[PATCH] Added ability to remove id mappings in wbinfo and libwbclient.

The idmap_tdb backend already provides an interface to remove existing id
mappings.  This commit plumbs that ability up through, winbindd, libwbclient,
and wbinfo.

Added new winbindd command:
        WINBINDD_REMOVE_MAPPING
Added new libwbclient interfaces:
        wbcRemoveUidMapping() and wbcRemoveGidMapping()
Added new wbinfo options:
        --remove-uid-mapping
        --remove-gid-mapping

Increased libwbclient version to 0.2
Increased winbind interface version to 20
(cherry picked from commit 2ebab00716509617f1980beacee09c85b6b13b91)

11 files changed, 315 insertions, 4 deletions

diff --git a/source/include/proto.h b/source/include/proto.h
index f93870d58d9..a147ae539ff 100644
--- a/source/include/proto.h
+++ b/source/include/proto.h
@@ -10515,6 +10515,7 @@ NTSTATUS idmap_backends_sid_to_unixid(const char *domname,
 NTSTATUS idmap_new_mapping(const struct dom_sid *psid, enum id_type type,
 			   struct unixid *pxid);
 NTSTATUS idmap_set_mapping(const struct id_map *map);
+NTSTATUS idmap_remove_mapping(const struct id_map *map);
 
 /* The following definitions come from winbindd/idmap_cache.c  */
 
diff --git a/source/nsswitch/libwbclient/wbc_idmap.c b/source/nsswitch/libwbclient/wbc_idmap.c
index 1615fd33eef..6652f676364 100644
--- a/source/nsswitch/libwbclient/wbc_idmap.c
+++ b/source/nsswitch/libwbclient/wbc_idmap.c
@@ -362,6 +362,92 @@ wbcErr wbcSetGidMapping(gid_t gid, const struct wbcDomainSid *sid)
 	return wbc_status;
 }
 
+/** @brief Remove a user id mapping
+ *
+ * @param uid       Uid of the mapping to remove.
+ * @param *sid      Pointer to the sid of the mapping to remove.
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcRemoveUidMapping(uid_t uid, const struct wbcDomainSid *sid)
+{
+	struct winbindd_request request;
+	struct winbindd_response response;
+	wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+	char *sid_string = NULL;
+
+	if (!sid) {
+		return WBC_ERR_INVALID_PARAM;
+	}
+
+	/* Initialise request */
+
+	ZERO_STRUCT(request);
+	ZERO_STRUCT(response);
+
+	/* Make request */
+
+	request.data.dual_idmapset.id = uid;
+	request.data.dual_idmapset.type = _ID_TYPE_UID;
+
+	wbc_status = wbcSidToString(sid, &sid_string);
+	BAIL_ON_WBC_ERROR(wbc_status);
+
+	strncpy(request.data.dual_idmapset.sid, sid_string,
+		sizeof(request.data.dual_idmapset.sid)-1);
+	wbcFreeMemory(sid_string);
+
+	wbc_status = wbcRequestResponse(WINBINDD_REMOVE_MAPPING,
+					&request, &response);
+	BAIL_ON_WBC_ERROR(wbc_status);
+
+ done:
+	return wbc_status;
+}
+
+/** @brief Remove a group id mapping
+ *
+ * @param gid       Gid of the mapping to remove.
+ * @param *sid      Pointer to the sid of the mapping to remove.
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcRemoveGidMapping(gid_t gid, const struct wbcDomainSid *sid)
+{
+	struct winbindd_request request;
+	struct winbindd_response response;
+	wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+	char *sid_string = NULL;
+
+	if (!sid) {
+		return WBC_ERR_INVALID_PARAM;
+	}
+
+	/* Initialise request */
+
+	ZERO_STRUCT(request);
+	ZERO_STRUCT(response);
+
+	/* Make request */
+
+	request.data.dual_idmapset.id = gid;
+	request.data.dual_idmapset.type = _ID_TYPE_GID;
+
+	wbc_status = wbcSidToString(sid, &sid_string);
+	BAIL_ON_WBC_ERROR(wbc_status);
+
+	strncpy(request.data.dual_idmapset.sid, sid_string,
+		sizeof(request.data.dual_idmapset.sid)-1);
+	wbcFreeMemory(sid_string);
+
+	wbc_status = wbcRequestResponse(WINBINDD_REMOVE_MAPPING,
+					&request, &response);
+	BAIL_ON_WBC_ERROR(wbc_status);
+
+ done:
+	return wbc_status;
+}
+
 /** @brief Set the highwater mark for allocated uids.
  *
  * @param uid_hwm      The new uid highwater mark value
diff --git a/source/nsswitch/libwbclient/wbclient.h b/source/nsswitch/libwbclient/wbclient.h
index 797b4d7044a..f927b35f70e 100644
--- a/source/nsswitch/libwbclient/wbclient.h
+++ b/source/nsswitch/libwbclient/wbclient.h
@@ -57,9 +57,12 @@ const char *wbcErrorString(wbcErr error);
 /**
  *  @brief Some useful details about the wbclient library
  *
+ *  0.1: Initial version
+ *  0.2: Added wbcRemoveUidMapping()
+ *       Added wbcRemoveGidMapping()
  **/
 #define WBCLIENT_MAJOR_VERSION 0
-#define WBCLIENT_MINOR_VERSION 1
+#define WBCLIENT_MINOR_VERSION 2
 #define WBCLIENT_VENDOR_VERSION "Samba libwbclient"
 struct wbcLibraryDetails {
 	uint16_t major_version;
@@ -503,6 +506,10 @@ wbcErr wbcSetUidMapping(uid_t uid, const struct wbcDomainSid *sid);
 
