diff options
Diffstat (limited to 'source/utils/net_groupmap.c')
| -rw-r--r-- | source/utils/net_groupmap.c | 767 |
1 files changed, 767 insertions, 0 deletions
diff --git a/source/utils/net_groupmap.c b/source/utils/net_groupmap.c new file mode 100644 index 00000000000..78e763e1818 --- /dev/null +++ b/source/utils/net_groupmap.c @@ -0,0 +1,767 @@ +/* + * Unix SMB/CIFS implementation. + * RPC Pipe client / server routines + * Copyright (C) Andrew Tridgell 1992-2000, + * Copyright (C) Jean François Micouleau 1998-2001. + * Copyright (C) Gerald Carter 2003. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + + +#include "includes.h" +#include "../utils/net.h" + + +/********************************************************* + utility function to parse an integer parameter from + "parameter = value" +**********************************************************/ +static uint32 get_int_param( const char* param ) +{ + char *p; + + p = strchr( param, '=' ); + if ( !p ) + return 0; + + return atoi(p+1); +} + +/********************************************************* + utility function to parse an integer parameter from + "parameter = value" +**********************************************************/ +static char* get_string_param( const char* param ) +{ + char *p; + + p = strchr( param, '=' ); + if ( !p ) + return NULL; + + return (p+1); +} + +/********************************************************* + Figure out if the input was an NT group or a SID string. + Return the SID. +**********************************************************/ +static BOOL get_sid_from_input(DOM_SID *sid, char *input) +{ + GROUP_MAP map; + + if (StrnCaseCmp( input, "S-", 2)) { + /* Perhaps its the NT group name? */ + if (!pdb_getgrnam(&map, input)) { + printf("NT Group %s doesn't exist in mapping DB\n", input); + return False; + } else { + *sid = map.sid; + } + } else { + if (!string_to_sid(sid, input)) { + printf("converting sid %s from a string failed!\n", input); + return False; + } + } + return True; +} + +/********************************************************* + Dump a GROUP_MAP entry to stdout (long or short listing) +**********************************************************/ + +static void print_map_entry ( GROUP_MAP map, BOOL long_list ) +{ + fstring string_sid; + fstring group_type; + + decode_sid_name_use(group_type, map.sid_name_use); + sid_to_string(string_sid, &map.sid); + + if (!long_list) + d_printf("%s (%s) -> %s\n", map.nt_name, string_sid, gidtoname(map.gid)); + else { + d_printf("%s\n", map.nt_name); + d_printf("\tSID : %s\n", string_sid); + d_printf("\tUnix group: %s\n", gidtoname(map.gid)); + d_printf("\tGroup type: %s\n", group_type); + d_printf("\tComment : %s\n", map.comment); + } + +} +/********************************************************* + List the groups. +**********************************************************/ +static int net_groupmap_list(int argc, const char **argv) +{ + int entries; + BOOL long_list = False; + int i; + fstring ntgroup = ""; + fstring sid_string = ""; + + /* get the options */ + for ( i=0; i<argc; i++ ) { + if ( !StrCaseCmp(argv[i], "verbose")) { + long_list = True; + } + else if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) { + fstrcpy( ntgroup, get_string_param( argv[i] ) ); + if ( !ntgroup[0] ) { + d_printf("must supply a name\n"); + return -1; + } + } + else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) { + fstrcpy( sid_string, get_string_param( argv[i] ) ); + if ( !sid_string[0] ) { + d_printf("must supply a SID\n"); + return -1; + } + } + else { + d_printf("Bad option: %s\n", argv[i]); + return -1; + } + } + + /* list a single group