source3/utils/net_groupmap.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-2000,
   5  *  Copyright (C) Jean François Micouleau      1998-2001.
   6  *  Copyright (C) Gerald Carter                2003.
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 2 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, write to the Free Software
  20  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21  */
  22
  23
  24 #include "includes.h"
  25 #include "../utils/net.h"
  26
  27
  28 /*********************************************************
  29  utility function to parse an integer parameter from
  30  "parameter = value"
  31 **********************************************************/
  32 static uint32 get_int_param( const char* param )
  33 {
  34         char *p;
  35
  36         p = strchr( param, '=' );
  37         if ( !p )
  38                 return 0;
  39
  40         return atoi(p+1);
  41 }
  42
  43 /*********************************************************
  44  utility function to parse an integer parameter from
  45  "parameter = value"
  46 **********************************************************/
  47 static char* get_string_param( const char* param )
  48 {
  49         char *p;
  50
  51         p = strchr( param, '=' );
  52         if ( !p )
  53                 return NULL;
  54
  55         return (p+1);
  56 }
  57
  58 /*********************************************************
  59  Figure out if the input was an NT group or a SID string.
  60  Return the SID.
  61 **********************************************************/
  62 static BOOL get_sid_from_input(DOM_SID *sid, char *input)
  63 {
  64         GROUP_MAP map;
  65
  66         if (StrnCaseCmp( input, "S-", 2)) {
  67                 /* Perhaps its the NT group name? */
  68                 if (!pdb_getgrnam(&map, input, MAPPING_WITHOUT_PRIV)) {
  69                         printf("NT Group %s doesn't exist in mapping DB\n", input);
  70                         return False;
  71                 } else {
  72                         *sid = map.sid;
  73                 }
  74         } else {
  75                 if (!string_to_sid(sid, input)) {
  76                         printf("converting sid %s from a string failed!\n", input);
  77                         return False;
  78                 }
  79         }
  80         return True;
  81 }
  82
  83 /*********************************************************
  84  Dump a GROUP_MAP entry to stdout (long or short listing)
  85 **********************************************************/
  86
  87 static void print_map_entry ( GROUP_MAP map, BOOL long_list )
  88 {
  89         fstring string_sid;
  90         fstring group_type;
  91         fstring priv_text;
  92
  93         decode_sid_name_use(group_type, map.sid_name_use);
  94         sid_to_string(string_sid, &map.sid);
  95         convert_priv_to_text(&(map.priv_set), priv_text);
  96
  97         if (!long_list)
  98                 d_printf("%s (%s) -> %s\n", map.nt_name, string_sid, gidtoname(map.gid));
  99         else {
 100                 d_printf("%s\n", map.nt_name);
 101                 d_printf("\tSID       : %s\n", string_sid);
 102                 d_printf("\tUnix group: %s\n", gidtoname(map.gid));
 103                 d_printf("\tGroup type: %s\n", group_type);
 104                 d_printf("\tComment   : %s\n", map.comment);
 105                 d_printf("\tPrivilege : %s\n\n", priv_text);
