mirror of
https://github.com/samba-team/samba.git
synced 2025-03-29 02:50:28 +03:00
s3: create_builtin_users/administrators belongs to passdb not auth.
Guenther
This commit is contained in:
Günther Deschner
parent
9bd06f6bc7
commit
03e6082e3c
@ -763,7 +763,8 @@ PASSDB_OBJ = $(PASSDB_GET_SET_OBJ) passdb/passdb.o passdb/pdb_interface.o \
|
||||
passdb/util_unixsids.o passdb/lookup_sid.o \
|
||||
passdb/login_cache.o @PDB_STATIC@ \
|
||||
passdb/account_pol.o $(PRIVILEGES_OBJ) \
|
||||
lib/util_nscd.o lib/winbind_util.o $(SERVER_MUTEX_OBJ)
|
||||
lib/util_nscd.o lib/winbind_util.o $(SERVER_MUTEX_OBJ) \
|
||||
passdb/pdb_util.o
|
||||
|
||||
DEVEL_HELP_WEIRD_OBJ = modules/weird.o
|
||||
CP850_OBJ = modules/CP850.o
|
||||
|
||||
@ -204,136 +204,6 @@ static NTSTATUS add_builtin_administrators(struct security_token *token,
|
||||
return NT_STATUS_OK;
|
||||
}
|
||||
|
||||
/**
|
||||
* Create the requested BUILTIN if it doesn't already exist. This requires
|
||||
* winbindd to be running.
|
||||
*
|
||||
* @param[in] rid BUILTIN rid to create
|
||||
* @return Normal NTSTATUS return.
|
||||
*/
|
||||
static NTSTATUS create_builtin(uint32 rid)
|
||||
{
|
||||
NTSTATUS status = NT_STATUS_OK;
|
||||
struct dom_sid sid;
|
||||
gid_t gid;
|
||||
|
||||
if (!sid_compose(&sid, &global_sid_Builtin, rid)) {
|
||||
return NT_STATUS_NO_SUCH_ALIAS;
|
||||
}
|
||||
|
||||
if (!sid_to_gid(&sid, &gid)) {
|
||||
if (!lp_winbind_nested_groups() || !winbind_ping()) {
|
||||
return NT_STATUS_PROTOCOL_UNREACHABLE;
|
||||
}
|
||||
status = pdb_create_builtin_alias(rid);
|
||||
}
|
||||
return status;
|
||||
}
|
||||
|
||||
/**
|
||||
* Add sid as a member of builtin_sid.
|
||||
*
|
||||
* @param[in] builtin_sid An existing builtin group.
|
||||
* @param[in] dom_sid sid to add as a member of builtin_sid.
|
||||
* @return Normal NTSTATUS return
|
||||
*/
|
||||
static NTSTATUS add_sid_to_builtin(const struct dom_sid *builtin_sid,
|
||||
const struct dom_sid *dom_sid)
|
||||
{
|
||||
NTSTATUS status = NT_STATUS_OK;
|
||||
|
||||
if (!dom_sid || !builtin_sid) {
|
||||
return NT_STATUS_INVALID_PARAMETER;
|
||||
}
|
||||
|
||||
status = pdb_add_aliasmem(builtin_sid, dom_sid);
|
||||
|
||||
if (NT_STATUS_EQUAL(status, NT_STATUS_MEMBER_IN_ALIAS)) {
|
||||
DEBUG(5, ("add_sid_to_builtin %s is already a member of %s\n",
|
||||
sid_string_dbg(dom_sid),
|
||||
sid_string_dbg(builtin_sid)));
|
||||
return NT_STATUS_OK;
|
||||
}
|
||||
|
||||
if (!NT_STATUS_IS_OK(status)) {
|
||||
DEBUG(4, ("add_sid_to_builtin %s could not be added to %s: "
|
||||
"%s\n", sid_string_dbg(dom_sid),
|
||||
sid_string_dbg(builtin_sid), nt_errstr(status)));
|
||||
}
|
||||
return status;
|
||||
}
|
||||
|
||||
/*******************************************************************
|
||||
*******************************************************************/
|
||||
|
||||
NTSTATUS create_builtin_users(const struct dom_sid *dom_sid)
|
||||
{
|
||||
NTSTATUS status;
|
||||
struct dom_sid dom_users;
|
||||
|
||||
status = create_builtin(BUILTIN_RID_USERS);
|
||||
if ( !NT_STATUS_IS_OK(status) ) {
|
||||
DEBUG(5,("create_builtin_users: Failed to create Users\n"));
|
||||
return status;
|
||||
}
|
||||
|
||||
/* add domain users */
|
||||
if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
|
||||
&& sid_compose(&dom_users, dom_sid, DOMAIN_RID_USERS))
|
||||
{
|
||||
status = add_sid_to_builtin(&global_sid_Builtin_Users,
|
||||
&dom_users);
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
/*******************************************************************
|
||||
*******************************************************************/
|
||||
|
||||
NTSTATUS create_builtin_administrators(const struct dom_sid *dom_sid)
|
||||
{
|
||||
NTSTATUS status;
|
||||
struct dom_sid dom_admins, root_sid;
|
||||
fstring root_name;
|
||||
enum lsa_SidType type;
|
||||
TALLOC_CTX *ctx;
|
||||
bool ret;
|
||||
|
||||
status = create_builtin(BUILTIN_RID_ADMINISTRATORS);
|
||||
if ( !NT_STATUS_IS_OK(status) ) {