is given a name */ + if ( ntgroup[0] || sid_string[0] ) { + DOM_SID sid; + GROUP_MAP map; + + if ( sid_string[0] ) + fstrcpy( ntgroup, sid_string); + + if (!get_sid_from_input(&sid, ntgroup)) { + return -1; + } + + /* Get the current mapping from the database */ + if(!pdb_getgrsid(&map, sid)) { + d_printf("Failure to local group SID in the database\n"); + return -1; + } + + print_map_entry( map, long_list ); + } + else { + GROUP_MAP *map=NULL; + /* enumerate all group mappings */ + if (!pdb_enum_group_mapping(SID_NAME_UNKNOWN, &map, &entries, ENUM_ALL_MAPPED)) + return -1; + + for (i=0; i<entries; i++) { + print_map_entry( map[i], long_list ); + } + + SAFE_FREE(map); + } + + return 0; +} + +/********************************************************* + Add a new group mapping entry +**********************************************************/ + +static int net_groupmap_add(int argc, const char **argv) +{ + DOM_SID sid; + fstring ntgroup = ""; + fstring unixgrp = ""; + fstring string_sid = ""; + fstring type = ""; + fstring ntcomment = ""; + enum SID_NAME_USE sid_type = SID_NAME_DOM_GRP; + uint32 rid = 0; + gid_t gid; + int i; + + /* get the options */ + for ( i=0; i<argc; i++ ) { + if ( !StrnCaseCmp(argv[i], "rid", strlen("rid")) ) { + rid = get_int_param(argv[i]); + if ( rid < DOMAIN_GROUP_RID_ADMINS ) { + d_printf("RID must be greater than %d\n", (uint32)DOMAIN_GROUP_RID_ADMINS-1); + return -1; + } + } + else if ( !StrnCaseCmp(argv[i], "unixgroup", strlen("unixgroup")) ) { + fstrcpy( unixgrp, get_string_param( argv[i] ) ); + if ( !unixgrp[0] ) { + d_printf("must supply a name\n"); + return -1; + } + } + else if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) { + fstrcpy( ntgroup, get_string_param( argv[i] ) ); + if ( !ntgroup[0] ) { + d_printf("must supply a name\n"); + return -1; + } + } + else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) { + fstrcpy( string_sid, get_string_param( argv[i] ) ); + if ( !string_sid[0] ) { + d_printf("must supply a SID\n"); + return -1; + } + } + else if ( !StrnCaseCmp(argv[i], "comment", strlen("comment")) ) { + fstrcpy( ntcomment, get_string_param( argv[i] ) ); + if ( !ntcomment[0] ) { + d_printf("must supply a comment string\n"); + return -1; + } + } + else if ( !StrnCaseCmp(argv[i], "type", strlen("type")) ) { + fstrcpy( type, get_string_param( argv[i] ) ); + switch ( type[0] ) { + case 'b': + case 'B': + sid_type = SID_NAME_WKN_GRP; + break; + case 'd': + case 'D': + sid_type = SID_NAME_DOM_GRP; + break; + case 'l': + case 'L': + sid_type = SID_NAME_ALIAS; + break; + } + } + else { + d_printf("Bad option: %s\n", argv[i]); + return -1; + } + } + + if ( !unixgrp[0] ) { + d_printf("Usage: net groupmap add {rid=<int>|sid=<string>} unixgroup=<string> [type=<domain|local|builtin>] [ntgroup=<string>] [comment=<string>]\n"); + return -1; + } + + if ( (gid = nametogid(unixgrp)) == (gid_t)-1 ) { + d_printf("Can't lookup UNIX group %s\n", unixgrp); + return -1; + } + + if ( (rid == 0) && (string_sid[0] == '\0') ) { + d_printf("No rid or sid specified, choosing algorithmic mapping\n"); + rid = pdb_gid_to_group_rid(gid); + } + + /* append the rid to our own domain/machine SID if we don't have a full SID */ + if ( !string_sid[0] ) { + sid_copy(&sid, get_global_sam_sid()); + sid_append_rid(&sid, rid); + sid_to_string(string_sid, &sid); + } + + if (!ntcomment[0]) + fstrcpy(ntcomment, "Local Unix group"); + + if (!ntgroup[0] ) + fstrcpy( ntgroup, unixgrp ); + + + if (!add_initial_entry(gid, string_sid, sid_type, ntgroup, ntcomment)) { + d_printf("adding entry for group %s failed!