source3/groupdb/mapping.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-2000,
   5  *  Copyright (C) Jean François Micouleau      1998-2001.
   6  *  Copyright (C) Volker Lendecke              2006.
   7  *  Copyright (C) Gerald Carter                2006.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 3 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  21  */
  22
  23 #include "includes.h"
  24 #include "groupdb/mapping.h"
  25
  26 static const struct mapping_backend *backend;
  27
  28 /*
  29   initialise a group mapping backend
  30  */
  31 static bool init_group_mapping(void)
  32 {
  33         if (backend != NULL) {
  34                 /* already initialised */
  35                 return True;
  36         }
  37
  38         backend = groupdb_ldb_init();
  39
  40         return backend != NULL;
  41 }
  42
  43 /****************************************************************************
  44 initialise first time the mapping list
  45 ****************************************************************************/
  46 NTSTATUS add_initial_entry(gid_t gid, const char *sid, enum lsa_SidType sid_name_use, const char *nt_name, const char *comment)
  47 {
  48         GROUP_MAP map;
  49
  50         if(!init_group_mapping()) {
  51                 DEBUG(0,("failed to initialize group mapping\n"));
  52                 return NT_STATUS_UNSUCCESSFUL;
  53         }
  54
  55         map.gid=gid;
  56         if (!string_to_sid(&map.sid, sid)) {
  57                 DEBUG(0, ("string_to_sid failed: %s", sid));
  58                 return NT_STATUS_UNSUCCESSFUL;
  59         }
  60
  61         map.sid_name_use=sid_name_use;
  62         fstrcpy(map.nt_name, nt_name);
  63         fstrcpy(map.comment, comment);
  64
  65         return pdb_add_group_mapping_entry(&map);
  66 }
  67
  68 static NTSTATUS alias_memberships(const DOM_SID *members, size_t num_members,
  69                                   DOM_SID **sids, size_t *num)
  70 {
  71         size_t i;
  72
  73         *num = 0;
  74         *sids = NULL;
  75
  76         for (i=0; i<num_members; i++) {
  77                 NTSTATUS status = backend->one_alias_membership(&members[i], sids, num);
  78                 if (!NT_STATUS_IS_OK(status))
  79                         return status;
  80         }
  81         return NT_STATUS_OK;
  82 }
  83
  84 struct aliasmem_closure {
  85         const DOM_SID *alias;
  86         DOM_SID **sids;
  87         size_t *num;
  88 };
  89
  90
  91
  92 /*
  93  *
  94  * High level functions
  95  * better to use them than the lower ones.
  96  *
  97  * we are checking if the group is in the mapping file
  98  * and if the group is an existing unix group
  99  *
 100  */
 101
 102 /* get a domain group from it's SID */
 103
 104 bool get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map)
 105 {
 106         struct group *grp;
 107         bool ret;
 108
 109         if(!init_group_mapping()) {
 110                 DEBUG(0,("failed to initialize group mapping\n"));
 111                 return(False);
 112         }
 113
 114         DEBUG(10, ("get_domain_group_from_sid\n"));
 115
 116         /* if the group is NOT in the database, it CAN NOT be a domain group */
 117
 118         become_root();
 119         ret = pdb_getgrsid(map, sid);
 120         unbecome_root();
 121
 122         /* special case check for rid 513 */
 123
 124         if ( !ret ) {
 125                 uint32 rid;
 126
 127                 sid_peek_rid( &sid, &rid );
 128
 129                 if ( rid == DOMAIN_GROUP_RID_USERS ) {
 130                         fstrcpy( map->nt_name, "None" );
 131                         fstrcpy( map->comment, "Ordinary Users" );
 132                         sid_copy( &map->sid, &sid );
 133                         map->sid_name_use = SID_NAME_DOM_GRP;
 134                         map->gid = (gid_t)-1;
 135
 136                         return True;
 137                 }
 138
 139                 return False;
 140         }
 141
 142         DEBUG(10, ("get_domain_group_from_sid: SID found in the TDB\n"));
 143
 144         /* if it's not a domain group, continue */
 145         if (map->sid_name_use!=SID_NAME_DOM_GRP) {
 146                 return False;
 147         }
 148
 149         DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
 150
 151         if (map->gid==-1) {
 152                 return False;
 153         }
 154
 155         DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid));
 156
 157         grp = getgrgid(map->gid);
 158         if ( !grp ) {
 159                 DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n"));
 160                 return False;
 161         }
 162
 163         DEBUG(10, ("get_domain_group_from_sid: gid exists in UNIX security\n"));
 164
 165         return True;
 166 }
 167
 168 /****************************************************************************
