#include "includes.h"
-#include "../utils/net.h"
+#include "utils/net.h"
/*********************************************************
if (StrnCaseCmp( input, "S-", 2)) {
/* Perhaps its the NT group name? */
- if (!pdb_getgrnam(&map, input, MAPPING_WITHOUT_PRIV)) {
+ if (!pdb_getgrnam(&map, input)) {
printf("NT Group %s doesn't exist in mapping DB\n", input);
return False;
} else {
{
fstring string_sid;
fstring group_type;
- fstring priv_text;
decode_sid_name_use(group_type, map.sid_name_use);
sid_to_string(string_sid, &map.sid);
- convert_priv_to_text(&(map.priv_set), priv_text);
if (!long_list)
d_printf("%s (%s) -> %s\n", map.nt_name, string_sid, gidtoname(map.gid));
d_printf("\tUnix group: %s\n", gidtoname(map.gid));
d_printf("\tGroup type: %s\n", group_type);
d_printf("\tComment : %s\n", map.comment);
- d_printf("\tPrivilege : %s\n\n", priv_text);
}
}
/*********************************************************
List the groups.
**********************************************************/
-int net_groupmap_list(int argc, const char **argv)
+static int net_groupmap_list(int argc, const char **argv)
{
int entries;
BOOL long_list = False;
int i;
fstring ntgroup = "";
+ fstring sid_string = "";
/* get the options */
for ( i=0; i<argc; i++ ) {
if ( !StrCaseCmp(argv[i], "verbose")) {
long_list = True;
}
- else if ( !StrnCaseCmp(argv[i], "name", strlen("name")) ) {
+ else if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
fstrcpy( ntgroup, get_string_param( argv[i] ) );
if ( !ntgroup[0] ) {
d_printf("must supply a name\n");
return -1;
}
}
+ else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
+ fstrcpy( sid_string, get_string_param( argv[i] ) );
+ if ( !sid_string[0] ) {
+ d_printf("must supply a SID\n");
+ return -1;
+ }
+ }
else {
d_printf("Bad option: %s\n", argv[i]);
return -1;
}
/* list a single group is given a name */
- if ( ntgroup[0] ) {
+ if ( ntgroup[0] || sid_string[0] ) {
DOM_SID sid;
GROUP_MAP map;
+
+ if ( sid_string[0] )
+ fstrcpy( ntgroup, sid_string);
if (!get_sid_from_input(&sid, ntgroup)) {
return -1;
}
/* Get the current mapping from the database */
- if(!pdb_getgrsid(&map, sid, MAPPING_WITH_PRIV)) {
+ if(!pdb_getgrsid(&map, sid)) {
d_printf("Failure to local group SID in the database\n");
return -1;
}
print_map_entry( map, long_list );
- free_privilege(&(map.priv_set));
}
else {
GROUP_MAP *map=NULL;
/* enumerate all group mappings */
- if ( !pdb_enum_group_mapping(SID_NAME_UNKNOWN, &map, &entries, ENUM_ALL_MAPPED, MAPPING_WITH_PRIV) )
+ if (!pdb_enum_group_mapping(SID_NAME_UNKNOWN, &map, &entries, ENUM_ALL_MAPPED))
return -1;
for (i=0; i<entries; i++) {
print_map_entry( map[i], long_list );
- free_privilege(&(map[i].priv_set));
}
+
+ SAFE_FREE(map);
}
return 0;
Add a new group mapping entry
**********************************************************/
-int net_groupmap_add(int argc, const char **argv)
+static int net_groupmap_add(int argc, const char **argv)
{
- PRIVILEGE_SET se_priv;
DOM_SID sid;
fstring ntgroup = "";
+ fstring unixgrp = "";
fstring string_sid = "";
fstring type = "";
fstring ntcomment = "";
- enum SID_NAME_USE sid_type = SID_NAME_UNKNOWN;
+ enum SID_NAME_USE sid_type = SID_NAME_DOM_GRP;
uint32 rid = 0;
gid_t gid;
int i;
return -1;
}
}
- else if ( !StrnCaseCmp(argv[i], "name", strlen("name")) ) {
+ else if ( !StrnCaseCmp(argv[i], "unixgroup", strlen("unixgroup")) ) {
+ fstrcpy( unixgrp, get_string_param( argv[i] ) );
+ if ( !unixgrp[0] ) {
+ d_printf("must supply a name\n");
+ return -1;
+ }
+ }