 wbcErr wbcSetGidMapping(gid_t gid, const struct wbcDomainSid *sid);
 
+wbcErr wbcRemoveUidMapping(uid_t uid, const struct wbcDomainSid *sid);
+
+wbcErr wbcRemoveGidMapping(gid_t gid, const struct wbcDomainSid *sid);
+
 wbcErr wbcSetUidHwm(uid_t uid_hwm);
 
 wbcErr wbcSetGidHwm(gid_t gid_hwm);
diff --git a/source/nsswitch/wbinfo.c b/source/nsswitch/wbinfo.c
index 27df52f92c9..d5eee7e8f8e 100644
--- a/source/nsswitch/wbinfo.c
+++ b/source/nsswitch/wbinfo.c
@@ -811,6 +811,54 @@ static bool wbinfo_set_gid_mapping(gid_t gid, const char *sid_str)
 	return true;
 }
 
+static bool wbinfo_remove_uid_mapping(uid_t uid, const char *sid_str)
+{
+	wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+	struct wbcDomainSid sid;
+
+	/* Send request */
+
+	wbc_status = wbcStringToSid(sid_str, &sid);
+	if (!WBC_ERROR_IS_OK(wbc_status)) {
+		return false;
+	}
+
+	wbc_status = wbcRemoveUidMapping(uid, &sid);
+	if (!WBC_ERROR_IS_OK(wbc_status)) {
+		return false;
+	}
+
+	/* Display response */
+
+	d_printf("Removed uid %d to sid %s mapping\n", uid, sid_str);
+
+	return true;
+}
+
+static bool wbinfo_remove_gid_mapping(gid_t gid, const char *sid_str)
+{
+	wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+	struct wbcDomainSid sid;
+
+	/* Send request */
+
+	wbc_status = wbcStringToSid(sid_str, &sid);
+	if (!WBC_ERROR_IS_OK(wbc_status)) {
+		return false;
+	}
+
+	wbc_status = wbcRemoveGidMapping(gid, &sid);
+	if (!WBC_ERROR_IS_OK(wbc_status)) {
+		return false;
+	}
+
+	/* Display response */
+
+	d_printf("Removed gid %d to sid %s mapping\n", gid, sid_str);
+
+	return true;
+}
+
 /* Convert sid to string */
 