|
||||
DEBUG(5,("create_builtin_administrators: Failed to create Administrators\n"));
|
||||
return status;
|
||||
}
|
||||
|
||||
/* add domain admins */
|
||||
if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
|
||||
&& sid_compose(&dom_admins, dom_sid, DOMAIN_RID_ADMINS))
|
||||
{
|
||||
status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
|
||||
&dom_admins);
|
||||
if (!NT_STATUS_IS_OK(status)) {
|
||||
return status;
|
||||
}
|
||||
}
|
||||
|
||||
/* add root */
|
||||
if ( (ctx = talloc_init("create_builtin_administrators")) == NULL ) {
|
||||
return NT_STATUS_NO_MEMORY;
|
||||
}
|
||||
fstr_sprintf( root_name, "%s\\root", get_global_sam_name() );
|
||||
ret = lookup_name(ctx, root_name, LOOKUP_NAME_DOMAIN, NULL, NULL,
|
||||
&root_sid, &type);
|
||||
TALLOC_FREE( ctx );
|
||||
|
||||
if ( ret ) {
|
||||
status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
|
||||
&root_sid);
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
static NTSTATUS finalize_local_nt_token(struct security_token *result,
|
||||
bool is_guest);
|
||||
|
||||
|
||||
@ -250,8 +250,6 @@ bool nt_token_check_domain_rid( struct security_token *token, uint32 rid );
|
||||
struct security_token *get_root_nt_token( void );
|
||||
NTSTATUS add_aliases(const struct dom_sid *domain_sid,
|
||||
struct security_token *token);
|
||||
NTSTATUS create_builtin_users(const struct dom_sid *sid);
|
||||
NTSTATUS create_builtin_administrators(const struct dom_sid *sid);
|
||||
struct security_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
|
||||
const struct dom_sid *user_sid,
|
||||
bool is_guest,
|
||||
@ -3621,6 +3619,11 @@ NTSTATUS pdb_wbc_sam_init(void);
|
||||
|
||||
NTSTATUS pdb_tdbsam_init(void);
|
||||
|
||||
/* The following definitions come from passdb/pdb_util.c */
|
||||
|
||||
NTSTATUS create_builtin_users(const struct dom_sid *sid);
|
||||
NTSTATUS create_builtin_administrators(const struct dom_sid *sid);
|
||||
|
||||
/* The following definitions come from passdb/util_builtin.c */
|
||||
|
||||
bool lookup_builtin_rid(TALLOC_CTX *mem_ctx, uint32 rid, const char **name);
|
||||
|
||||
158
source3/passdb/pdb_util.c
Normal file
158
source3/passdb/pdb_util.c
Normal file
@ -0,0 +1,158 @@
|
||||
/*
|
||||
* Unix SMB/CIFS implementation.
|
||||
* Authentication utility functions
|
||||
* Copyright (C) Andrew Tridgell 1992-1998
|
||||
* Copyright (C) Andrew Bartlett 2001
|
||||
* Copyright (C) Jeremy Allison 2000-2001
|
||||
* Copyright (C) Rafal Szczesniak 2002
|
||||
* Copyright (C) Volker Lendecke 2006
|
||||
* Copyright (C) Michael Adam 2007
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#include "includes.h"
|
||||
#include "../libcli/security/security.h"
|
||||
#include "passdb.h"
|
||||
#include "lib/winbind_util.h"
|
||||
|
||||
/**
|
||||
* Add sid as a member of builtin_sid.
|
||||
*
|
||||
* @param[in] builtin_sid An existing builtin group.
|
||||
* @param[in] dom_sid sid to add as a member of builtin_sid.
|
||||
* @return Normal NTSTATUS return
|
||||
*/
|
||||
static NTSTATUS add_sid_to_builtin(const struct dom_sid *builtin_sid,
|
||||
const struct dom_sid *dom_sid)
|
||||
{
|
||||
NTSTATUS status = NT_STATUS_OK;
|
||||
|
||||
if (!dom_sid || !builtin_sid) {
|
||||
return NT_STATUS_INVALID_PARAMETER;
|
||||
}
|
||||
|
||||
status = pdb_add_aliasmem(builtin_sid, dom_sid);
|
||||
|
||||
if (NT_STATUS_EQUAL(status, NT_STATUS_MEMBER_IN_ALIAS)) {
|
||||
DEBUG(5, ("add_sid_to_builtin %s is already a member of %s\n",
|
||||
sid_string_dbg(dom_sid),
|
||||
sid_string_dbg(builtin_sid)));
|
||||
return NT_STATUS_OK;
|
||||
}
|
||||
|
||||
if (!NT_STATUS_IS_OK(status)) {
|
||||
DEBUG(4, ("add_sid_to_builtin %s could not be added to %s: "
|
||||
"%s\n", sid_string_dbg(dom_sid),
|
||||
sid_string_dbg(builtin_sid), nt_errstr(status)));
|
||||
}
|
||||
return status;
|
||||
}
|
||||
|
||||
/**
|
||||
* Create the requested BUILTIN if it doesn't already exist. This requires
|
||||
* winbindd to be running.