+ else if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
fstrcpy( ntgroup, get_string_param( argv[i] ) );
if ( !ntgroup[0] ) {
d_printf("must supply a name\n");
}
}
else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
- fstrcpy( sid_string, get_string_param( argv[i] ) );
- if ( !sid_string[0] ) {
+ fstrcpy( string_sid, get_string_param( argv[i] ) );
+ if ( !string_sid[0] ) {
d_printf("must supply a SID\n");
return -1;
}
}
}
- if ( !ntgroup[0] || (!rid && !sid_string[0]} || sid_type==SID_NAME_UNKNOWN ) {
- d_printf("Usage: net groupmap add {rid=<int>|sid=<string>} name=<string>| type=<domain|local|builtin> [comment=<string>]\n");
+ if ( !unixgrp[0] ) {
+ d_printf("Usage: net groupmap add {rid=<int>|sid=<string>} unixgroup=<string> [type=<domain|local|builtin>] [ntgroup=<string>] [comment=<string>]\n");
+ return -1;
+ }
+
+ if ( (gid = nametogid(unixgrp)) == (gid_t)-1 ) {
+ d_printf("Can't lookup UNIX group %s\n", unixgrp);
return -1;
}
+ if ( (rid == 0) && (string_sid[0] == '\0') ) {
+ d_printf("No rid or sid specified, choosing algorithmic mapping\n");
+ rid = pdb_gid_to_group_rid(gid);
+ }
+
/* append the rid to our own domain/machine SID if we don't have a full SID */
- if ( !sid_string[0] ) {
+ if ( !string_sid[0] ) {
sid_copy(&sid, get_global_sam_sid());
sid_append_rid(&sid, rid);
sid_to_string(string_sid, &sid);
}
- if (ntcomment[0])
+ if (!ntcomment[0])
fstrcpy(ntcomment, "Local Unix group");
- if ( !(gid = nametogid(ntgroup)) ) {
- d_printf("Can't lookup UNIX group %s\n", ntgroup);
- return -1;
- }
+ if (!ntgroup[0] )
+ fstrcpy( ntgroup, unixgrp );
+
- init_privilege(&se_priv);
-#if 0
- if (privilege!=NULL)
- convert_priv_from_text(&se_priv, privilege);
-#endif
-
- if (!add_initial_entry(gid, string_sid, sid_type, ntgroup,
- ntcomment, se_priv, PR_ACCESS_FROM_NETWORK) ) {
+ if (!add_initial_entry(gid, string_sid, sid_type, ntgroup, ntcomment)) {
d_printf("adding entry for group %s failed!\n", ntgroup);
return -1;
}
- free_privilege(&se_priv);
-
d_printf("Successully added group %s to the mapping db\n", ntgroup);
return 0;
}
-int net_groupmap_modify(int argc, const char **argv)
+static int net_groupmap_modify(int argc, const char **argv)
{
DOM_SID sid;
GROUP_MAP map;
fstring ntcomment = "";
fstring type = "";
fstring ntgroup = "";
+ fstring unixgrp = "";
+ fstring sid_string = "";
enum SID_NAME_USE sid_type = SID_NAME_UNKNOWN;
int i;
+ gid_t gid;
/* get the options */
for ( i=0; i<argc; i++ ) {
- if ( !StrnCaseCmp(argv[i], "name", strlen("name")) ) {
+ if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
fstrcpy( ntgroup, get_string_param( argv[i] ) );
if ( !ntgroup[0] ) {
d_printf("must supply a name\n");
return -1;
}
}
+ else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
+ fstrcpy( sid_string, get_string_param( argv[i] ) );
+ if ( !sid_string[0] ) {
+ d_printf("must supply a name\n");
+ return -1;
+ }
+ }
else if ( !StrnCaseCmp(argv[i], "comment", strlen("comment")) ) {
fstrcpy( ntcomment, get_string_param( argv[i] ) );
if ( !ntcomment[0] ) {
return -1;
}
}
+ else if ( !StrnCaseCmp(argv[i], "unixgroup", strlen("unixgroup")) ) {
+ fstrcpy( unixgrp, get_string_param( argv[i] ) );
+ if ( !unixgrp[0] ) {
+ d_printf("must supply a group name\n");
+ return -1;
+ }
+ }
else if ( !StrnCaseCmp(argv[i], "type", strlen("type")) ) {
fstrcpy( type, get_string_param( argv[i] ) );
switch ( type[0] ) {
}
}
- if ( !ntgroup[0] ) {
- d_printf("Usage: net groupmap modify name=<string|SID> [comment=<string>] [type=<domain|local>\n");