\n", ntgroup); + return -1; + } + + d_printf("Successully added group %s to the mapping db\n", ntgroup); + return 0; +} + +static int net_groupmap_modify(int argc, const char **argv) +{ + DOM_SID sid; + GROUP_MAP map; + fstring ntcomment = ""; + fstring type = ""; + fstring ntgroup = ""; + fstring unixgrp = ""; + fstring sid_string = ""; + enum SID_NAME_USE sid_type = SID_NAME_UNKNOWN; + int i; + gid_t gid; + + /* get the options */ + for ( i=0; i<argc; i++ ) { + if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) { + fstrcpy( ntgroup, get_string_param( argv[i] ) ); + if ( !ntgroup[0] ) { + d_printf("must supply a name\n"); + return -1; + } + } + else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) { + fstrcpy( sid_string, get_string_param( argv[i] ) ); + if ( !sid_string[0] ) { + d_printf("must supply a name\n"); + return -1; + } + } + else if ( !StrnCaseCmp(argv[i], "comment", strlen("comment")) ) { + fstrcpy( ntcomment, get_string_param( argv[i] ) ); + if ( !ntcomment[0] ) { + d_printf("must supply a comment string\n"); + return -1; + } + } + else if ( !StrnCaseCmp(argv[i], "unixgroup", strlen("unixgroup")) ) { + fstrcpy( unixgrp, get_string_param( argv[i] ) ); + if ( !unixgrp[0] ) { + d_printf("must supply a group name\n"); + return -1; + } + } + else if ( !StrnCaseCmp(argv[i], "type", strlen("type")) ) { + fstrcpy( type, get_string_param( argv[i] ) ); + switch ( type[0] ) { + case 'd': + case 'D': + sid_type = SID_NAME_DOM_GRP; + break; + case 'l': + case 'L': + sid_type = SID_NAME_ALIAS; + break; + } + } + else { + d_printf("Bad option: %s\n", argv[i]); + return -1; + } + } + + if ( !ntgroup[0] && !sid_string[0] ) { + d_printf("Usage: net groupmap modify {ntgroup=<string>|sid=<SID>} [comment=<string>] [unixgroup=<string>] [type=<domain|local>]\n"); + return -1; + } + + /* give preference to the SID; if both the ntgroup name and SID + are defined, use the SID and assume that the group name could be a + new name */ + + if ( sid_string[0] ) { + if (!get_sid_from_input(&sid, sid_string)) { + return -1; + } + } + else { + if (!get_sid_from_input(&sid, ntgroup)) { + return -1; + } + } + + /* Get the current mapping from the database */ + if(!pdb_getgrsid(&map, sid)) { + d_printf("Failure to local group SID in the database\n"); + return -1; + } + + /* + * Allow changing of group type only between domain and local + * We disallow changing Builtin groups !!! (SID problem) + */ + if (sid_type != SID_NAME_UNKNOWN) { + if (map.sid_name_use == SID_NAME_WKN_GRP) { + d_printf("You can only change between domain and local groups.\n"); + return -1; + } + + map.sid_name_use=sid_type; + } + + /* Change comment if new one */ + if ( ntcomment[0] ) + fstrcpy( map.comment, ntcomment ); + + if ( ntgroup[0] ) + fstrcpy( map.nt_name, ntgroup ); + + if ( unixgrp[0] ) { + gid = nametogid( unixgrp ); + if ( gid == -1 ) { + d_printf("Unable to lookup UNIX group %s. Make sure the group exists.\n", + unixgrp); + return -1; + } + + map.gid = gid; + } + + if ( !pdb_update_group_mapping_entry(&map) ) { + d_printf("Could not update group database\n"); + return -1; + } + + d_printf("Updated mapping entry for %s\n", map.nt_name); + + return 0; +} + +static int net_groupmap_delete(int argc, const char **argv) +{ + DOM_SID sid; + fstring ntgroup = ""; + fstring sid_string = ""; + int i; + + /* get the options */ + for ( i=0; i<argc; i++ ) { + if ( !StrnCaseCmp(argv[i], "ntgroup", strlen("ntgroup")) ) { + fstrcpy( ntgroup, get_string_param( argv[i] ) ); + if ( !ntgroup[0] ) { + d_printf("must supply a name\n"); + return -1; + } + } + else if ( !StrnCaseCmp(argv[i], "sid", strlen("sid")) ) { + fstrcpy( sid_string, get_string_param( argv[i] ) ); + if ( !sid_string[0] ) { + d_printf("must