source3/groupdb/mapping.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-2000,
   5  *  Copyright (C) Jean François Micouleau      1998-2001.
   6  *  Copyright (C) Volker Lendecke              2006.
   7  *  Copyright (C) Gerald Carter                2006.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 3 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  21  */
  22
  23 #include "includes.h"
  24 #include "system/passwd.h"
  25 #include "groupdb/mapping.h"
  26 #include "../libcli/security/security.h"
  27 #include "lib/winbind_util.h"
  28
  29 static const struct mapping_backend *backend;
  30
  31 /*
  32   initialise a group mapping backend
  33  */
  34 static bool init_group_mapping(void)
  35 {
  36         if (backend != NULL) {
  37                 /* already initialised */
  38                 return True;
  39         }
  40
  41         backend = groupdb_tdb_init();
  42
  43         return backend != NULL;
  44 }
  45
  46 /****************************************************************************
  47 initialise first time the mapping list
  48 ****************************************************************************/
  49 NTSTATUS add_initial_entry(gid_t gid, const char *sid, enum lsa_SidType sid_name_use, const char *nt_name, const char *comment)
  50 {
  51         GROUP_MAP map;
  52
  53         if(!init_group_mapping()) {
  54                 DEBUG(0,("failed to initialize group mapping\n"));
  55                 return NT_STATUS_UNSUCCESSFUL;
  56         }
  57
  58         map.gid=gid;
  59         if (!string_to_sid(&map.sid, sid)) {
  60                 DEBUG(0, ("string_to_sid failed: %s", sid));
  61                 return NT_STATUS_UNSUCCESSFUL;
  62         }
  63
  64         map.sid_name_use=sid_name_use;
  65         fstrcpy(map.nt_name, nt_name);
  66         fstrcpy(map.comment, comment);
  67
  68         return pdb_add_group_mapping_entry(&map);
  69 }
  70
  71 static NTSTATUS alias_memberships(const struct dom_sid *members, size_t num_members,
  72                                   struct dom_sid **sids, size_t *num)
  73 {
  74         size_t i;
  75
  76         *num = 0;
  77         *sids = NULL;
  78
  79         for (i=0; i<num_members; i++) {
  80                 NTSTATUS status = backend->one_alias_membership(&members[i], sids, num);
  81                 if (!NT_STATUS_IS_OK(status))
  82                         return status;
  83         }
  84         return NT_STATUS_OK;
  85 }
  86
  87 struct aliasmem_closure {
  88         const struct dom_sid *alias;
  89         struct dom_sid **sids;
  90         size_t *num;
  91 };
  92
  93
  94
  95 /*
  96  *
  97  * High level functions
  98  * better to use them than the lower ones.
  99  *
 100  * we are checking if the group is in the mapping file
 101  * and if the group is an existing unix group
 102  *
 103  */
 104
 105 /* get a domain group from it's SID */
 106
 107 bool get_domain_group_from_sid(struct dom_sid sid, GROUP_MAP *map)
 108 {
 109         struct group *grp;
 110         bool ret;
 111
 112         if(!init_group_mapping()) {
 113                 DEBUG(0,("failed to initialize group mapping\n"));
 114                 return(False);
 115         }
 116
 117         DEBUG(10, ("get_domain_group_from_sid\n"));
 118
 119         /* if the group is NOT in the database, it CAN NOT be a domain group */
 120
 121         become_root();
 122         ret = pdb_getgrsid(map, sid);
 123         unbecome_root();
 124
 125         /* special case check for rid 513 */
 126
 127         if ( !ret ) {
 128                 uint32 rid;
 129
 130                 sid_peek_rid( &sid, &rid );
 131
 132                 if ( rid == DOMAIN_RID_USERS ) {
 133                         fstrcpy( map->nt_name, "None" );
 134                         fstrcpy( map->comment, "Ordinary Users" );
 135                         sid_copy( &map->sid, &sid );
 136                         map->sid_name_use = SID_NAME_DOM_GRP;
 137                         map->gid = (gid_t)-1;
 138                         return True;
 139                 }
 140                 return False;
 141         }
 142
 143         DEBUG(10, ("get_domain_group_from_sid: SID found in passdb\n"));
 144
 145         /* if it's not a domain group, continue */
 146         if (map->sid_name_use!=SID_NAME_DOM_GRP) {
 147                 return False;
 148         }
 149
 150         DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
 151
 152         if (map->gid==-1) {
 153                 return False;
 154         }
 155
 156         DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid));
 157
 158         grp = getgrgid(map->gid);
 159         if ( !grp ) {
 160                 DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n"));
 161                 return False;
 162         }
 163
 164         DEBUG(10, ("get_domain_group_from_sid: gid exists in UNIX security\n"));
 165
 166         return True;
 167 }
 168
 169 /****************************************************************************