 106         }
 107
 108 }
 109 /*********************************************************
 110  List the groups.
 111 **********************************************************/
 112 int net_groupmap_list(int argc, const char **argv)
 113 {
 114         int entries;
 115         BOOL long_list = False;
 116         int i;
 117         fstring ntgroup = "";
 118
 119         /* get the options */
 120         for ( i=0; i<argc; i++ ) {
 121                 if ( !StrCaseCmp(argv[i], "verbose")) {
 122                         long_list = True;
 123                 }
 124                 else if ( !StrnCaseCmp(argv[i], "name", strlen("name")) ) {
 125                         fstrcpy( ntgroup, get_string_param( argv[i] ) );
 126                         if ( !ntgroup[0] ) {
 127                                 d_printf("must supply a name\n");
 128                                 return -1;
 129                         }
 130                 }
 131                 else {
 132                         d_printf("Bad option: %s\n", argv[i]);
 133                         return -1;
 134                 }
 135         }
 136
 137         /* list a single group is given a name */
 138         if ( ntgroup[0] ) {
 139                 DOM_SID sid;
 140                 GROUP_MAP map;
 141
 142                 if (!get_sid_from_input(&sid, ntgroup)) {
 143                         return -1;
 144                 }
 145
 146                 /* Get the current mapping from the database */
 147                 if(!pdb_getgrsid(&map, sid, MAPPING_WITH_PRIV)) {
 148                         d_printf("Failure to local group SID in the database\n");
 149                         return -1;
 150                 }
 151
 152                 print_map_entry( map, long_list );
 153                 free_privilege(&(map.priv_set));
 154         }
 155         else {
 156                 GROUP_MAP *map=NULL;
 157                 /* enumerate all group mappings */
 158                 if ( !pdb_enum_group_mapping(SID_NAME_UNKNOWN, &map, &entries, ENUM_ALL_MAPPED, MAPPING_WITH_PRIV) )
 159                         return -1;
 160
 161                 for (i=0; i<entries; i++) {
 162                         print_map_entry( map[i], long_list );
 163                         free_privilege(&(map[i].priv_set));
 164                 }
 165         }
 166
 167         return 0;
 168 }
 169
 170 /*********************************************************
 171  Add a new group mapping entry
 172 **********************************************************/
 173
 174 int net_groupmap_add(int argc, const char **argv)
 175 {
 176         PRIVILEGE_SET se_priv;
 177         DOM_SID sid;
 178         fstring ntgroup = "";
 179         fstring unixgrp = "";
 180         fstring string_sid = "";
 181         fstring type = "";
 182         fstring ntcomment = "";
 183         enum SID_NAME_USE sid_type = SID_NAME_DOM_GRP;
 184         uint32 rid = 0;
 185         gid_t gid;
 186         int i;
 187
 188         /* get the options */
 189         for ( i=0; i<argc; i++ ) {
 190                 if ( !StrnCaseCmp(argv[i], "rid", strlen("rid")) ) {
 191                         rid = get_int_param(argv[i]);
 192                         if ( rid < DOMAIN_GROUP_RID_ADMINS ) {
 193                                 d_printf("RID must be greater than %d\n", (uint32)DOMAIN_GROUP_RID_ADMINS-1);
 194                                 return -1;
 195                         }
 196                 }
 197                 else if ( !StrnCaseCmp(argv[i], "unixgroup", strlen("unixgroup")) ) {
 198                         fstrcpy( unixgrp, get_string_param( argv[i] ) );
 199                         if ( !unixgrp[0] ) {
 200                                 d_printf("must supply a name\n");
 201                                 return -1;
 202                         }
 203                 }
 204                 else if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
 205                         fstrcpy( ntgroup, get_string_param( argv[i] ) );
 206                         if ( !ntgroup[0] ) {
 207                                 d_printf("must supply a name\n");
 208                                 return -1;
 209                         }
 210                 }
 211                 else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
 212                         fstrcpy( string_sid, get_string_param( argv[i] ) );
 213                         if ( !string_sid[0] ) {
 214                                 d_printf("must supply a SID\n");
 215                                 return -1;
 216                         }
 217                 }
 218                 else if ( !StrnCaseCmp(argv[i], "comment", strlen("comment")) ) {
 219                         fstrcpy( ntcomment, get_string_param( argv[i] ) );
 220                         if ( !ntcomment[0] ) {
 221                                 d_printf("must supply a comment string\n");
 222                                 return -1;
 223                         }
 224                 }
 225                 else if ( !StrnCaseCmp(argv[i], "type", strlen("type")) )  {