+ if ( !ntgroup[0] && !sid_string[0] ) {
+ d_printf("Usage: net groupmap modify {ntgroup=<string>|sid=<SID>} [comment=<string>] [unixgroup=<string>] [type=<domain|local>]\n");
return -1;
}
-
- if (!get_sid_from_input(&sid, ntgroup)) {
- return -1;
+
+ /* give preference to the SID; if both the ntgroup name and SID
+ are defined, use the SID and assume that the group name could be a
+ new name */
+
+ if ( sid_string[0] ) {
+ if (!get_sid_from_input(&sid, sid_string)) {
+ return -1;
+ }
}
+ else {
+ if (!get_sid_from_input(&sid, ntgroup)) {
+ return -1;
+ }
+ }
/* Get the current mapping from the database */
- if(!pdb_getgrsid(&map, sid, MAPPING_WITH_PRIV)) {
+ if(!pdb_getgrsid(&map, sid)) {
d_printf("Failure to local group SID in the database\n");
return -1;
}
* Allow changing of group type only between domain and local
* We disallow changing Builtin groups !!! (SID problem)
*/
- if (sid_type==SID_NAME_ALIAS
- || sid_type==SID_NAME_DOM_GRP
- || sid_type==SID_NAME_UNKNOWN)
- {
- if (map.sid_name_use==SID_NAME_ALIAS
- || map.sid_name_use==SID_NAME_DOM_GRP
- || map.sid_name_use==SID_NAME_UNKNOWN)
- {
- map.sid_name_use=sid_type;
- } else {
- printf("cannot change group type to builtin\n");
- };
- } else {
- printf("cannot change group type from builtin\n");
+ if (sid_type != SID_NAME_UNKNOWN) {
+ if (map.sid_name_use == SID_NAME_WKN_GRP) {
+ d_printf("You can only change between domain and local groups.\n");
+ return -1;
+ }
+
+ map.sid_name_use=sid_type;
}
/* Change comment if new one */
if ( ntcomment[0] )
fstrcpy( map.comment, ntcomment );
-
-#if 0
- /* Change the privilege if new one */
- if (privilege!=NULL)
- convert_priv_from_text(&map.priv_set, privilege);
-#endif
+
+ if ( ntgroup[0] )
+ fstrcpy( map.nt_name, ntgroup );
+
+ if ( unixgrp[0] ) {
+ gid = nametogid( unixgrp );
+ if ( gid == -1 ) {
+ d_printf("Unable to lookup UNIX group %s. Make sure the group exists.\n",
+ unixgrp);
+ return -1;
+ }
+
+ map.gid = gid;
+ }
if ( !pdb_update_group_mapping_entry(&map) ) {
d_printf("Could not update group database\n");
- free_privilege(&map.priv_set);
return -1;
}
- free_privilege(&map.priv_set);
-
- d_printf("Updated mapping entry for %s\n", ntgroup);
+ d_printf("Updated mapping entry for %s\n", map.nt_name);
return 0;
}
-int net_groupmap_delete(int argc, const char **argv)
+static int net_groupmap_delete(int argc, const char **argv)
{
DOM_SID sid;
fstring ntgroup = "";
+ fstring sid_string = "";
int i;
/* get the options */
for ( i=0; i<argc; i++ ) {
- if ( !StrnCaseCmp(argv[i], "name", strlen("name")) ) {
+ if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) {
fstrcpy( ntgroup, get_string_param( argv[i] ) );
if ( !ntgroup[0] ) {
d_printf("must supply a name\n");
return -1;
}
}
+ else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) {
+ fstrcpy( sid_string, get_string_param( argv[i] ) );
+ if ( !sid_string[0] ) {
+ d_printf("must supply a SID\n");
+ return -1;
+ }
+ }
else {
d_printf("Bad option: %s\n", argv[i]);
return -1;
}
}
- if ( !ntgroup[0] ) {
- d_printf("Usage: net groupmap delete name=<string|SID>\n");
+ if ( !ntgroup[0] && !sid_string[0]) {
+ d_printf("Usage: net groupmap delete {ntgroup=<string>|sid=<SID>}\n");
return -1;
}
+ /* give preference to the SID if we have that */
+
+ if ( sid_string[0] )
+ fstrcpy( ntgroup, sid_string );
+
if ( !get_sid_from_input(&sid, ntgroup) ) {
d_printf("Unable to resolve group %s to a SID\n", ntgroup);
return -1;
return 0;
}
-#if 0
-/*********************************************************
- Change a group.