 170  Create a UNIX group on demand.
 171 ****************************************************************************/
 172
 173 int smb_create_group(const char *unix_group, gid_t *new_gid)
 174 {
 175         char *add_script = NULL;
 176         int     ret = -1;
 177         int     fd = 0;
 178
 179         *new_gid = 0;
 180
 181         /* defer to scripts */
 182
 183         if ( *lp_addgroup_script() ) {
 184                 TALLOC_CTX *ctx = talloc_tos();
 185
 186                 add_script = talloc_strdup(ctx,
 187                                         lp_addgroup_script());
 188                 if (!add_script) {
 189                         return -1;
 190                 }
 191                 add_script = talloc_string_sub(ctx,
 192                                 add_script, "%g", unix_group);
 193                 if (!add_script) {
 194                         return -1;
 195                 }
 196
 197                 ret = smbrun(add_script, &fd);
 198                 DEBUG(ret ? 0 : 3,("smb_create_group: Running the command `%s' gave %d\n",add_script,ret));
 199                 if (ret == 0) {
 200                         smb_nscd_flush_group_cache();
 201                 }
 202                 if (ret != 0)
 203                         return ret;
 204
 205                 if (fd != 0) {
 206                         fstring output;
 207
 208                         *new_gid = 0;
 209                         if (read(fd, output, sizeof(output)) > 0) {
 210                                 *new_gid = (gid_t)strtoul(output, NULL, 10);
 211                         }
 212
 213                         close(fd);
 214                 }
 215
 216         }
 217
 218         if (*new_gid == 0) {
 219                 struct group *grp = getgrnam(unix_group);
 220
 221                 if (grp != NULL)
 222                         *new_gid = grp->gr_gid;
 223         }
 224
 225         return ret;
 226 }
 227
 228 /****************************************************************************
 229  Delete a UNIX group on demand.
 230 ****************************************************************************/
 231
 232 int smb_delete_group(const char *unix_group)
 233 {
 234         char *del_script = NULL;
 235         int ret = -1;
 236
 237         /* defer to scripts */
 238
 239         if ( *lp_delgroup_script() ) {
 240                 TALLOC_CTX *ctx = talloc_tos();
 241
 242                 del_script = talloc_strdup(ctx,
 243                                 lp_delgroup_script());
 244                 if (!del_script) {
 245                         return -1;
 246                 }
 247                 del_script = talloc_string_sub(ctx,
 248                                 del_script, "%g", unix_group);
 249                 if (!del_script) {
 250                         return -1;
 251                 }
 252                 ret = smbrun(del_script,NULL);
 253                 DEBUG(ret ? 0 : 3,("smb_delete_group: Running the command `%s' gave %d\n",del_script,ret));
 254                 if (ret == 0) {
 255                         smb_nscd_flush_group_cache();
 256                 }
 257                 return ret;
 258         }
 259
 260         return -1;
 261 }
 262
 263 /****************************************************************************