 static bool wbinfo_lookupsid(const char *sid_str)
@@ -1489,6 +1537,8 @@ enum {
 	OPT_ALLOCATE_GID,
 	OPT_SET_UID_MAPPING,
 	OPT_SET_GID_MAPPING,
+	OPT_REMOVE_UID_MAPPING,
+	OPT_REMOVE_GID_MAPPING,
 	OPT_SEPARATOR,
 	OPT_LIST_ALL_DOMAINS,
 	OPT_LIST_OWN_DOMAIN,
@@ -1538,6 +1588,8 @@ int main(int argc, char **argv, char **envp)
 		  "Get a new GID out of idmap" },
 		{ "set-uid-mapping", 0, POPT_ARG_STRING, &string_arg, OPT_SET_UID_MAPPING, "Create or modify uid to sid mapping in idmap", "UID,SID" },
 		{ "set-gid-mapping", 0, POPT_ARG_STRING, &string_arg, OPT_SET_GID_MAPPING, "Create or modify gid to sid mapping in idmap", "GID,SID" },
+		{ "remove-uid-mapping", 0, POPT_ARG_STRING, &string_arg, OPT_REMOVE_UID_MAPPING, "Remove uid to sid mapping in idmap", "UID,SID" },
+		{ "remove-gid-mapping", 0, POPT_ARG_STRING, &string_arg, OPT_REMOVE_GID_MAPPING, "Remove gid to sid mapping in idmap", "GID,SID" },
 		{ "check-secret", 't', POPT_ARG_NONE, 0, 't', "Check shared secret" },
 		{ "trusted-domains", 'm', POPT_ARG_NONE, 0, 'm', "List trusted domains" },
 		{ "all-domains", 0, POPT_ARG_NONE, 0, OPT_LIST_ALL_DOMAINS, "List all domains (trusted and own domain)" },
@@ -1726,6 +1778,28 @@ int main(int argc, char **argv, char **envp)
 				goto done;
 			}
 			break;
+		case OPT_REMOVE_UID_MAPPING:
+			if (!parse_mapping_arg(string_arg, &int_subarg,
+				&string_subarg) ||
+			    !wbinfo_remove_uid_mapping(int_subarg,
+				string_subarg))
+			{
+				d_fprintf(stderr, "Could not remove uid to sid "
+				    "mapping\n");
+				goto done;
+			}
+			break;
+		case OPT_REMOVE_GID_MAPPING:
+			if (!parse_mapping_arg(string_arg, &int_subarg,
+			        &string_subarg) ||
+			    !wbinfo_remove_gid_mapping(int_subarg,
+			        string_subarg))
+			{
+				d_fprintf(stderr, "Could not remove gid to sid "
+				    "mapping\n");
+				goto done;
+			}
+			break;
 		case 't':
 			if (!wbinfo_check_secret()) {
 				d_fprintf(stderr, "Could not check secret\n");
diff --git a/source/nsswitch/winbind_struct_protocol.h b/source/nsswitch/winbind_struct_protocol.h
index 169b4a8c95a..e16103465f2 100644
--- a/source/nsswitch/winbind_struct_protocol.h
+++ b/source/nsswitch/winbind_struct_protocol.h
@@ -41,7 +41,9 @@
 
 /* Update this when you change the interface.  */
 
-#define WINBIND_INTERFACE_VERSION 19
+/* Version 20: added WINBINDD_REMOVE_MAPPING command */
+
+#define WINBIND_INTERFACE_VERSION 20
 
 /* Have to deal with time_t being 4 or 8 bytes due to structure alignment.
    On a 64bit Linux box, we have to support a constant structure size
@@ -104,6 +106,7 @@ enum winbindd_cmd {
 	WINBINDD_ALLOCATE_UID,
 	WINBINDD_ALLOCATE_GID,
 	WINBINDD_SET_MAPPING,
+	WINBINDD_REMOVE_MAPPING,
 	WINBINDD_SET_HWM,
 
 	/* Miscellaneous other stuff */
@@ -150,6 +153,7 @@ enum winbindd_cmd {
 	WINBINDD_DUAL_UID2SID,
 	WINBINDD_DUAL_GID2SID,
 	WINBINDD_DUAL_SET_MAPPING,
+	WINBINDD_DUAL_REMOVE_MAPPING,
 	WINBINDD_DUAL_SET_HWM,
 
 	/* Wrapper around possibly blocking unix nss calls */
diff --git a/source/winbindd/idmap.c b/source/winbindd/idmap.c
index cfc5597f429..054df9be057 100644
--- a/source/winbindd/idmap.c
+++ b/source/winbindd/idmap.c
@@ -788,3 +788,20 @@ NTSTATUS idmap_set_mapping(const struct id_map *map)
 
 	return dom->methods->set_mapping(dom, map);
 }
+
+NTSTATUS idmap_remove_mapping(const struct id_map *map)
+{
+	struct idmap_domain *dom;
+
+	dom = idmap_find_domain(NULL);
+	if (dom == NULL) {
+		DEBUG(3, ("no default domain, no place to write\n"));
+		return NT_STATUS_ACCESS_DENIED;
+	}
+	if (dom->methods->remove_mapping == NULL) {
+		DEBUG(3, ("default domain not writable\n"));
+		return NT_STATUS_MEDIA_WRITE_PROTECTED;
+	}
+
+	return dom->methods->remove_mapping(dom, map);
+}
diff --git a/source/winbindd/idmap_tdb.c b/source/winbindd/idmap_tdb.c
index 9e66eed0c88..c9b07f1b631 100644
--- a/source/winbindd/idmap_tdb.c
+++ b/source/winbindd/idmap_tdb.c
@@ -875,8 +875,13 @@ static NTSTATUS idmap_tdb_set_mapping(struct idmap_domain *dom, const struct id_
 	ksid = string_term_tdb_data(ksidstr);
 
