
737                 return -1;
738         }
739
740         for (i = 0; i < num; i++) {
741                 printf("%s\n", sid_string_tos(&(members[i])));
742         }
743
744         TALLOC_FREE(members);
745
746         return 0;
747 }
748
749 static bool print_alias_memberships(TALLOC_CTX *mem_ctx,
750                                     const DOM_SID *domain_sid,
751                                     const DOM_SID *member)
752 {
753         uint32 *alias_rids;
754         size_t i, num_alias_rids;
755
756         alias_rids = NULL;
757         num_alias_rids = 0;
758
759         if (!NT_STATUS_IS_OK(pdb_enum_alias_memberships(
760                                      mem_ctx, domain_sid, member, 1,
761                                      &alias_rids, &num_alias_rids))) {
762                 d_fprintf(stderr, "Could not list memberships for sid %s\n",
763                          sid_string_tos(member));
764                 return false;
765         }
766
767         for (i = 0; i < num_alias_rids; i++) {
768                 DOM_SID alias;
769                 sid_copy(&alias, domain_sid);
770                 sid_append_rid(&alias, alias_rids[i]);
771                 printf("%s\n", sid_string_tos(&alias));
772         }
773
774         return true;
775 }
776
777 static int net_groupmap_memberships(struct net_context *c, int argc, const char **argv)
778 {
779         TALLOC_CTX *mem_ctx;
780         DOM_SID *domain_sid, *builtin_sid, member;
781
782         if ( (argc != 1) ||
783              c->display_usage ||
784              !string_to_sid(&member, argv[0]) ) {
785                 d_printf("Usage: net groupmap memberof sid\n");
786                 return -1;
787         }
788
789         mem_ctx = talloc_init("net_groupmap_memberships");
790         if (mem_ctx == NULL) {
791                 d_fprintf(stderr, "talloc_init failed\n");
792                 return -1;
793         }
794
795         domain_sid = get_global_sam_sid();
796         builtin_sid = string_sid_talloc(mem_ctx, "S-1-5-32");
797         if ((domain_sid == NULL) || (builtin_sid == NULL)) {
798                 d_fprintf(stderr, "Could not get domain sid\n");
799                 return -1;
800         }
801
802         if (!print_alias_memberships(mem_ctx, domain_sid, &member) ||
803             !print_alias_memberships(mem_ctx, builtin_sid, &member))
804                 return -1;
805
806         talloc_destroy(mem_ctx);
807
808         return 0;
809 }
810
811 /***********************************************************
812  migrated functionality from smbgroupedit
813  **********************************************************/
814 int net_groupmap(struct net_context *c, int argc, const char **argv)
815 {
816         struct functable func[] = {
817                 {
818                         "add",
819                         net_groupmap_add,
820                         NET_TRANSPORT_LOCAL,
821                         "Create a new group mapping",
822                         "net groupmap add\n"
823                         "    Create a new group mapping"
824                 },
825                 {
826                         "modify",
827                         net_groupmap_modify,
828                         NET_TRANSPORT_LOCAL,
829                         "Update a group mapping",
830                         "net groupmap modify\n"
831                         "    Modify an existing group mapping"
832                 },
833                 {
834                         "delete",
835                         net_groupmap_delete,
836                         NET_TRANSPORT_LOCAL,
837                         "Remove a group mapping",
838                         "net groupmap delete\n"
839                         "    Remove a group mapping"
840                 },
841                 {
842                         "set",
843                         net_groupmap_set,
844                         NET_TRANSPORT_LOCAL,
845                         "Set group mapping",
846                         "net groupmap set\n"
847                         "    Set a group mapping"
848                 },
849                 {
850                         "cleanup",
851                         net_groupmap_cleanup,
852                         NET_TRANSPORT_LOCAL,
853                         "Remove foreign group mapping entries",
854                         "net groupmap cleanup\n"
855                         "    Remove foreign group mapping entries"
856                 },
857                 {
858                         "addmem",
859                         net_groupmap_addmem,
860                         NET_TRANSPORT_LOCAL,
861                         "Add a foreign alias member",
862                         "net groupmap addmem\n"
863                         "    Add a foreign alias member"
864                 },
865                 {
866                         "delmem",
867                         net_groupmap_delmem,
868                         NET_TRANSPORT_LOCAL,
869                         "Delete foreign alias member",
870                         "net groupmap delmem\n"
871                         "    Delete foreign alias member"
872                 },
873                 {
874                         "listmem",
875                         net_groupmap_listmem,
876                         NET_TRANSPORT_LOCAL,
877                         "List foreign group members",
878                         "net groupmap listmem\n"
879                         "    List foreign alias members"
880                 },
881                 {
882                         "memberships",
883                         net_groupmap_memberships,
884                         NET_TRANSPORT_LOCAL,
885                         "List foreign group memberships",
886                         "net groupmap memberships\n"
887                         "    List foreign group memberships"
888                 },
889                 {
890                         "list",
891                         net_groupmap_list,
892                         NET_TRANSPORT_LOCAL,
893                         "List current group map",
894                         "net groupmap list\n"
895                         "    List current group map"
896                 },
897                 {NULL, NULL, 0, NULL, NULL}
898         };
899
900         /* we shouldn't have silly checks like this */
901         if (getuid() != 0) {
902                 d_fprintf(stderr, "You must be root to edit group mappings.\n");
903                 return -1;
904         }
905
906         return net_run_function(c,argc, argv, "net groupmap", func);
907 }
908