 264  Set a user's primary UNIX group.
 265 ****************************************************************************/
 266
 267 int smb_set_primary_group(const char *unix_group, const char* unix_user)
 268 {
 269         char *add_script = NULL;
 270         int ret = -1;
 271
 272         /* defer to scripts */
 273
 274         if ( *lp_setprimarygroup_script() ) {
 275                 TALLOC_CTX *ctx = talloc_tos();
 276
 277                 add_script = talloc_strdup(ctx,
 278                                 lp_setprimarygroup_script());
 279                 if (!add_script) {
 280                         return -1;
 281                 }
 282                 add_script = talloc_all_string_sub(ctx,
 283                                 add_script, "%g", unix_group);
 284                 if (!add_script) {
 285                         return -1;
 286                 }
 287                 add_script = talloc_string_sub(ctx,
 288                                 add_script, "%u", unix_user);
 289                 if (!add_script) {
 290                         return -1;
 291                 }
 292                 ret = smbrun(add_script,NULL);
 293                 flush_pwnam_cache();
 294                 DEBUG(ret ? 0 : 3,("smb_set_primary_group: "
 295                          "Running the command `%s' gave %d\n",add_script,ret));
 296                 if (ret == 0) {
 297                         smb_nscd_flush_group_cache();
 298                 }
 299                 return ret;
 300         }
 301
 302         return -1;
 303 }
 304
 305 /****************************************************************************
 306  Add a user to a UNIX group.
 307 ****************************************************************************/
 308
 309 int smb_add_user_group(const char *unix_group, const char *unix_user)
 310 {
 311         char *add_script = NULL;
 312         int ret = -1;
 313
 314         /* defer to scripts */
 315
 316         if ( *lp_addusertogroup_script() ) {
 317                 TALLOC_CTX *ctx = talloc_tos();
 318
 319                 add_script = talloc_strdup(ctx,
 320                                 lp_addusertogroup_script());
 321                 if (!add_script) {
 322                         return -1;
 323                 }
 324                 add_script = talloc_string_sub(ctx,
 325                                 add_script, "%g", unix_group);
 326                 if (!add_script) {
 327                         return -1;
 328                 }
 329                 add_script = talloc_string_sub2(ctx,
 330                                 add_script, "%u", unix_user, true, false, true);
 331                 if (!add_script) {
 332                         return -1;
 333                 }
 334                 ret = smbrun(add_script,NULL);
 335                 DEBUG(ret ? 0 : 3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script,ret));
 336                 if (ret == 0) {
 337                         smb_nscd_flush_group_cache();
 338                 }
 339                 return ret;
 340         }
 341
 342         return -1;
 343 }
 344
 345 /****************************************************************************
 346  Delete a user from a UNIX group
 347 ****************************************************************************/
 348
 349 int smb_delete_user_group(const char *unix_group, const char *unix_user)
 350 {
 351         char *del_script = NULL;
 352         int ret = -1;
 353
 354         /* defer to scripts */
 355
 356         if ( *lp_deluserfromgroup_script() ) {
 357                 TALLOC_CTX *ctx = talloc_tos();
 358
 359                 del_script = talloc_strdup(ctx,
 360                                 lp_deluserfromgroup_script());
 361                 if (!del_script) {
 362                         return -1;
 363                 }
 364                 del_script = talloc_string_sub(ctx,
 365                                 del_script, "%g", unix_group);
 366                 if (!del_script) {
 367                         return -1;
 368                 }
 369                 del_script = talloc_string_sub2(ctx,
 370                                 del_script, "%u", unix_user, true, false, true);
 371                 if (!del_script) {
 372                         return -1;
 373                 }
 374                 ret = smbrun(del_script,NULL);
 375                 DEBUG(ret ? 0 : 3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script,ret));
 376                 if (ret == 0) {
 377                         smb_nscd_flush_group_cache();
 378                 }
 379                 return ret;
 380         }
 381
 382         return -1;
 383 }
 384
 385
 386 NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
 387                                  struct dom_sid sid)
 388 {
 389         if (!init_group_mapping()) {
 390                 DEBUG(0,("failed to initialize group mapping\n"));
 391                 return NT_STATUS_UNSUCCESSFUL;
 392         }
 393         return backend->get_group_map_from_sid(sid, map) ?