supply a SID\n"); + return -1; + } + } + else { + d_printf("Bad option: %s\n", argv[i]); + return -1; + } + } + + if ( !ntgroup[0] && !sid_string[0]) { + d_printf("Usage: net groupmap delete {ntgroup=<string>|sid=<SID>}\n"); + return -1; + } + + /* give preference to the SID if we have that */ + + if ( sid_string[0] ) + fstrcpy( ntgroup, sid_string ); + + if ( !get_sid_from_input(&sid, ntgroup) ) { + d_printf("Unable to resolve group %s to a SID\n", ntgroup); + return -1; + } + + if ( !pdb_delete_group_mapping_entry(sid) ) { + printf("Failed to removing group %s from the mapping db!\n", ntgroup); + return -1; + } + + d_printf("Sucessfully removed %s from the mapping db\n", ntgroup); + + return 0; +} + +static int net_groupmap_set(int argc, const char **argv) +{ + const char *ntgroup = NULL; + struct group *grp = NULL; + GROUP_MAP map; + BOOL have_map = False; + + if ((argc < 1) || (argc > 2)) { + d_printf("Usage: net groupmap set \"NT Group\" " + "[\"unix group\"] [-C \"comment\"] [-L] [-D]\n"); + return -1; + } + + if ( opt_localgroup && opt_domaingroup ) { + d_printf("Can only specify -L or -D, not both\n"); + return -1; + } + + ntgroup = argv[0]; + + if (argc == 2) { + grp = getgrnam(argv[1]); + + if (grp == NULL) { + d_printf("Could not find unix group %s\n", argv[1]); + return -1; + } + } + + have_map = pdb_getgrnam(&map, ntgroup); + + if (!have_map) { + DOM_SID sid; + have_map = ( (strncmp(ntgroup, "S-", 2) == 0) && + string_to_sid(&sid, ntgroup) && + pdb_getgrsid(&map, sid) ); + } + + if (!have_map) { + + /* Ok, add it */ + + if (grp == NULL) { + d_printf("Could not find group mapping for %s\n", + ntgroup); + return -1; + } + + map.gid = grp->gr_gid; + + if (opt_rid == 0) { + opt_rid = pdb_gid_to_group_rid(map.gid); + } + + sid_copy(&map.sid, get_global_sam_sid()); + sid_append_rid(&map.sid, opt_rid); + + map.sid_name_use = SID_NAME_DOM_GRP; + fstrcpy(map.nt_name, ntgroup); + fstrcpy(map.comment, ""); + + if (!pdb_add_group_mapping_entry(&map)) { + d_printf("Could not add mapping entry for %s\n", + ntgroup); + return -1; + } + } + + /* Now we have a mapping entry, update that stuff */ + + if ( opt_localgroup || opt_domaingroup ) { + if (map.sid_name_use == SID_NAME_WKN_GRP) { + d_printf("Can't change type of the BUILTIN group %s\n", + map.nt_name); + return -1; + } + } + + if (opt_localgroup) + map.sid_name_use = SID_NAME_ALIAS; + + if (opt_domaingroup) + map.sid_name_use = SID_NAME_DOM_GRP; + + /* The case (opt_domaingroup && opt_localgroup) was tested for above */ + + if (strlen(opt_comment) > 0) + fstrcpy(map.comment, opt_comment); + + if (strlen(opt_newntname) > 0) + fstrcpy(map.nt_name, opt_newntname); + + if (grp != NULL) + map.gid = grp->gr_gid; + + if (!pdb_update_group_mapping_entry(&map)) { + d_printf("Could not update group mapping for %s\n", ntgroup); + return -1; + } + + return 0; +} + +static int net_groupmap_cleanup(int argc, const char **argv) +{ + GROUP_MAP *map = NULL; + int i, entries; + + if (!pdb_enum_group_mapping(SID_NAME_UNKNOWN, &map, &entries, + ENUM_ALL_MAPPED)) { + d_printf("Could not list group mappings\n"); + return -1; + } + + for (i=0; i<entries; i++) { + + if (map[i].sid_name_use == SID_NAME_WKN_GRP) + continue; + + if (map[i].gid == -1) + printf("Group %s is not mapped\n", map[i].nt_name); + + if (!sid_check_is_in_our_domain(&map[i].sid)) { + printf("Deleting mapping for NT Group %s, sid %s\n", + map[i].nt_name, + sid_string_static(&map[i].sid)); + pdb_delete_group_mapping_entry(map[i].sid); + } + } + + SAFE_FREE(map); + + return 0; +} + +static int net_groupmap_addmem(int argc, const char **argv) +{ + DOM_SID alias, member; + + if ( (argc != 2) || + !string_to_sid(&alias, argv[0]) || + !string_to_sid(&member, argv[1]) ) { + d_printf("Usage: net groupmap addmem alias-sid member-sid\n"); + return -1; + } + + if (!pdb_add_aliasmem(&alias, &member)) { + d_printf("Could not add sid %s to alias %s\n", + argv[1], argv[0]); + return -1; + } + + return 0; +} + +static int net_groupmap_delmem(int argc, const char **argv) +{ + DOM_SID alias, member; + + if ( (argc != 2) || + !string_to_sid(&alias, argv[0]) || + !string_to_sid(&member, argv[1]) ) { + d_printf("Usage: net groupmap delmem alias-sid member-sid\n"); + return -1; + } + + if (!pdb_del_aliasmem(&alias, &member)) { + d_printf("Could not delete sid %s from alias %s\n", + argv[1], argv[0]); + return -1; + } + + return 0; +} + +static int net_groupmap_listmem(int argc, const char **argv) +{ + DOM_SID alias; + DOM_SID *members; + int i, num; + NTSTATUS result; + + if ( (argc != 1) || + !string_to_sid(&alias, argv[0]) ) { + d_printf("Usage: net groupmap listmem alias-sid\n"); + return -1; + } + + if (!pdb_enum_aliasmem(&alias, &members, &num)) { + d_printf("Could not list members for sid %s: %s\n", + argv[0], nt_errstr(result)); + return -1; + } + + for (i = 0; i < num; i++) { + printf("%s\n", sid_string_static(&(members[i]))); + } + + SAFE_FREE(members); + + return 0; +} + +static int net_groupmap_memberships(int argc, const char **argv) +{ + DOM_SID member; + DOM_SID *aliases; + int i, num; + NTSTATUS result; + + if ( (argc != 1) || + !string_to_sid(&member, argv[0]) ) { + d_printf("Usage: net groupmap memberof sid\n"); + return -1; + } + + if (!pdb_enum_alias_memberships(&member, &aliases, &num)) { + d_printf("Could not list memberships for sid %s: %s\n", + argv[0], nt_errstr(result)); + return -1; + } + + for (i = 0; i < num; i++) { + printf("%s\n", sid_string_static(&(aliases[i]))); + } + + SAFE_FREE(aliases); + + return 0; +} + +int net_help_groupmap(int argc, const char **argv) +{ + d_printf("net groupmap add"\ + "\n Create a new group mapping\n"); + d_printf("net groupmap modify"\ + "\n Update a group mapping\n"); + d_printf("net groupmap delete"\ + "\n Remove a group mapping\n"); + d_printf("net groupmap addmember"\ + "\n Add a foreign alias member\n"); + d_printf("net groupmap delmember"\ + "\n Delete a foreign alias member\n"); + d_printf("net groupmap listmembers"\ + "\n List foreign group members\n"); + d_printf("net groupmap memberships"\ + "\n List foreign group memberships\n"); + d_printf("net groupmap list"\ + "\n List current group map\n"); + d_printf("net groupmap set"\ + "\n Set group mapping\n"); + d_printf("net groupmap cleanup"\ + "\n Remove foreign group mapping entries\n"); + + return -1; +} + + +/*********************************************************** + migrated functionality from smbgroupedit + **********************************************************/ +int net_groupmap(int argc, const char **argv) +{ + struct functable func[] = { + {"add", net_groupmap_add}, + {"modify", net_groupmap_modify}, + {"delete", net_groupmap_delete}, + {"set", net_groupmap_set}, + {"cleanup", net_groupmap_cleanup}, + {"addmem", net_groupmap_addmem}, + {"delmem", net_groupmap_delmem}, + {"listmem", net_groupmap_listmem}, + {"memberships", net_groupmap_memberships}, + {"list", net_groupmap_list}, + {"help", net_help_groupmap}, + {NULL, NULL} + }; + + /* we shouldn't have silly checks like this */ +#if 0 + if (getuid() != 0) { + d_printf("You must be root to edit group mappings.\nExiting...\n"); + return -1; + } +#endif + + if ( argc ) + return net_run_function(argc, argv, func, net_help_groupmap); + + return net_help_groupmap( argc, argv ); +} + |