2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-2000,
5 * Copyright (C) Jean François Micouleau 1998-2001.
6 * Copyright (C) Volker Lendecke 2006.
7 * Copyright (C) Gerald Carter 2006.
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 3 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, see <http://www.gnu.org/licenses/>.
24 #include "groupdb/mapping.h"
26 static const struct mapping_backend *backend;
29 initialise a group mapping backend
31 static BOOL init_group_mapping(void)
33 const char *backend_string;
35 if (backend != NULL) {
36 /* already initialised */
40 backend = groupdb_ldb_init();
42 return backend != NULL;
45 /****************************************************************************
46 initialise first time the mapping list
47 ****************************************************************************/
48 NTSTATUS add_initial_entry(gid_t gid, const char *sid, enum lsa_SidType sid_name_use, const char *nt_name, const char *comment)
52 if(!init_group_mapping()) {
53 DEBUG(0,("failed to initialize group mapping\n"));
54 return NT_STATUS_UNSUCCESSFUL;
58 if (!string_to_sid(&map.sid, sid)) {
59 DEBUG(0, ("string_to_sid failed: %s", sid));
60 return NT_STATUS_UNSUCCESSFUL;
63 map.sid_name_use=sid_name_use;
64 fstrcpy(map.nt_name, nt_name);
65 fstrcpy(map.comment, comment);
67 return pdb_add_group_mapping_entry(&map);
70 static NTSTATUS alias_memberships(const DOM_SID *members, size_t num_members,
71 DOM_SID **sids, size_t *num)
78 for (i=0; i<num_members; i++) {
79 NTSTATUS status = backend->one_alias_membership(&members[i], sids, num);
80 if (!NT_STATUS_IS_OK(status))
86 struct aliasmem_closure {
96 * High level functions
97 * better to use them than the lower ones.
99 * we are checking if the group is in the mapping file
100 * and if the group is an existing unix group
104 /* get a domain group from it's SID */
106 BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map)
111 if(!init_group_mapping()) {
112 DEBUG(0,("failed to initialize group mapping\n"));
116 DEBUG(10, ("get_domain_group_from_sid\n"));
118 /* if the group is NOT in the database, it CAN NOT be a domain group */
121 ret = pdb_getgrsid(map, sid);
124 /* special case check for rid 513 */
129 sid_peek_rid( &sid, &rid );
131 if ( rid == DOMAIN_GROUP_RID_USERS ) {
132 fstrcpy( map->nt_name, "None" );
133 fstrcpy( map->comment, "Ordinary Users" );
134 sid_copy( &map->sid, &sid );
135 map->sid_name_use = SID_NAME_DOM_GRP;
136 map->gid = (gid_t)-1;
144 DEBUG(10, ("get_domain_group_from_sid: SID found in the TDB\n"));
146 /* if it's not a domain group, continue */
147 if (map->sid_name_use!=SID_NAME_DOM_GRP) {
151 DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
157 DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid));
159 grp = getgrgid(map->gid);
161 DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n"));
165 DEBUG(10, ("get_domain_group_from_sid: gid exists in UNIX security\n"));
170 /****************************************************************************
171 Create a UNIX group on demand.
172 ****************************************************************************/
174 int smb_create_group(const char *unix_group, gid_t *new_gid)
182 /* defer to scripts */
184 if ( *lp_addgroup_script() ) {
185 pstrcpy(add_script, lp_addgroup_script());
186 pstring_sub(add_script, "%g", unix_group);
187 ret = smbrun(add_script, &fd);
188 DEBUG(ret ? 0 : 3,("smb_create_group: Running the command `%s' gave %d\n",add_script,ret));
190 smb_nscd_flush_group_cache();
199 if (read(fd, output, sizeof(output)) > 0) {
200 *new_gid = (gid_t)strtoul(output, NULL, 10);
209 struct group *grp = getgrnam(unix_group);
212 *new_gid = grp->gr_gid;
218 /****************************************************************************
219 Delete a UNIX group on demand.
220 ****************************************************************************/
222 int smb_delete_group(const char *unix_group)
227 /* defer to scripts */
229 if ( *lp_delgroup_script() ) {
230 pstrcpy(del_script, lp_delgroup_script());
231 pstring_sub(del_script, "%g", unix_group);
232 ret = smbrun(del_script,NULL);
233 DEBUG(ret ? 0 : 3,("smb_delete_group: Running the command `%s' gave %d\n",del_script,ret));
235 smb_nscd_flush_group_cache();
243 /****************************************************************************