 394                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 395 }
 396
 397 NTSTATUS pdb_default_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
 398                                  gid_t gid)
 399 {
 400         if (!init_group_mapping()) {
 401                 DEBUG(0,("failed to initialize group mapping\n"));
 402                 return NT_STATUS_UNSUCCESSFUL;
 403         }
 404         return backend->get_group_map_from_gid(gid, map) ?
 405                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 406 }
 407
 408 NTSTATUS pdb_default_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
 409                                  const char *name)
 410 {
 411         if (!init_group_mapping()) {
 412                 DEBUG(0,("failed to initialize group mapping\n"));
 413                 return NT_STATUS_UNSUCCESSFUL;
 414         }
 415         return backend->get_group_map_from_ntname(name, map) ?
 416                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 417 }
 418
 419 NTSTATUS pdb_default_add_group_mapping_entry(struct pdb_methods *methods,
 420                                                 GROUP_MAP *map)
 421 {
 422         if (!init_group_mapping()) {
 423                 DEBUG(0,("failed to initialize group mapping\n"));
 424                 return NT_STATUS_UNSUCCESSFUL;
 425         }
 426         return backend->add_mapping_entry(map, TDB_INSERT) ?
 427                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 428 }
 429
 430 NTSTATUS pdb_default_update_group_mapping_entry(struct pdb_methods *methods,
 431                                                    GROUP_MAP *map)
 432 {
 433         if (!init_group_mapping()) {
 434                 DEBUG(0,("failed to initialize group mapping\n"));
 435                 return NT_STATUS_UNSUCCESSFUL;
 436         }
 437         return backend->add_mapping_entry(map, TDB_REPLACE) ?
 438                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 439 }
 440
 441 NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods,
 442                                                    struct dom_sid sid)
 443 {
 444         if (!init_group_mapping()) {
 445                 DEBUG(0,("failed to initialize group mapping\n"));
 446                 return NT_STATUS_UNSUCCESSFUL;
 447         }
 448         return backend->group_map_remove(&sid) ?
 449                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 450 }
 451
 452 NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
 453                                            const struct dom_sid *sid, enum lsa_SidType sid_name_use,
 454                                            GROUP_MAP **pp_rmap, size_t *p_num_entries,
 455                                            bool unix_only)
 456 {
 457         if (!init_group_mapping()) {
 458                 DEBUG(0,("failed to initialize group mapping\n"));
 459                 return NT_STATUS_UNSUCCESSFUL;
 460         }
 461         return backend->enum_group_mapping(sid, sid_name_use, pp_rmap, p_num_entries, unix_only) ?
