mirror of
https://github.com/samba-team/samba.git
synced 2025-02-02 09:47:23 +03:00
Merging smbgroupedit into 'net groupmap'. Not entirely done.
Need to check on where the privilege code is sitting and update the docs. Examples: root# bin/net help groupmap net groupmap add Create a new group mapping net groupmap modify Update a group mapping net groupmap delete Remove a group mapping net groupmap list List current group map # bin/net groupmap add Usage: net groupmap add rid=<int> name=<string> type=<domain|local|builtin> [comment=<string>] # bin/net groupmap delete Usage: net groupmap delete name=<string|SID> # bin/net groupmap modify Usage: net groupmap modify name=<string|SID> [comment=<string>] [type=<domain|local> (This used to be commit f2fd0ab41ffbc0355db95529b6bda1b21aa4860a)
This commit is contained in:
Gerald Carter
parent
a53c63f99e
commit
a1fb9f2176
@ -126,7 +126,7 @@ BIN_PROGS1 = bin/smbclient@EXEEXT@ bin/net@EXEEXT@ bin/smbspool@EXEEXT@ \
|
||||
BIN_PROGS2 = bin/smbcontrol@EXEEXT@ bin/smbtree@EXEEXT@ bin/tdbbackup@EXEEXT@ \
|
||||
bin/nmblookup@EXEEXT@ bin/pdbedit@EXEEXT@
|
||||
BIN_PROGS3 = bin/smbpasswd@EXEEXT@ bin/rpcclient@EXEEXT@ bin/smbcacls@EXEEXT@ \
|
||||
bin/profiles@EXEEXT@ bin/smbgroupedit@EXEEXT@ bin/ntlm_auth@EXEEXT@ \
|
||||
bin/profiles@EXEEXT@ bin/ntlm_auth@EXEEXT@ \
|
||||
bin/smbcquotas@EXEEXT@
|
||||
|
||||
TORTURE_PROGS = bin/smbtorture@EXEEXT@ bin/msgtest@EXEEXT@ \
|
||||
@ -466,7 +466,7 @@ CLIENT_OBJ = $(CLIENT_OBJ1) $(PARAM_OBJ) $(LIBSMB_OBJ) $(UBIQX_OBJ) \
|
||||
NET_OBJ1 = utils/net.o utils/net_ads.o utils/net_ads_cldap.o utils/net_help.o \
|
||||
utils/net_rap.o utils/net_rpc.o utils/net_rpc_samsync.o \
|
||||
utils/net_rpc_join.o utils/net_time.o utils/net_lookup.o \
|
||||
utils/net_cache.o
|
||||
utils/net_cache.o utils/net_groupmap.o
|
||||
|
||||
NET_OBJ = $(NET_OBJ1) $(PARAM_OBJ) $(SECRETS_OBJ) $(LIBSMB_OBJ) \
|
||||
$(RPC_PARSE_OBJ) $(PASSDB_OBJ) $(GROUPDB_OBJ) \
|
||||
|
||||
@ -327,6 +327,26 @@ static int net_file(int argc, const char **argv)
|
||||
return net_rap_file(argc, argv);
|
||||
}
|
||||
|
||||
/***********************************************************
|
||||
migrated functionality from smbgroupedit
|
||||
**********************************************************/
|
||||
static int net_groupmap(int argc, const char **argv)
|
||||
{
|
||||
if ( 0 == argc )
|
||||
return net_help_groupmap( argc, argv );
|
||||
|
||||
if ( !StrCaseCmp( argv[0], "add" ) )
|
||||
return net_groupmap_add(argc-1, argv+1);
|
||||
else if ( !StrCaseCmp( argv[0], "modify" ) )
|
||||
return net_groupmap_modify(argc-1, argv+1);
|
||||
else if ( !StrCaseCmp( argv[0], "delete" ) )
|
||||
return net_groupmap_delete(argc-1, argv+1);
|
||||
else if ( !StrCaseCmp( argv[0], "list" ) )
|
||||
return net_groupmap_list(argc-1, argv+1);
|
||||
|
||||
return net_help_groupmap( argc, argv );
|
||||
}
|
||||
|
||||
/*
|
||||
Retrieve our local SID or the SID for the specified name
|
||||
*/
|
||||
@ -488,6 +508,7 @@ static struct functable net_func[] = {
|
||||
{"PRINTQ", net_rap_printq},
|
||||
{"USER", net_user},
|
||||
{"GROUP", net_group},
|
||||
{"GROUPMAP", net_groupmap},
|
||||
{"VALIDATE", net_rap_validate},
|
||||
{"GROUPMEMBER", net_rap_groupmember},
|
||||
{"ADMIN", net_rap_admin},
|
||||
|
||||
419
source3/utils/net_groupmap.c
Normal file
419
source3/utils/net_groupmap.c
Normal file
@ -0,0 +1,419 @@
|
||||
/*
|
||||
* Unix SMB/CIFS implementation.