 169  Create a UNIX group on demand.
 170 ****************************************************************************/
 171
 172 int smb_create_group(const char *unix_group, gid_t *new_gid)
 173 {
 174         pstring add_script;
 175         int     ret = -1;
 176         int     fd = 0;
 177
 178         *new_gid = 0;
 179
 180         /* defer to scripts */
 181
 182         if ( *lp_addgroup_script() ) {
 183                 pstrcpy(add_script, lp_addgroup_script());
 184                 pstring_sub(add_script, "%g", unix_group);
 185                 ret = smbrun(add_script, &fd);
 186                 DEBUG(ret ? 0 : 3,("smb_create_group: Running the command `%s' gave %d\n",add_script,ret));
 187                 if (ret == 0) {
 188                         smb_nscd_flush_group_cache();
 189                 }
 190                 if (ret != 0)
 191                         return ret;
 192
 193                 if (fd != 0) {
 194                         fstring output;
 195
 196                         *new_gid = 0;
 197                         if (read(fd, output, sizeof(output)) > 0) {
 198                                 *new_gid = (gid_t)strtoul(output, NULL, 10);
 199                         }
 200
 201                         close(fd);
 202                 }
 203
 204         }
 205
 206         if (*new_gid == 0) {
 207                 struct group *grp = getgrnam(unix_group);
 208
 209                 if (grp != NULL)
 210                         *new_gid = grp->gr_gid;
 211         }
 212
 213         return ret;
 214 }
 215
 216 /****************************************************************************
 217  Delete a UNIX group on demand.
 218 ****************************************************************************/
 219
 220 int smb_delete_group(const char *unix_group)
 221 {
 222         pstring del_script;
 223         int ret;
 224
 225         /* defer to scripts */
 226
 227         if ( *lp_delgroup_script() ) {
 228                 pstrcpy(del_script, lp_delgroup_script());
 229                 pstring_sub(del_script, "%g", unix_group);
 230                 ret = smbrun(del_script,NULL);
 231                 DEBUG(ret ? 0 : 3,("smb_delete_group: Running the command `%s' gave %d\n",del_script,ret));
 232                 if (ret == 0) {
 233                         smb_nscd_flush_group_cache();
 234                 }
 235                 return ret;
 236         }
 237
 238         return -1;
 239 }
 240
 241 /****************************************************************************
 242  Set a user's primary UNIX group.
 243 ****************************************************************************/
 244 int smb_set_primary_group(const char *unix_group, const char* unix_user)
 245 {
 246         pstring add_script;
 247         int ret;
 248
 249         /* defer to scripts */
 250
 251         if ( *lp_setprimarygroup_script() ) {
 252                 pstrcpy(add_script, lp_setprimarygroup_script());
 253                 all_string_sub(add_script, "%g", unix_group, sizeof(add_script));
 254                 all_string_sub(add_script, "%u", unix_user, sizeof(add_script));
 255                 ret = smbrun(add_script,NULL);
 256                 flush_pwnam_cache();
 257                 DEBUG(ret ? 0 : 3,("smb_set_primary_group: "
 258                          "Running the command `%s' gave %d\n",add_script,ret));
 259                 if (ret == 0) {
 260                         smb_nscd_flush_group_cache();
 261                 }
 262                 return ret;
 263         }
 264
 265         return -1;
 266 }
 267
 268 /****************************************************************************