 462                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 463 }
 464
 465 NTSTATUS pdb_default_create_alias(struct pdb_methods *methods,
 466                                   const char *name, uint32 *rid)
 467 {
 468         struct dom_sid sid;
 469         enum lsa_SidType type;
 470         uint32 new_rid;
 471         gid_t gid;
 472         bool exists;
 473         GROUP_MAP map;
 474         TALLOC_CTX *mem_ctx;
 475         NTSTATUS status;
 476
 477         DEBUG(10, ("Trying to create alias %s\n", name));
 478
 479         mem_ctx = talloc_new(NULL);
 480         if (mem_ctx == NULL) {
 481                 return NT_STATUS_NO_MEMORY;
 482         }
 483
 484         exists = lookup_name(mem_ctx, name, LOOKUP_NAME_LOCAL,
 485                              NULL, NULL, &sid, &type);
 486         TALLOC_FREE(mem_ctx);
 487
 488         if (exists) {
 489                 return NT_STATUS_ALIAS_EXISTS;
 490         }
 491
 492         if (!pdb_new_rid(&new_rid)) {
 493                 DEBUG(0, ("Could not allocate a RID.\n"));
 494                 return NT_STATUS_ACCESS_DENIED;
 495         }
 496
 497         sid_compose(&sid, get_global_sam_sid(), new_rid);
 498
 499         if (!winbind_allocate_gid(&gid)) {
 500                 DEBUG(3, ("Could not get a gid out of winbind - "
 501                           "wasted a rid :-(\n"));
 502                 return NT_STATUS_ACCESS_DENIED;
 503         }
 504
 505         DEBUG(10, ("Creating alias %s with gid %u and rid %u\n",
 506                    name, (unsigned int)gid, (unsigned int)new_rid));
 507
 508         map.gid = gid;
 509         sid_copy(&map.sid, &sid);
 510         map.sid_name_use = SID_NAME_ALIAS;
 511         fstrcpy(map.nt_name, name);
 512         fstrcpy(map.comment, "");
 513
 514         status = pdb_add_group_mapping_entry(&map);
 515
 516         if (!NT_STATUS_IS_OK(status)) {
 517                 DEBUG(0, ("Could not add group mapping entry for alias %s "
 518                           "(%s)\n", name, nt_errstr(status)));
 519                 return status;
 520         }
 521
 522         *rid = new_rid;
 523
 524         return NT_STATUS_OK;
 525 }
 526
 527 NTSTATUS pdb_default_delete_alias(struct pdb_methods *methods,
 528                                   const struct dom_sid *sid)
 529 {
 530         return pdb_delete_group_mapping_entry(*sid);
 531 }
 532
 533 NTSTATUS pdb_default_get_aliasinfo(struct pdb_methods *methods,
 534                                    const struct dom_sid *sid,
 535                                    struct acct_info *info)
 536 {
 537         GROUP_MAP map;
 538
 539         if (!pdb_getgrsid(&map, *sid))
 540                 return NT_STATUS_NO_SUCH_ALIAS;
 541
 542         if ((map.sid_name_use != SID_NAME_ALIAS) &&
 543             (map.sid_name_use != SID_NAME_WKN_GRP)) {
 544                 DEBUG(2, ("%s is a %s, expected an alias\n",
 545                           sid_string_dbg(sid),
 546                           sid_type_lookup(map.sid_name_use)));
 547                 return NT_STATUS_NO_SUCH_ALIAS;
 548         }
 549
 550         fstrcpy(info->acct_name, map.nt_name);
 551         fstrcpy(info->acct_desc, map.comment);
 552         sid_peek_rid(&map.sid, &info->rid);
 553         return NT_STATUS_OK;
 554 }
 555
 556 NTSTATUS pdb_default_set_aliasinfo(struct pdb_methods *methods,
 557                                    const struct dom_sid *sid,
 558                                    struct acct_info *info)
 559 {
 560         GROUP_MAP map;
 561
 562         if (!pdb_getgrsid(&map, *sid))
 563                 return NT_STATUS_NO_SUCH_ALIAS;
 564
 565         fstrcpy(map.nt_name, info->acct_name);
 566         fstrcpy(map.comment, info->acct_desc);
 567
 568         return pdb_update_group_mapping_entry(&map);
 569 }
 570
 571 NTSTATUS pdb_default_add_aliasmem(struct pdb_methods *methods,
 572                                   const struct dom_sid *alias, const struct dom_sid *member)
 573 {
 574         if (!init_group_mapping()) {