244 Set a user's primary UNIX group.
245 ****************************************************************************/
246 int smb_set_primary_group(const char *unix_group, const char* unix_user)
251 /* defer to scripts */
253 if ( *lp_setprimarygroup_script() ) {
254 pstrcpy(add_script, lp_setprimarygroup_script());
255 all_string_sub(add_script, "%g", unix_group, sizeof(add_script));
256 all_string_sub(add_script, "%u", unix_user, sizeof(add_script));
257 ret = smbrun(add_script,NULL);
259 DEBUG(ret ? 0 : 3,("smb_set_primary_group: "
260 "Running the command `%s' gave %d\n",add_script,ret));
262 smb_nscd_flush_group_cache();
270 /****************************************************************************
271 Add a user to a UNIX group.
272 ****************************************************************************/
274 int smb_add_user_group(const char *unix_group, const char *unix_user)
279 /* defer to scripts */
281 if ( *lp_addusertogroup_script() ) {
282 pstrcpy(add_script, lp_addusertogroup_script());
283 pstring_sub(add_script, "%g", unix_group);
284 pstring_sub(add_script, "%u", unix_user);
285 ret = smbrun(add_script,NULL);
286 DEBUG(ret ? 0 : 3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script,ret));
288 smb_nscd_flush_group_cache();
296 /****************************************************************************
297 Delete a user from a UNIX group
298 ****************************************************************************/
300 int smb_delete_user_group(const char *unix_group, const char *unix_user)
305 /* defer to scripts */
307 if ( *lp_deluserfromgroup_script() ) {
308 pstrcpy(del_script, lp_deluserfromgroup_script());
309 pstring_sub(del_script, "%g", unix_group);
310 pstring_sub(del_script, "%u", unix_user);
311 ret = smbrun(del_script,NULL);
312 DEBUG(ret ? 0 : 3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script,ret));
314 smb_nscd_flush_group_cache();
323 NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
326 if (!init_group_mapping()) {
327 DEBUG(0,("failed to initialize group mapping\n"));
328 return NT_STATUS_UNSUCCESSFUL;
330 return backend->get_group_map_from_sid(sid, map) ?
331 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
334 NTSTATUS pdb_default_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
337 if (!init_group_mapping()) {
338 DEBUG(0,("failed to initialize group mapping\n"));
339 return NT_STATUS_UNSUCCESSFUL;
341 return backend->get_group_map_from_gid(gid, map) ?
342 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
345 NTSTATUS pdb_default_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
348 if (!init_group_mapping()) {
349 DEBUG(0,("failed to initialize group mapping\n"));
350 return NT_STATUS_UNSUCCESSFUL;
352 return backend->get_group_map_from_ntname(name, map) ?
353 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
356 NTSTATUS pdb_default_add_group_mapping_entry(struct pdb_methods *methods,
359 if (!init_group_mapping()) {
360 DEBUG(0,("failed to initialize group mapping\n"));
361 return NT_STATUS_UNSUCCESSFUL;
363 return backend->add_mapping_entry(map, TDB_INSERT) ?
364 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
367 NTSTATUS pdb_default_update_group_mapping_entry(struct pdb_methods *methods,
370 if (!init_group_mapping()) {
371 DEBUG(0,("failed to initialize group mapping\n"));
372 return NT_STATUS_UNSUCCESSFUL;
374 return backend->add_mapping_entry(map, TDB_REPLACE) ?
375 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
378 NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods,
381 if (!init_group_mapping()) {
382 DEBUG(0,("failed to initialize group mapping\n"));
383 return NT_STATUS_UNSUCCESSFUL;
385 return backend->group_map_remove(&sid) ?
386 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
389 NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
390 const DOM_SID *sid, enum lsa_SidType sid_name_use,
391 GROUP_MAP **pp_rmap, size_t *p_num_entries,
394 if (!init_group_mapping()) {
395 DEBUG(0,("failed to initialize group mapping\n"));
396 return NT_STATUS_UNSUCCESSFUL;
398 return backend->enum_group_mapping(sid, sid_name_use, pp_rmap, p_num_entries, unix_only) ?