 226                         fstrcpy( type, get_string_param( argv[i] ) );
 227                         switch ( type[0] ) {
 228                                 case 'b':
 229                                 case 'B':
 230                                         sid_type = SID_NAME_WKN_GRP;
 231                                         break;
 232                                 case 'd':
 233                                 case 'D':
 234                                         sid_type = SID_NAME_DOM_GRP;
 235                                         break;
 236                                 case 'l':
 237                                 case 'L':
 238                                         sid_type = SID_NAME_ALIAS;
 239                                         break;
 240                         }
 241                 }
 242                 else {
 243                         d_printf("Bad option: %s\n", argv[i]);
 244                         return -1;
 245                 }
 246         }
 247
 248         if ( !unixgrp[0] || (!rid && !string_sid[0]) ) {
 249                 d_printf("Usage: net groupmap add {rid=<int>|sid=<string>} unixgroup=<string> [type=<domain|local|builtin>] [ntgroup=<string>] [comment=<string>]\n");
 250                 return -1;
 251         }
 252
 253         /* append the rid to our own domain/machine SID if we don't have a full SID */
 254         if ( !string_sid[0] ) {
 255                 sid_copy(&sid, get_global_sam_sid());
 256                 sid_append_rid(&sid, rid);
 257                 sid_to_string(string_sid, &sid);
 258         }
 259
 260         if (ntcomment[0])
 261                 fstrcpy(ntcomment, "Local Unix group");
 262
 263         if ( !(gid = nametogid(unixgrp)) ) {
 264                 d_printf("Can't lookup UNIX group %s\n", ntgroup);
 265                 return -1;
 266         }
 267
 268         if ( !ntgroup[0] )
 269                 fstrcpy( ntgroup, unixgrp );
 270
 271
 272         init_privilege(&se_priv);
 273 #if 0
 274         if (privilege!=NULL)
 275                 convert_priv_from_text(&se_priv, privilege);
 276 #endif
 277
 278         if (!add_initial_entry(gid, string_sid, sid_type, ntgroup,
 279                               ntcomment, se_priv, PR_ACCESS_FROM_NETWORK) ) {
 280                 d_printf("adding entry for group %s failed!\n", ntgroup);
 281                 return -1;
 282         }
 283
 284         free_privilege(&se_priv);
 285
 286         d_printf("Successully added group %s to the mapping db\n", ntgroup);
 287         return 0;
 288 }
 289
 290 int net_groupmap_modify(int argc, const char **argv)
 291 {
 292         DOM_SID sid;
 293         GROUP_MAP map;
 294         fstring ntcomment = "";
 295         fstring type = "";
 296         fstring ntgroup = "";
 297         fstring unixgrp = "";
 298         fstring sid_string = "";
 299         enum SID_NAME_USE sid_type = SID_NAME_UNKNOWN;
 300         int i;
 301         gid_t gid;
 302
 303         /* get the options */
 304         for ( i=0; i<argc; i++ ) {
 305                 if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
 306                         fstrcpy( ntgroup, get_string_param( argv[i] ) );
 307                         if ( !ntgroup[0] ) {
 308                                 d_printf("must supply a name\n");
 309                                 return -1;
 310                         }
 311                 }
 312                 else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
 313                         fstrcpy( sid_string, get_string_param( argv[i] ) );
 314                         if ( !sid_string[0] ) {
 315                                 d_printf("must supply a name\n");
 316                                 return -1;
 317                         }
 318                 }
 319                 else if ( !StrnCaseCmp(argv[i], "comment", strlen("comment")) ) {
 320                         fstrcpy( ntcomment, get_string_param( argv[i] ) );
 321                         if ( !ntcomment[0] ) {
 322                                 d_printf("must supply a comment string\n");
 323                                 return -1;
 324                         }
 325                 }
 326                 else if ( !StrnCaseCmp(argv[i], "unixgroup", strlen("unixgroup")) ) {
 327                         fstrcpy( unixgrp, get_string_param( argv[i] ) );
 328                         if ( !unixgrp[0] ) {
 329                                 d_printf("must supply a group name\n");
 330                                 return -1;
 331                         }
 332                 }
 333                 else if ( !StrnCaseCmp(argv[i], "type", strlen("type")) )  {
 334                         fstrcpy( type, get_string_param( argv[i] ) );
 335                         switch ( type[0] ) {
 336                                 case 'd':
 337                                 case 'D':
 338                                         sid_type = SID_NAME_DOM_GRP;
 339                                         break;
 340                                 case 'l':
 341                                 case 'L':
 342                                         sid_type = SID_NAME_ALIAS;