 575                 DEBUG(0,("failed to initialize group mapping\n"));
 576                 return NT_STATUS_UNSUCCESSFUL;
 577         }
 578         return backend->add_aliasmem(alias, member);
 579 }
 580
 581 NTSTATUS pdb_default_del_aliasmem(struct pdb_methods *methods,
 582                                   const struct dom_sid *alias, const struct dom_sid *member)
 583 {
 584         if (!init_group_mapping()) {
 585                 DEBUG(0,("failed to initialize group mapping\n"));
 586                 return NT_STATUS_UNSUCCESSFUL;
 587         }
 588         return backend->del_aliasmem(alias, member);
 589 }
 590
 591 NTSTATUS pdb_default_enum_aliasmem(struct pdb_methods *methods,
 592                                    const struct dom_sid *alias, TALLOC_CTX *mem_ctx,
 593                                    struct dom_sid **pp_members, size_t *p_num_members)
 594 {
 595         if (!init_group_mapping()) {
 596                 DEBUG(0,("failed to initialize group mapping\n"));
 597                 return NT_STATUS_UNSUCCESSFUL;
 598         }
 599         return backend->enum_aliasmem(alias, mem_ctx, pp_members,
 600                                       p_num_members);
 601 }
 602
 603 NTSTATUS pdb_default_alias_memberships(struct pdb_methods *methods,
 604                                        TALLOC_CTX *mem_ctx,
 605                                        const struct dom_sid *domain_sid,
 606                                        const struct dom_sid *members,
 607                                        size_t num_members,
 608                                        uint32 **pp_alias_rids,
 609                                        size_t *p_num_alias_rids)
 610 {
 611         struct dom_sid *alias_sids;
 612         size_t i, num_alias_sids;
 613         NTSTATUS result;
 614
 615         if (!init_group_mapping()) {
 616                 DEBUG(0,("failed to initialize group mapping\n"));
 617                 return NT_STATUS_UNSUCCESSFUL;
 618         }
 619
 620         alias_sids = NULL;
 621         num_alias_sids = 0;
 622
 623         result = alias_memberships(members, num_members,
 624                                    &alias_sids, &num_alias_sids);
 625
 626         if (!NT_STATUS_IS_OK(result))
 627                 return result;
 628
 629         *p_num_alias_rids = 0;
 630
 631         if (num_alias_sids == 0) {
 632                 TALLOC_FREE(alias_sids);
 633                 return NT_STATUS_OK;
 634         }
 635
 636         *pp_alias_rids = TALLOC_ARRAY(mem_ctx, uint32, num_alias_sids);
 637         if (*pp_alias_rids == NULL)
 638                 return NT_STATUS_NO_MEMORY;
 639
 640         for (i=0; i<num_alias_sids; i++) {
 641                 if (!sid_peek_check_rid(domain_sid, &alias_sids[i],
 642                                         &(*pp_alias_rids)[*p_num_alias_rids]))
 643                         continue;
 644                 *p_num_alias_rids += 1;
 645         }
 646
 647         TALLOC_FREE(alias_sids);
 648
 649         return NT_STATUS_OK;
 650 }
 651
 652 /**********************************************************************
 653  no ops for passdb backends that don't implement group mapping
 654  *********************************************************************/
 655
 656 NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
 657                                  struct dom_sid sid)
 658 {
 659         return NT_STATUS_UNSUCCESSFUL;
 660 }
 661
 662 NTSTATUS pdb_nop_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
 663                                  gid_t gid)
 664 {
 665         return NT_STATUS_UNSUCCESSFUL;
 666 }
 667
 668 NTSTATUS pdb_nop_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
 669                                  const char *name)
 670 {
 671         return NT_STATUS_UNSUCCESSFUL;
 672 }
 673
 674 NTSTATUS pdb_nop_add_group_mapping_entry(struct pdb_methods *methods,
 675                                                 GROUP_MAP *map)
 676 {