 269  Add a user to a UNIX group.
 270 ****************************************************************************/
 271
 272 int smb_add_user_group(const char *unix_group, const char *unix_user)
 273 {
 274         pstring add_script;
 275         int ret;
 276
 277         /* defer to scripts */
 278
 279         if ( *lp_addusertogroup_script() ) {
 280                 pstrcpy(add_script, lp_addusertogroup_script());
 281                 pstring_sub(add_script, "%g", unix_group);
 282                 pstring_sub(add_script, "%u", unix_user);
 283                 ret = smbrun(add_script,NULL);
 284                 DEBUG(ret ? 0 : 3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script,ret));
 285                 if (ret == 0) {
 286                         smb_nscd_flush_group_cache();
 287                 }
 288                 return ret;
 289         }
 290
 291         return -1;
 292 }
 293
 294 /****************************************************************************
 295  Delete a user from a UNIX group
 296 ****************************************************************************/
 297
 298 int smb_delete_user_group(const char *unix_group, const char *unix_user)
 299 {
 300         pstring del_script;
 301         int ret;
 302
 303         /* defer to scripts */
 304
 305         if ( *lp_deluserfromgroup_script() ) {
 306                 pstrcpy(del_script, lp_deluserfromgroup_script());
 307                 pstring_sub(del_script, "%g", unix_group);
 308                 pstring_sub(del_script, "%u", unix_user);
 309                 ret = smbrun(del_script,NULL);
 310                 DEBUG(ret ? 0 : 3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script,ret));
 311                 if (ret == 0) {
 312                         smb_nscd_flush_group_cache();
 313                 }
 314                 return ret;
 315         }
 316
 317         return -1;
 318 }
 319
 320
 321 NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
 322                                  DOM_SID sid)
 323 {
 324         if (!init_group_mapping()) {
 325                 DEBUG(0,("failed to initialize group mapping\n"));
 326                 return NT_STATUS_UNSUCCESSFUL;
 327         }
 328         return backend->get_group_map_from_sid(sid, map) ?
 329                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 330 }
 331
 332 NTSTATUS pdb_default_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
 333                                  gid_t gid)
 334 {
 335         if (!init_group_mapping()) {
 336                 DEBUG(0,("failed to initialize group mapping\n"));
 337                 return NT_STATUS_UNSUCCESSFUL;
 338         }
 339         return backend->get_group_map_from_gid(gid, map) ?
 340                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 341 }
 342
 343 NTSTATUS pdb_default_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
 344                                  const char *name)
 345 {
 346         if (!init_group_mapping()) {
 347                 DEBUG(0,("failed to initialize group mapping\n"));
 348                 return NT_STATUS_UNSUCCESSFUL;
 349         }
 350         return backend->get_group_map_from_ntname(name, map) ?
 351                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 352 }
 353
 354 NTSTATUS pdb_default_add_group_mapping_entry(struct pdb_methods *methods,
 355                                                 GROUP_MAP *map)
 356 {
 357         if (!init_group_mapping()) {
 358                 DEBUG(0,("failed to initialize group mapping\n"));
 359                 return NT_STATUS_UNSUCCESSFUL;
 360         }
 361         return backend->add_mapping_entry(map, TDB_INSERT) ?
 362                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 363 }
 364
 365 NTSTATUS pdb_default_update_group_mapping_entry(struct pdb_methods *methods,
 366                                                    GROUP_MAP *map)
 367 {
 368         if (!init_group_mapping()) {
 369                 DEBUG(0,("failed to initialize group mapping\n"));
 370                 return NT_STATUS_UNSUCCESSFUL;
 371         }
 372         return backend->add_mapping_entry(map, TDB_REPLACE) ?
 373                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 374 }
 375
 376 NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods,
 377                                                    DOM_SID sid)
 378 {
 379         if (!init_group_mapping()) {
 380                 DEBUG(0,("failed to initialize group mapping\n"));
 381                 return NT_STATUS_UNSUCCESSFUL;
 382         }
 383         return backend->group_map_remove(&sid) ?
 384                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 385 }
 386
 387 NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
 388                                            const DOM_SID *sid, enum lsa_SidType sid_name_use,
 389                                            GROUP_MAP **pp_rmap, size_t *p_num_entries,
 390                                            bool unix_only)
 391 {
 392         if (!init_group_mapping()) {
 393                 DEBUG(0,("failed to initialize group mapping\n"));
 394                 return NT_STATUS_UNSUCCESSFUL;
 395         }
 396         return backend->enum_group_mapping(sid, sid_name_use, pp_rmap, p_num_entries, unix_only) ?