 343                                         break;
 344                         }
 345                 }
 346                 else {
 347                         d_printf("Bad option: %s\n", argv[i]);
 348                         return -1;
 349                 }
 350         }
 351
 352         if ( !ntgroup[0] && !sid_string[0] ) {
 353                 d_printf("Usage: net groupmap modify {ntgroup=<string>|sid=<SID>} [comment=<string>] [unixgroup=<string>] [type=<domain|local>]\n");
 354                 return -1;
 355         }
 356
 357         /* give preference to the SID; if both the ntgroup name and SID
 358            are defined, use the SID and assume that the group name could be a
 359            new name */
 360
 361         if ( sid_string[0] ) {
 362                 if (!get_sid_from_input(&sid, sid_string)) {
 363                         return -1;
 364                 }
 365         }
 366         else {
 367                 if (!get_sid_from_input(&sid, ntgroup)) {
 368                         return -1;
 369                 }
 370         }
 371
 372         /* Get the current mapping from the database */
 373         if(!pdb_getgrsid(&map, sid, MAPPING_WITH_PRIV)) {
 374                 d_printf("Failure to local group SID in the database\n");
 375                 return -1;
 376         }
 377
 378         /*
 379          * Allow changing of group type only between domain and local
 380          * We disallow changing Builtin groups !!! (SID problem)
 381          */
 382         if ( sid_type != SID_NAME_UNKNOWN )
 383         {
 384                 if ( map.sid_name_use == SID_NAME_WKN_GRP ) {
 385                         d_printf("You can only change between domain and local groups.\n");
 386                         return -1;
 387                 }
 388
 389                 map.sid_name_use=sid_type;
 390         }
 391
 392         /* Change comment if new one */
 393         if ( ntcomment[0] )
 394                 fstrcpy( map.comment, ntcomment );
 395
 396         if ( ntgroup[0] )
 397                 fstrcpy( map.nt_name, ntgroup );
 398
 399         if ( unixgrp[0] ) {
 400                 gid = nametogid( unixgrp );
 401                 if ( gid == -1 ) {
 402                         d_printf("Unable to lookup UNIX group %s.  Make sure the group exists.\n",
 403                                 unixgrp);
 404                         return -1;
 405                 }
 406
 407                 map.gid = gid;
 408         }
 409
 410 #if 0
 411         /* Change the privilege if new one */
 412         if (privilege!=NULL)
 413                 convert_priv_from_text(&map.priv_set, privilege);
 414 #endif
 415
 416         if ( !pdb_update_group_mapping_entry(&map) ) {
 417                 d_printf("Could not update group database\n");
 418                 free_privilege(&map.priv_set);
 419                 return -1;
 420         }
 421
 422         free_privilege(&map.priv_set);
 423
 424         d_printf("Updated mapping entry for %s\n", ntgroup);
 425
 426         return 0;
 427 }
 428
 429 int net_groupmap_delete(int argc, const char **argv)
 430 {
 431         DOM_SID sid;
 432         fstring ntgroup = "";
 433         fstring sid_string = "";
 434         int i;
 435
 436         /* get the options */
 437         for ( i=0; i<argc; i++ ) {
 438                 if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
 439                         fstrcpy( ntgroup, get_string_param( argv[i] ) );
 440                         if ( !ntgroup[0] ) {
 441                                 d_printf("must supply a name\n");
 442                                 return -1;
 443                         }
 444                 }
 445                 if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
 446                         fstrcpy( sid_string, get_string_param( argv[i] ) );
 447                         if ( !sid_string[0] ) {
 448                                 d_printf("must supply a SID\n");
 449                                 return -1;
 450                         }
 451                 }
 452                 else {
 453                         d_printf("Bad option: %s\n", argv[i]);
 454                         return -1;
 455                 }
 456         }
 457
 458         if ( !ntgroup[0] && !sid_string[0]) {
 459                 d_printf("Usage: net groupmap delete {ntgroup=<string>|sid=<SID>}\n");
 460                 return -1;
 461         }
 462
 463         /* give preference to the SID if we have that */
 464
 465         if ( sid_string[0] )
 466                 fstrcpy( ntgroup, sid_string );
 467
 468         if ( !get_sid_from_input(&sid, ntgroup) ) {
 469                 d_printf("Unable to resolve group %s to a SID\n", ntgroup);
 470                 return -1;
 471         }
 472
 473         if ( !pdb_delete_group_mapping_entry(sid) ) {
 474                 printf("Failed to removing group %s from the mapping db!\n", ntgroup);
 475                 return -1;
 476         }
 477
 478         d_printf("Sucessfully removed %s from the mapping db\n", ntgroup);
 479
 480         return 0;
 481 }
 482