 677         return NT_STATUS_UNSUCCESSFUL;
 678 }
 679
 680 NTSTATUS pdb_nop_update_group_mapping_entry(struct pdb_methods *methods,
 681                                                    GROUP_MAP *map)
 682 {
 683         return NT_STATUS_UNSUCCESSFUL;
 684 }
 685
 686 NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods,
 687                                                    struct dom_sid sid)
 688 {
 689         return NT_STATUS_UNSUCCESSFUL;
 690 }
 691
 692 NTSTATUS pdb_nop_enum_group_mapping(struct pdb_methods *methods,
 693                                            enum lsa_SidType sid_name_use,
 694                                            GROUP_MAP **rmap, size_t *num_entries,
 695                                            bool unix_only)
 696 {
 697         return NT_STATUS_UNSUCCESSFUL;
 698 }
 699
 700 /****************************************************************************
 701  These need to be redirected through pdb_interface.c
 702 ****************************************************************************/
 703 bool pdb_get_dom_grp_info(const struct dom_sid *sid, struct acct_info *info)
 704 {
 705         GROUP_MAP map;
 706         bool res;
 707
 708         become_root();
 709         res = get_domain_group_from_sid(*sid, &map);
 710         unbecome_root();
 711
 712         if (!res)
 713                 return False;
 714
 715         fstrcpy(info->acct_name, map.nt_name);
 716         fstrcpy(info->acct_desc, map.comment);
 717         sid_peek_rid(sid, &info->rid);
 718         return True;
 719 }
 720
 721 bool pdb_set_dom_grp_info(const struct dom_sid *sid, const struct acct_info *info)
 722 {
 723         GROUP_MAP map;
 724
 725         if (!get_domain_group_from_sid(*sid, &map))
 726                 return False;
 727
 728         fstrcpy(map.nt_name, info->acct_name);
 729         fstrcpy(map.comment, info->acct_desc);
 730
 731         return NT_STATUS_IS_OK(pdb_update_group_mapping_entry(&map));
 732 }
 733
 734 /********************************************************************
 735  Really just intended to be called by smbd
 736 ********************************************************************/
 737
 738 NTSTATUS pdb_create_builtin_alias(uint32 rid)
 739 {
 740         struct dom_sid sid;
 741         enum lsa_SidType type;
 742         gid_t gid;
 743         GROUP_MAP map;
 744         TALLOC_CTX *mem_ctx;
 745         NTSTATUS status;
 746         const char *name = NULL;
 747         fstring groupname;
 748
 749         DEBUG(10, ("Trying to create builtin alias %d\n", rid));
 750
 751         if ( !sid_compose( &sid, &global_sid_Builtin, rid ) ) {
 752                 return NT_STATUS_NO_SUCH_ALIAS;
 753         }
 754
 755         if ( (mem_ctx = talloc_new(NULL)) == NULL ) {
 756                 return NT_STATUS_NO_MEMORY;
 757         }
 758
 759         if ( !lookup_sid(mem_ctx, &sid, NULL, &name, &type) ) {
 760                 TALLOC_FREE( mem_ctx );
 761                 return NT_STATUS_NO_SUCH_ALIAS;
 762         }
 763
 764         /* validate RID so copy the name and move on */
 765
 766         fstrcpy( groupname, name );
 767         TALLOC_FREE( mem_ctx );
 768
 769         if (!winbind_allocate_gid(&gid)) {
 770                 DEBUG(3, ("pdb_create_builtin_alias: Could not get a gid out of winbind\n"));
 771                 return NT_STATUS_ACCESS_DENIED;
 772         }
 773
 774         DEBUG(10,("Creating alias %s with gid %u\n", groupname, (unsigned int)gid));
 775
 776         map.gid = gid;
 777         sid_copy(&map.sid, &sid);
 778         map.sid_name_use = SID_NAME_ALIAS;
 779         fstrcpy(map.nt_name, groupname);
 780         fstrcpy(map.comment, "");
 781
 782         status = pdb_add_group_mapping_entry(&map);
 783
 784         if (!NT_STATUS_IS_OK(status)) {
 785                 DEBUG(0, ("pdb_create_builtin_alias: Could not add group mapping entry for alias %d "
 786                           "(%s)\n", rid, nt_errstr(status)));
 787         }
 788
 789         return status;
 790 }
 791
 792