399 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
402 NTSTATUS pdb_default_create_alias(struct pdb_methods *methods,
403 const char *name, uint32 *rid)
406 enum lsa_SidType type;
414 DEBUG(10, ("Trying to create alias %s\n", name));
416 mem_ctx = talloc_new(NULL);
417 if (mem_ctx == NULL) {
418 return NT_STATUS_NO_MEMORY;
421 exists = lookup_name(mem_ctx, name, LOOKUP_NAME_ISOLATED,
422 NULL, NULL, &sid, &type);
423 TALLOC_FREE(mem_ctx);
426 return NT_STATUS_ALIAS_EXISTS;
429 if (!winbind_allocate_gid(&gid)) {
430 DEBUG(3, ("Could not get a gid out of winbind\n"));
431 return NT_STATUS_ACCESS_DENIED;
434 if (!pdb_new_rid(&new_rid)) {
435 DEBUG(0, ("Could not allocate a RID -- wasted a gid :-(\n"));
436 return NT_STATUS_ACCESS_DENIED;
439 DEBUG(10, ("Creating alias %s with gid %d and rid %d\n",
440 name, gid, new_rid));
442 sid_copy(&sid, get_global_sam_sid());
443 sid_append_rid(&sid, new_rid);
446 sid_copy(&map.sid, &sid);
447 map.sid_name_use = SID_NAME_ALIAS;
448 fstrcpy(map.nt_name, name);
449 fstrcpy(map.comment, "");
451 status = pdb_add_group_mapping_entry(&map);
453 if (!NT_STATUS_IS_OK(status)) {
454 DEBUG(0, ("Could not add group mapping entry for alias %s "
455 "(%s)\n", name, nt_errstr(status)));
464 NTSTATUS pdb_default_delete_alias(struct pdb_methods *methods,
467 return pdb_delete_group_mapping_entry(*sid);
470 NTSTATUS pdb_default_get_aliasinfo(struct pdb_methods *methods,
472 struct acct_info *info)
476 if (!pdb_getgrsid(&map, *sid))
477 return NT_STATUS_NO_SUCH_ALIAS;
479 if ((map.sid_name_use != SID_NAME_ALIAS) &&
480 (map.sid_name_use != SID_NAME_WKN_GRP)) {
481 DEBUG(2, ("%s is a %s, expected an alias\n",
482 sid_string_static(sid),
483 sid_type_lookup(map.sid_name_use)));
484 return NT_STATUS_NO_SUCH_ALIAS;
487 fstrcpy(info->acct_name, map.nt_name);
488 fstrcpy(info->acct_desc, map.comment);
489 sid_peek_rid(&map.sid, &info->rid);
493 NTSTATUS pdb_default_set_aliasinfo(struct pdb_methods *methods,
495 struct acct_info *info)
499 if (!pdb_getgrsid(&map, *sid))
500 return NT_STATUS_NO_SUCH_ALIAS;
502 fstrcpy(map.nt_name, info->acct_name);
503 fstrcpy(map.comment, info->acct_desc);
505 return pdb_update_group_mapping_entry(&map);
508 NTSTATUS pdb_default_add_aliasmem(struct pdb_methods *methods,
509 const DOM_SID *alias, const DOM_SID *member)
511 if (!init_group_mapping()) {
512 DEBUG(0,("failed to initialize group mapping\n"));
513 return NT_STATUS_UNSUCCESSFUL;
515 return backend->add_aliasmem(alias, member);
518 NTSTATUS pdb_default_del_aliasmem(struct pdb_methods *methods,
519 const DOM_SID *alias, const DOM_SID *member)
521 if (!init_group_mapping()) {
522 DEBUG(0,("failed to initialize group mapping\n"));
523 return NT_STATUS_UNSUCCESSFUL;
525 return backend->del_aliasmem(alias, member);
528 NTSTATUS pdb_default_enum_aliasmem(struct pdb_methods *methods,
529 const DOM_SID *alias, DOM_SID **pp_members,
530 size_t *p_num_members)
532 if (!init_group_mapping()) {
533 DEBUG(0,("failed to initialize group mapping\n"));
534 return NT_STATUS_UNSUCCESSFUL;
536 return backend->enum_aliasmem(alias, pp_members, p_num_members);
539 NTSTATUS pdb_default_alias_memberships(struct pdb_methods *methods,
541 const DOM_SID *domain_sid,
542 const DOM_SID *members,
544 uint32 **pp_alias_rids,
545 size_t *p_num_alias_rids)
548 size_t i, num_alias_sids;
551 if (!init_group_mapping()) {
552 DEBUG(0,("failed to initialize group mapping\n"));
553 return NT_STATUS_UNSUCCESSFUL;
559 result = alias_memberships(members, num_members,
560 &alias_sids, &num_alias_sids);