 397                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 398 }
 399
 400 NTSTATUS pdb_default_create_alias(struct pdb_methods *methods,
 401                                   const char *name, uint32 *rid)
 402 {
 403         DOM_SID sid;
 404         enum lsa_SidType type;
 405         uint32 new_rid;
 406         gid_t gid;
 407         bool exists;
 408         GROUP_MAP map;
 409         TALLOC_CTX *mem_ctx;
 410         NTSTATUS status;
 411
 412         DEBUG(10, ("Trying to create alias %s\n", name));
 413
 414         mem_ctx = talloc_new(NULL);
 415         if (mem_ctx == NULL) {
 416                 return NT_STATUS_NO_MEMORY;
 417         }
 418
 419         exists = lookup_name(mem_ctx, name, LOOKUP_NAME_ISOLATED,
 420                              NULL, NULL, &sid, &type);
 421         TALLOC_FREE(mem_ctx);
 422
 423         if (exists) {
 424                 return NT_STATUS_ALIAS_EXISTS;
 425         }
 426
 427         if (!winbind_allocate_gid(&gid)) {
 428                 DEBUG(3, ("Could not get a gid out of winbind\n"));
 429                 return NT_STATUS_ACCESS_DENIED;
 430         }
 431
 432         if (!pdb_new_rid(&new_rid)) {
 433                 DEBUG(0, ("Could not allocate a RID -- wasted a gid :-(\n"));
 434                 return NT_STATUS_ACCESS_DENIED;
 435         }
 436
 437         DEBUG(10, ("Creating alias %s with gid %d and rid %d\n",
 438                    name, gid, new_rid));
 439
 440         sid_copy(&sid, get_global_sam_sid());
 441         sid_append_rid(&sid, new_rid);
 442
 443         map.gid = gid;
 444         sid_copy(&map.sid, &sid);
 445         map.sid_name_use = SID_NAME_ALIAS;
 446         fstrcpy(map.nt_name, name);
 447         fstrcpy(map.comment, "");
 448
 449         status = pdb_add_group_mapping_entry(&map);
 450
 451         if (!NT_STATUS_IS_OK(status)) {
 452                 DEBUG(0, ("Could not add group mapping entry for alias %s "
 453                           "(%s)\n", name, nt_errstr(status)));
 454                 return status;
 455         }
 456
 457         *rid = new_rid;
 458
 459         return NT_STATUS_OK;
 460 }
 461
 462 NTSTATUS pdb_default_delete_alias(struct pdb_methods *methods,
 463                                   const DOM_SID *sid)
 464 {
 465         return pdb_delete_group_mapping_entry(*sid);
 466 }
 467
 468 NTSTATUS pdb_default_get_aliasinfo(struct pdb_methods *methods,
 469                                    const DOM_SID *sid,
 470                                    struct acct_info *info)
 471 {
 472         GROUP_MAP map;
 473
 474         if (!pdb_getgrsid(&map, *sid))
 475                 return NT_STATUS_NO_SUCH_ALIAS;
 476
 477         if ((map.sid_name_use != SID_NAME_ALIAS) &&
 478             (map.sid_name_use != SID_NAME_WKN_GRP)) {
 479                 DEBUG(2, ("%s is a %s, expected an alias\n",
 480                           sid_string_static(sid),
 481                           sid_type_lookup(map.sid_name_use)));
 482                 return NT_STATUS_NO_SUCH_ALIAS;
 483         }
 484
 485         fstrcpy(info->acct_name, map.nt_name);
 486         fstrcpy(info->acct_desc, map.comment);
 487         sid_peek_rid(&map.sid, &info->rid);
 488         return NT_STATUS_OK;
 489 }
 490
 491 NTSTATUS pdb_default_set_aliasinfo(struct pdb_methods *methods,
 492                                    const DOM_SID *sid,
 493                                    struct acct_info *info)
 494 {
 495         GROUP_MAP map;
 496
 497         if (!pdb_getgrsid(&map, *sid))
 498                 return NT_STATUS_NO_SUCH_ALIAS;
 499
 500         fstrcpy(map.nt_name, info->acct_name);
 501         fstrcpy(map.comment, info->acct_desc);
 502
 503         return pdb_update_group_mapping_entry(&map);
 504 }
 505
 506 NTSTATUS pdb_default_add_aliasmem(struct pdb_methods *methods,
 507                                   const DOM_SID *alias, const DOM_SID *member)
 508 {