-**********************************************************/
-static int changegroup(char *sid_string, char *group, enum SID_NAME_USE sid_type, char *ntgroup, char *groupdesc, char *privilege)
+static int net_groupmap_set(int argc, const char **argv)
+{
+ const char *ntgroup = NULL;
+ struct group *grp = NULL;
+ GROUP_MAP map;
+ BOOL have_map = False;
+
+ if ((argc < 1) || (argc > 2)) {
+ d_printf("Usage: net groupmap set \"NT Group\" "
+ "[\"unix group\"] [-C \"comment\"] [-L] [-D]\n");
+ return -1;
+ }
+
+ if ( opt_localgroup && opt_domaingroup ) {
+ d_printf("Can only specify -L or -D, not both\n");
+ return -1;
+ }
+
+ ntgroup = argv[0];
+
+ if (argc == 2) {
+ grp = getgrnam(argv[1]);
+
+ if (grp == NULL) {
+ d_printf("Could not find unix group %s\n", argv[1]);
+ return -1;
+ }
+ }
+
+ have_map = pdb_getgrnam(&map, ntgroup);
+
+ if (!have_map) {
+ DOM_SID sid;
+ have_map = ( (strncmp(ntgroup, "S-", 2) == 0) &&
+ string_to_sid(&sid, ntgroup) &&
+ pdb_getgrsid(&map, sid) );
+ }
+
+ if (!have_map) {
+
+ /* Ok, add it */
+
+ if (grp == NULL) {
+ d_printf("Could not find group mapping for %s\n",
+ ntgroup);
+ return -1;
+ }
+
+ map.gid = grp->gr_gid;
+
+ if (opt_rid == 0) {
+ opt_rid = pdb_gid_to_group_rid(map.gid);
+ }
+
+ sid_copy(&map.sid, get_global_sam_sid());
+ sid_append_rid(&map.sid, opt_rid);
+
+ map.sid_name_use = SID_NAME_DOM_GRP;
+ fstrcpy(map.nt_name, ntgroup);
+ fstrcpy(map.comment, "");
+
+ if (!pdb_add_group_mapping_entry(&map)) {
+ d_printf("Could not add mapping entry for %s\n",
+ ntgroup);
+ return -1;
+ }
+ }
+
+ /* Now we have a mapping entry, update that stuff */
+
+ if ( opt_localgroup || opt_domaingroup ) {
+ if (map.sid_name_use == SID_NAME_WKN_GRP) {
+ d_printf("Can't change type of the BUILTIN group %s\n",
+ map.nt_name);
+ return -1;
+ }
+ }
+
+ if (opt_localgroup)
+ map.sid_name_use = SID_NAME_ALIAS;
+
+ if (opt_domaingroup)
+ map.sid_name_use = SID_NAME_DOM_GRP;
+
+ /* The case (opt_domaingroup && opt_localgroup) was tested for above */
+
+ if (strlen(opt_comment) > 0)
+ fstrcpy(map.comment, opt_comment);
+
+ if (strlen(opt_newntname) > 0)
+ fstrcpy(map.nt_name, opt_newntname);
+
+ if (grp != NULL)
+ map.gid = grp->gr_gid;
+
+ if (!pdb_update_group_mapping_entry(&map)) {
+ d_printf("Could not update group mapping for %s\n", ntgroup);
+ return -1;
+ }
+
+ return 0;
+}
+
+static int net_groupmap_cleanup(int argc, const char **argv)
+{
+ GROUP_MAP *map = NULL;
+ int i, entries;
+
+ if (!pdb_enum_group_mapping(SID_NAME_UNKNOWN, &map, &entries,
+ ENUM_ALL_MAPPED)) {
+ d_printf("Could not list group mappings\n");
+ return -1;
+ }
+
+ for (i=0; i<entries; i++) {
+
+ if (map[i].sid_name_use == SID_NAME_WKN_GRP)
+ continue;
+
+ if (map[i].gid == -1)
+ printf("Group %s is not mapped\n", map[i].nt_name);
+
+ if (!sid_check_is_in_our_domain(&map[i].sid)) {
+ printf("Deleting mapping for NT Group %s, sid %s\n",
+ map[i].nt_name,
+ sid_string_static(&map[i].sid));
+ pdb_delete_group_mapping_entry(map[i].sid);
+ }
+ }
+
+ SAFE_FREE(map);
+
+ return 0;
+}
+
+static int net_groupmap_addmem(int argc, const char **argv)
+{
+ DOM_SID alias, member;
+
+ if ( (argc != 2) ||
+ !string_to_sid(&alias, argv[0]) ||
+ !string_to_sid(&member, argv[1]) ) {
+ d_printf("Usage: net groupmap addmem alias-sid member-sid\n");
+ return -1;
+ }
+
+ if (!pdb_add_aliasmem(&alias, &member)) {
+ d_printf("Could not add sid %s to alias %s\n",