562 if (!NT_STATUS_IS_OK(result))
565 *p_num_alias_rids = 0;
567 if (num_alias_sids == 0) {
568 TALLOC_FREE(alias_sids);
572 *pp_alias_rids = TALLOC_ARRAY(mem_ctx, uint32, num_alias_sids);
573 if (*pp_alias_rids == NULL)
574 return NT_STATUS_NO_MEMORY;
576 for (i=0; i<num_alias_sids; i++) {
577 if (!sid_peek_check_rid(domain_sid, &alias_sids[i],
578 &(*pp_alias_rids)[*p_num_alias_rids]))
580 *p_num_alias_rids += 1;
583 TALLOC_FREE(alias_sids);
588 /**********************************************************************
589 no ops for passdb backends that don't implement group mapping
590 *********************************************************************/
592 NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
595 return NT_STATUS_UNSUCCESSFUL;
598 NTSTATUS pdb_nop_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
601 return NT_STATUS_UNSUCCESSFUL;
604 NTSTATUS pdb_nop_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
607 return NT_STATUS_UNSUCCESSFUL;
610 NTSTATUS pdb_nop_add_group_mapping_entry(struct pdb_methods *methods,
613 return NT_STATUS_UNSUCCESSFUL;
616 NTSTATUS pdb_nop_update_group_mapping_entry(struct pdb_methods *methods,
619 return NT_STATUS_UNSUCCESSFUL;
622 NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods,
625 return NT_STATUS_UNSUCCESSFUL;
628 NTSTATUS pdb_nop_enum_group_mapping(struct pdb_methods *methods,
629 enum lsa_SidType sid_name_use,
630 GROUP_MAP **rmap, size_t *num_entries,
633 return NT_STATUS_UNSUCCESSFUL;
636 /****************************************************************************
637 These need to be redirected through pdb_interface.c
638 ****************************************************************************/
639 BOOL pdb_get_dom_grp_info(const DOM_SID *sid, struct acct_info *info)
645 res = get_domain_group_from_sid(*sid, &map);
651 fstrcpy(info->acct_name, map.nt_name);
652 fstrcpy(info->acct_desc, map.comment);
653 sid_peek_rid(sid, &info->rid);
657 BOOL pdb_set_dom_grp_info(const DOM_SID *sid, const struct acct_info *info)
661 if (!get_domain_group_from_sid(*sid, &map))
664 fstrcpy(map.nt_name, info->acct_name);
665 fstrcpy(map.comment, info->acct_desc);
667 return NT_STATUS_IS_OK(pdb_update_group_mapping_entry(&map));
670 /********************************************************************
671 Really just intended to be called by smbd
672 ********************************************************************/
674 NTSTATUS pdb_create_builtin_alias(uint32 rid)
677 enum lsa_SidType type;
682 const char *name = NULL;
685 DEBUG(10, ("Trying to create builtin alias %d\n", rid));
687 if ( !sid_compose( &sid, &global_sid_Builtin, rid ) ) {
688 return NT_STATUS_NO_SUCH_ALIAS;
691 if ( (mem_ctx = talloc_new(NULL)) == NULL ) {
692 return NT_STATUS_NO_MEMORY;
695 if ( !lookup_sid(mem_ctx, &sid, NULL, &name, &type) ) {
696 TALLOC_FREE( mem_ctx );
697 return NT_STATUS_NO_SUCH_ALIAS;
700 /* validate RID so copy the name and move on */
702 fstrcpy( groupname, name );
703 TALLOC_FREE( mem_ctx );
705 if (!winbind_allocate_gid(&gid)) {
706 DEBUG(3, ("pdb_create_builtin_alias: Could not get a gid out of winbind\n"));
707 return NT_STATUS_ACCESS_DENIED;
710 DEBUG(10,("Creating alias %s with gid %d\n", name, gid));
713 sid_copy(&map.sid, &sid);
714 map.sid_name_use = SID_NAME_ALIAS;
715 fstrcpy(map.nt_name, name);
716 fstrcpy(map.comment, "");
718 status = pdb_add_group_mapping_entry(&map);
720 if (!NT_STATUS_IS_OK(status)) {
721 DEBUG(0, ("pdb_create_builtin_alias: Could not add group mapping entry for alias %d "
722 "(%s)\n", rid, nt_errstr(status)));