 509         if (!init_group_mapping()) {
 510                 DEBUG(0,("failed to initialize group mapping\n"));
 511                 return NT_STATUS_UNSUCCESSFUL;
 512         }
 513         return backend->add_aliasmem(alias, member);
 514 }
 515
 516 NTSTATUS pdb_default_del_aliasmem(struct pdb_methods *methods,
 517                                   const DOM_SID *alias, const DOM_SID *member)
 518 {
 519         if (!init_group_mapping()) {
 520                 DEBUG(0,("failed to initialize group mapping\n"));
 521                 return NT_STATUS_UNSUCCESSFUL;
 522         }
 523         return backend->del_aliasmem(alias, member);
 524 }
 525
 526 NTSTATUS pdb_default_enum_aliasmem(struct pdb_methods *methods,
 527                                    const DOM_SID *alias, DOM_SID **pp_members,
 528                                    size_t *p_num_members)
 529 {
 530         if (!init_group_mapping()) {
 531                 DEBUG(0,("failed to initialize group mapping\n"));
 532                 return NT_STATUS_UNSUCCESSFUL;
 533         }
 534         return backend->enum_aliasmem(alias, pp_members, p_num_members);
 535 }
 536
 537 NTSTATUS pdb_default_alias_memberships(struct pdb_methods *methods,
 538                                        TALLOC_CTX *mem_ctx,
 539                                        const DOM_SID *domain_sid,
 540                                        const DOM_SID *members,
 541                                        size_t num_members,
 542                                        uint32 **pp_alias_rids,
 543                                        size_t *p_num_alias_rids)
 544 {
 545         DOM_SID *alias_sids;
 546         size_t i, num_alias_sids;
 547         NTSTATUS result;
 548
 549         if (!init_group_mapping()) {
 550                 DEBUG(0,("failed to initialize group mapping\n"));
 551                 return NT_STATUS_UNSUCCESSFUL;
 552         }
 553
 554         alias_sids = NULL;
 555         num_alias_sids = 0;
 556
 557         result = alias_memberships(members, num_members,
 558                                    &alias_sids, &num_alias_sids);
 559
 560         if (!NT_STATUS_IS_OK(result))
 561                 return result;
 562
 563         *p_num_alias_rids = 0;
 564
 565         if (num_alias_sids == 0) {
 566                 TALLOC_FREE(alias_sids);
 567                 return NT_STATUS_OK;
 568         }
 569
 570         *pp_alias_rids = TALLOC_ARRAY(mem_ctx, uint32, num_alias_sids);
 571         if (*pp_alias_rids == NULL)
 572                 return NT_STATUS_NO_MEMORY;
 573
 574         for (i=0; i<num_alias_sids; i++) {
 575                 if (!sid_peek_check_rid(domain_sid, &alias_sids[i],
 576                                         &(*pp_alias_rids)[*p_num_alias_rids]))
 577                         continue;
 578                 *p_num_alias_rids += 1;
 579         }
 580
 581         TALLOC_FREE(alias_sids);
 582
 583         return NT_STATUS_OK;
 584 }
 585
 586 /**********************************************************************
 587  no ops for passdb backends that don't implement group mapping
 588  *********************************************************************/
 589
 590 NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
 591                                  DOM_SID sid)
 592 {
 593         return NT_STATUS_UNSUCCESSFUL;
 594 }
 595
 596 NTSTATUS pdb_nop_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
 597                                  gid_t gid)
 598 {
 599         return NT_STATUS_UNSUCCESSFUL;
 600 }
 601
 602 NTSTATUS pdb_nop_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
 603                                  const char *name)
 604 {
 605         return NT_STATUS_UNSUCCESSFUL;
 606 }
 607
 608 NTSTATUS pdb_nop_add_group_mapping_entry(struct pdb_methods *methods,
 609                                                 GROUP_MAP *map)
 610 {
 611         return NT_STATUS_UNSUCCESSFUL;
 612 }