+ argv[1], argv[0]);
+ return -1;
+ }
+
+ return 0;
+}
+
+static int net_groupmap_delmem(int argc, const char **argv)
+{
+ DOM_SID alias, member;
+
+ if ( (argc != 2) ||
+ !string_to_sid(&alias, argv[0]) ||
+ !string_to_sid(&member, argv[1]) ) {
+ d_printf("Usage: net groupmap delmem alias-sid member-sid\n");
+ return -1;
+ }
+
+ if (!pdb_del_aliasmem(&alias, &member)) {
+ d_printf("Could not delete sid %s from alias %s\n",
+ argv[1], argv[0]);
+ return -1;
+ }
+
+ return 0;
+}
+
+static int net_groupmap_listmem(int argc, const char **argv)
+{
+ DOM_SID alias;
+ DOM_SID *members;
+ int i, num;
+ NTSTATUS result;
+
+ if ( (argc != 1) ||
+ !string_to_sid(&alias, argv[0]) ) {
+ d_printf("Usage: net groupmap listmem alias-sid\n");
+ return -1;
+ }
+
+ if (!pdb_enum_aliasmem(&alias, &members, &num)) {
+ d_printf("Could not list members for sid %s: %s\n",
+ argv[0], nt_errstr(result));
+ return -1;
+ }
+
+ for (i = 0; i < num; i++) {
+ printf("%s\n", sid_string_static(&(members[i])));
+ }
+
+ SAFE_FREE(members);
+
+ return 0;
+}
+
+static int net_groupmap_memberships(int argc, const char **argv)
+{
+ DOM_SID member;
+ DOM_SID *aliases;
+ int i, num;
+ NTSTATUS result;
+
+ if ( (argc != 1) ||
+ !string_to_sid(&member, argv[0]) ) {
+ d_printf("Usage: net groupmap memberof sid\n");
+ return -1;
+ }
+
+ if (!pdb_enum_alias_memberships(&member, &aliases, &num)) {
+ d_printf("Could not list memberships for sid %s: %s\n",
+ argv[0], nt_errstr(result));
+ return -1;
+ }
+
+ for (i = 0; i < num; i++) {
+ printf("%s\n", sid_string_static(&(aliases[i])));
+ }
+
+ SAFE_FREE(aliases);
+
+ return 0;
+}
+
+int net_help_groupmap(int argc, const char **argv)
+{
+ d_printf("net groupmap add"\
+ "\n Create a new group mapping\n");
+ d_printf("net groupmap modify"\
+ "\n Update a group mapping\n");
+ d_printf("net groupmap delete"\
+ "\n Remove a group mapping\n");
+ d_printf("net groupmap addmem"\
+ "\n Add a foreign alias member\n");
+ d_printf("net groupmap delmem"\
+ "\n Delete a foreign alias member\n");
+ d_printf("net groupmap listmem"\
+ "\n List foreign group members\n");
+ d_printf("net groupmap memberships"\
+ "\n List foreign group memberships\n");
+ d_printf("net groupmap list"\
+ "\n List current group map\n");
+ d_printf("net groupmap set"\
+ "\n Set group mapping\n");
+ d_printf("net groupmap cleanup"\
+ "\n Remove foreign group mapping entries\n");
+
+ return -1;
+}
+
+
+/***********************************************************
+ migrated functionality from smbgroupedit
+ **********************************************************/
+int net_groupmap(int argc, const char **argv)
{
+ struct functable func[] = {
+ {"add", net_groupmap_add},
+ {"modify", net_groupmap_modify},
+ {"delete", net_groupmap_delete},
+ {"set", net_groupmap_set},
+ {"cleanup", net_groupmap_cleanup},
+ {"addmem", net_groupmap_addmem},
+ {"delmem", net_groupmap_delmem},
+ {"listmem", net_groupmap_listmem},
+ {"memberships", net_groupmap_memberships},
+ {"list", net_groupmap_list},
+ {"help", net_help_groupmap},
+ {NULL, NULL}
+ };
+
+ /* we shouldn't have silly checks like this */
+ if (getuid() != 0) {
+ d_printf("You must be root to edit group mappings.\nExiting...\n");
+ return -1;
+ }
+
+ if ( argc )
+ return net_run_function(argc, argv, func, net_help_groupmap);
+
+ return net_help_groupmap( argc, argv );
}
-#endif
+
git.samba.org / sfrench / samba-autobuild / .git / blobdiff