 	/* *DELETE* previous mappings if any.
-	 * This is done both SID and [U|G]ID passed in */
-	
+	 * This is done for both the SID and [U|G]ID passed in */
+
+	/* NOTE: We should lock both the ksid and kid records here, before
+	 * making modifications.  However, because tdb_chainlock() is a
+	 * blocking call we could create an unrecoverable deadlock, so for now
+	 * we only lock the ksid record. */
+
 	/* Lock the record for this SID. */
 	if (tdb_chainlock(ctx->tdb, ksid) != 0) {
 		DEBUG(10,("Failed to lock record %s. Error %s\n",
@@ -981,6 +986,11 @@ static NTSTATUS idmap_tdb_remove_mapping(struct idmap_domain *dom, const struct
 	ksid = string_term_tdb_data(ksidstr);
 	kid = string_term_tdb_data(kidstr);
 
+	/* NOTE: We should lock both the ksid and kid records here, before
+	 * making modifications.  However, because tdb_chainlock() is a
+	 * blocking call we could create an unrecoverable deadlock, so for now
+	 * we only lock the ksid record. */
+
 	/* Lock the record for this SID. */
 	if (tdb_chainlock(ctx->tdb, ksid) != 0) {
 		DEBUG(10,("Failed to lock record %s. Error %s\n",
diff --git a/source/winbindd/winbindd.c b/source/winbindd/winbindd.c
index 81eb3745b86..5984a87cfe3 100644
--- a/source/winbindd/winbindd.c
+++ b/source/winbindd/winbindd.c
@@ -343,6 +343,7 @@ static struct winbindd_dispatch_table {
 	{ WINBINDD_ALLOCATE_UID, winbindd_allocate_uid, "ALLOCATE_UID" },
 	{ WINBINDD_ALLOCATE_GID, winbindd_allocate_gid, "ALLOCATE_GID" },
 	{ WINBINDD_SET_MAPPING, winbindd_set_mapping, "SET_MAPPING" },
+	{ WINBINDD_REMOVE_MAPPING, winbindd_remove_mapping, "REMOVE_MAPPING" },
 	{ WINBINDD_SET_HWM, winbindd_set_hwm, "SET_HWMS" },
 
 	/* Miscellaneous */
diff --git a/source/winbindd/winbindd_idmap.c b/source/winbindd/winbindd_idmap.c
index d8c67dc21c7..94a8c78a855 100644
--- a/source/winbindd/winbindd_idmap.c
+++ b/source/winbindd/winbindd_idmap.c
@@ -111,6 +111,65 @@ enum winbindd_result winbindd_dual_set_mapping(struct winbindd_domain *domain,
 	return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
 }
 