 613
 614 NTSTATUS pdb_nop_update_group_mapping_entry(struct pdb_methods *methods,
 615                                                    GROUP_MAP *map)
 616 {
 617         return NT_STATUS_UNSUCCESSFUL;
 618 }
 619
 620 NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods,
 621                                                    DOM_SID sid)
 622 {
 623         return NT_STATUS_UNSUCCESSFUL;
 624 }
 625
 626 NTSTATUS pdb_nop_enum_group_mapping(struct pdb_methods *methods,
 627                                            enum lsa_SidType sid_name_use,
 628                                            GROUP_MAP **rmap, size_t *num_entries,
 629                                            bool unix_only)
 630 {
 631         return NT_STATUS_UNSUCCESSFUL;
 632 }
 633
 634 /****************************************************************************
 635  These need to be redirected through pdb_interface.c
 636 ****************************************************************************/
 637 bool pdb_get_dom_grp_info(const DOM_SID *sid, struct acct_info *info)
 638 {
 639         GROUP_MAP map;
 640         bool res;
 641
 642         become_root();
 643         res = get_domain_group_from_sid(*sid, &map);
 644         unbecome_root();
 645
 646         if (!res)
 647                 return False;
 648
 649         fstrcpy(info->acct_name, map.nt_name);
 650         fstrcpy(info->acct_desc, map.comment);
 651         sid_peek_rid(sid, &info->rid);
 652         return True;
 653 }
 654
 655 bool pdb_set_dom_grp_info(const DOM_SID *sid, const struct acct_info *info)
 656 {
 657         GROUP_MAP map;
 658
 659         if (!get_domain_group_from_sid(*sid, &map))
 660                 return False;
 661
 662         fstrcpy(map.nt_name, info->acct_name);
 663         fstrcpy(map.comment, info->acct_desc);
 664
 665         return NT_STATUS_IS_OK(pdb_update_group_mapping_entry(&map));
 666 }
 667
 668 /********************************************************************
 669  Really just intended to be called by smbd
 670 ********************************************************************/
 671
 672 NTSTATUS pdb_create_builtin_alias(uint32 rid)
 673 {
 674         DOM_SID sid;
 675         enum lsa_SidType type;
 676         gid_t gid;
 677         GROUP_MAP map;
 678         TALLOC_CTX *mem_ctx;
 679         NTSTATUS status;
 680         const char *name = NULL;
 681         fstring groupname;
 682
 683         DEBUG(10, ("Trying to create builtin alias %d\n", rid));
 684
 685         if ( !sid_compose( &sid, &global_sid_Builtin, rid ) ) {
 686                 return NT_STATUS_NO_SUCH_ALIAS;
 687         }
 688
 689         if ( (mem_ctx = talloc_new(NULL)) == NULL ) {
 690                 return NT_STATUS_NO_MEMORY;
 691         }
 692
 693         if ( !lookup_sid(mem_ctx, &sid, NULL, &name, &type) ) {
 694                 TALLOC_FREE( mem_ctx );
 695                 return NT_STATUS_NO_SUCH_ALIAS;
 696         }
 697
 698         /* validate RID so copy the name and move on */
 699
 700         fstrcpy( groupname, name );
 701         TALLOC_FREE( mem_ctx );
 702
 703         if (!winbind_allocate_gid(&gid)) {
 704                 DEBUG(3, ("pdb_create_builtin_alias: Could not get a gid out of winbind\n"));
 705                 return NT_STATUS_ACCESS_DENIED;
 706         }
 707
 708         DEBUG(10,("Creating alias %s with gid %d\n", name, gid));
 709
 710         map.gid = gid;
 711         sid_copy(&map.sid, &sid);
 712         map.sid_name_use = SID_NAME_ALIAS;
 713         fstrcpy(map.nt_name, name);
 714         fstrcpy(map.comment, "");
 715
 716         status = pdb_add_group_mapping_entry(&map);
 717
 718         if (!NT_STATUS_IS_OK(status)) {
 719                 DEBUG(0, ("pdb_create_builtin_alias: Could not add group mapping entry for alias %d "
 720                           "(%s)\n", rid, nt_errstr(status)));
 721         }
 722
 723         return status;
 724 }
 725
 726