|
||||
*
|
||||
* @param[in] rid BUILTIN rid to create
|
||||
* @return Normal NTSTATUS return.
|
||||
*/
|
||||
static NTSTATUS create_builtin(uint32 rid)
|
||||
{
|
||||
NTSTATUS status = NT_STATUS_OK;
|
||||
struct dom_sid sid;
|
||||
gid_t gid;
|
||||
|
||||
if (!sid_compose(&sid, &global_sid_Builtin, rid)) {
|
||||
return NT_STATUS_NO_SUCH_ALIAS;
|
||||
}
|
||||
|
||||
if (!sid_to_gid(&sid, &gid)) {
|
||||
if (!lp_winbind_nested_groups() || !winbind_ping()) {
|
||||
return NT_STATUS_PROTOCOL_UNREACHABLE;
|
||||
}
|
||||
status = pdb_create_builtin_alias(rid);
|
||||
}
|
||||
return status;
|
||||
}
|
||||
|
||||
/*******************************************************************
|
||||
*******************************************************************/
|
||||
|
||||
NTSTATUS create_builtin_users(const struct dom_sid *dom_sid)
|
||||
{
|
||||
NTSTATUS status;
|
||||
struct dom_sid dom_users;
|
||||
|
||||
status = create_builtin(BUILTIN_RID_USERS);
|
||||
if ( !NT_STATUS_IS_OK(status) ) {
|
||||
DEBUG(5,("create_builtin_users: Failed to create Users\n"));
|
||||
return status;
|
||||
}
|
||||
|
||||
/* add domain users */
|
||||
if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
|
||||
&& sid_compose(&dom_users, dom_sid, DOMAIN_RID_USERS))
|
||||
{
|
||||
status = add_sid_to_builtin(&global_sid_Builtin_Users,
|
||||
&dom_users);
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
/*******************************************************************
|
||||
*******************************************************************/
|
||||
|
||||
NTSTATUS create_builtin_administrators(const struct dom_sid *dom_sid)
|
||||
{
|
||||
NTSTATUS status;
|
||||
struct dom_sid dom_admins, root_sid;
|
||||
fstring root_name;
|
||||
enum lsa_SidType type;
|
||||
TALLOC_CTX *ctx;
|
||||
bool ret;
|
||||
|
||||
status = create_builtin(BUILTIN_RID_ADMINISTRATORS);
|
||||
if ( !NT_STATUS_IS_OK(status) ) {
|
||||
DEBUG(5,("create_builtin_administrators: Failed to create Administrators\n"));
|
||||
return status;
|
||||
}
|
||||
|
||||
/* add domain admins */
|
||||
if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
|
||||
&& sid_compose(&dom_admins, dom_sid, DOMAIN_RID_ADMINS))
|
||||
{
|
||||
status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
|
||||
&dom_admins);
|
||||
if (!NT_STATUS_IS_OK(status)) {
|
||||
return status;
|
||||
}
|
||||
}
|
||||
|
||||
/* add root */
|
||||
if ( (ctx = talloc_init("create_builtin_administrators")) == NULL ) {
|
||||
return NT_STATUS_NO_MEMORY;
|
||||
}
|
||||
fstr_sprintf( root_name, "%s\\root", get_global_sam_name() );
|
||||
ret = lookup_name(ctx, root_name, LOOKUP_NAME_DOMAIN, NULL, NULL,
|
||||
&root_sid, &type);
|
||||
TALLOC_FREE( ctx );
|
||||
|
||||
if ( ret ) {
|
||||
status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
|
||||
&root_sid);
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
@ -231,7 +231,8 @@ PASSDB_SRC = '''${PASSDB_GET_SET_SRC} passdb/passdb.c
|
||||
passdb/util_unixsids.c passdb/lookup_sid.c
|
||||
passdb/login_cache.c
|
||||
passdb/account_pol.c ${PRIVILEGES_SRC}
|
||||
lib/util_nscd.c lib/winbind_util.c ${SERVER_MUTEX_SRC}'''
|
||||
lib/util_nscd.c lib/winbind_util.c ${SERVER_MUTEX_SRC}
|
||||
passdb/pdb_util.c'''
|
||||
#FIXME: lib/winbind_util.c probably is not part of PASSDB_SRC
|
||||
|
||||
GROUPDB_SRC = '''groupdb/mapping.c groupdb/mapping_tdb.c'''
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user