+static void winbindd_remove_mapping_recv(TALLOC_CTX *mem_ctx, bool success,
+				   struct winbindd_response *response,
+				   void *c, void *private_data)
+{
+	void (*cont)(void *priv, bool succ) = (void (*)(void *, bool))c;
+
+	if (!success) {
+		DEBUG(5, ("Could not trigger idmap_remove_mapping\n"));
+		cont(private_data, False);
+		return;
+	}
+
+	if (response->result != WINBINDD_OK) {
+		DEBUG(5, ("idmap_remove_mapping returned an error\n"));
+		cont(private_data, False);
+		return;
+	}
+
+	cont(private_data, True);
+}
+
+void winbindd_remove_mapping_async(TALLOC_CTX *mem_ctx,
+			     const struct id_map *map,
+			     void (*cont)(void *private_data, bool success),
+			     void *private_data)
+{
+	struct winbindd_request request;
+	ZERO_STRUCT(request);
+	request.cmd = WINBINDD_DUAL_REMOVE_MAPPING;
+	request.data.dual_idmapset.id = map->xid.id;
+	request.data.dual_idmapset.type = map->xid.type;
+	sid_to_fstring(request.data.dual_idmapset.sid, map->sid);
+
+	do_async(mem_ctx, idmap_child(), &request, winbindd_remove_mapping_recv,
+		 (void *)cont, private_data);
+}
+
+enum winbindd_result winbindd_dual_remove_mapping(
+					    struct winbindd_domain *domain,
+					    struct winbindd_cli_state *state)
+{
+	struct id_map map;
+	DOM_SID sid;
+	NTSTATUS result;
+
+	DEBUG(3, ("[%5lu]: dual_idmapremove\n", (unsigned long)state->pid));
+
+	if (!string_to_sid(&sid, state->request.data.dual_idmapset.sid))
+		return WINBINDD_ERROR;
+
+	map.sid = &sid;
+	map.xid.id = state->request.data.dual_idmapset.id;
+	map.xid.type = state->request.data.dual_idmapset.type;
+	map.status = ID_MAPPED;
+
+	result = idmap_remove_mapping(&map);
+	return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
+}
+
 static void winbindd_set_hwm_recv(TALLOC_CTX *mem_ctx, bool success,
 				   struct winbindd_response *response,
 				   void *c, void *private_data)
@@ -486,6 +545,10 @@ static const struct winbindd_child_dispatch_table idmap_dispatch_table[] = {
 		.struct_cmd	= WINBINDD_DUAL_SET_MAPPING,
 		.struct_fn	= winbindd_dual_set_mapping,
 	},{
+		.name		= "DUAL_REMOVE_MAPPING",
+		.struct_cmd	= WINBINDD_DUAL_REMOVE_MAPPING,
+		.struct_fn	= winbindd_dual_remove_mapping,
+	},{
 		.name		= "DUAL_SET_HWMS",
 		.struct_cmd	= WINBINDD_DUAL_SET_HWM,
 		.struct_fn	= winbindd_dual_set_hwm,
diff --git a/source/winbindd/winbindd_proto.h b/source/winbindd/winbindd_proto.h
index b1e1e4f3f44..b0a08fdb070 100644
--- a/source/winbindd/winbindd_proto.h
+++ b/source/winbindd/winbindd_proto.h
@@ -355,6 +355,11 @@ void winbindd_set_mapping_async(TALLOC_CTX *mem_ctx, const struct id_map *map,
 			     void *private_data);
 enum winbindd_result winbindd_dual_set_mapping(struct winbindd_domain *domain,
 					    struct winbindd_cli_state *state);
+void winbindd_remove_mapping_async(TALLOC_CTX *mem_ctx, const struct id_map *map,
+			     void (*cont)(void *private_data, bool success),
+			     void *private_data);
+enum winbindd_result winbindd_dual_remove_mapping(struct winbindd_domain *domain,
+					    struct winbindd_cli_state *state);
 void winbindd_set_hwm_async(TALLOC_CTX *mem_ctx, const struct unixid *xid,
 			     void (*cont)(void *private_data, bool success),
 			     void *private_data);
@@ -507,6 +512,7 @@ void winbindd_sid_to_uid(struct winbindd_cli_state *state);
 void winbindd_sid_to_gid(struct winbindd_cli_state *state);
 void winbindd_sids_to_unixids(struct winbindd_cli_state *state);
 void winbindd_set_mapping(struct winbindd_cli_state *state);
+void winbindd_remove_mapping(struct winbindd_cli_state *state);
 void winbindd_set_hwm(struct winbindd_cli_state *state);
 void winbindd_uid_to_sid(struct winbindd_cli_state *state);
 void winbindd_gid_to_sid(struct winbindd_cli_state *state);
diff --git a/source/winbindd/winbindd_sid.c b/source/winbindd/winbindd_sid.c
index 274786fa632..d8bd8630378 100644
--- a/source/winbindd/winbindd_sid.c
+++ b/source/winbindd/winbindd_sid.c
@@ -415,6 +415,48 @@ void winbindd_set_mapping(struct winbindd_cli_state *state)
 			set_mapping_recv, state);
 }
 
+static void remove_mapping_recv(void *private_data, bool success)
+{
+	struct winbindd_cli_state *state =
+		talloc_get_type_abort(private_data, struct winbindd_cli_state);
+
+	if (!success) {
+		DEBUG(5, ("Could not remove sid mapping\n"));
+		request_error(state);
+		return;
+	}
+
+	request_ok(state);
+}
+
+void winbindd_remove_mapping(struct winbindd_cli_state *state)
+{
+	struct id_map map;
+	DOM_SID sid;
+
+	DEBUG(3, ("[%5lu]: remove id map\n", (unsigned long)state->pid));
+
+	if ( ! state->privileged) {
+		DEBUG(0, ("Only root is allowed to remove mappings!\n"));
+		request_error(state);
+		return;
+	}
+
+	if (!string_to_sid(&sid, state->request.data.dual_idmapset.sid)) {
+		DEBUG(1, ("Could not get convert sid %s from string\n",
+			  state->request.data.sid));
+		request_error(state);
+		return;
+	}
+
+	map.sid = &sid;
+	map.xid.id = state->request.data.dual_idmapset.id;
+	map.xid.type = state->request.data.dual_idmapset.type;
+
+	winbindd_remove_mapping_async(state->mem_ctx, &map,
+			remove_mapping_recv, state);
+}
+
 static void set_hwm_recv(void *private_data, bool success)
 {
 	struct winbindd_cli_state *state =