|
||||
* RPC Pipe client / server routines
|
||||
* Copyright (C) Andrew Tridgell 1992-2000,
|
||||
* Copyright (C) Jean François Micouleau 1998-2001.
|
||||
* Copyright (C) Gerald Carter 2003.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
|
||||
*/
|
||||
|
||||
|
||||
#include "includes.h"
|
||||
#include "../utils/net.h"
|
||||
|
||||
|
||||
/*********************************************************
|
||||
utility function to parse an integer parameter from
|
||||
"parameter = value"
|
||||
**********************************************************/
|
||||
static uint32 get_int_param( const char* param )
|
||||
{
|
||||
char *p;
|
||||
|
||||
p = strchr( param, '=' );
|
||||
if ( !p )
|
||||
return 0;
|
||||
|
||||
return atoi(p+1);
|
||||
}
|
||||
|
||||
/*********************************************************
|
||||
utility function to parse an integer parameter from
|
||||
"parameter = value"
|
||||
**********************************************************/
|
||||
static char* get_string_param( const char* param )
|
||||
{
|
||||
char *p;
|
||||
|
||||
p = strchr( param, '=' );
|
||||
if ( !p )
|
||||
return NULL;
|
||||
|
||||
return (p+1);
|
||||
}
|
||||
|
||||
/*********************************************************
|
||||
Figure out if the input was an NT group or a SID string.
|
||||
Return the SID.
|
||||
**********************************************************/
|
||||
static BOOL get_sid_from_input(DOM_SID *sid, char *input)
|
||||
{
|
||||
GROUP_MAP map;
|
||||
|
||||
if (StrnCaseCmp( input, "S-", 2)) {
|
||||
/* Perhaps its the NT group name? */
|
||||
if (!pdb_getgrnam(&map, input, MAPPING_WITHOUT_PRIV)) {
|
||||
printf("NT Group %s doesn't exist in mapping DB\n", input);
|
||||
return False;
|
||||
} else {
|
||||
*sid = map.sid;
|
||||
}
|
||||
} else {
|
||||
if (!string_to_sid(sid, input)) {
|
||||
printf("converting sid %s from a string failed!\n", input);
|
||||
return False;
|
||||
}
|
||||
}
|
||||
return True;
|
||||
}
|
||||
|
||||
/*********************************************************
|
||||
Dump a GROUP_MAP entry to stdout (long or short listing)
|
||||
**********************************************************/
|
||||
|
||||
static void print_map_entry ( GROUP_MAP map, BOOL long_list )
|
||||
{
|
||||
fstring string_sid;
|
||||
fstring group_type;
|
||||
fstring priv_text;
|
||||
|
||||
decode_sid_name_use(group_type, map.sid_name_use);
|
||||
sid_to_string(string_sid, &map.sid);
|
||||
convert_priv_to_text(&(map.priv_set), priv_text);
|
||||
|
||||
if (!long_list)
|
||||
d_printf("%s (%s) -> %s\n", map.nt_name, string_sid, gidtoname(map.gid));
|
||||
else {
|
||||
d_printf("%s\n", map.nt_name);
|
||||
d_printf("\tSID : %s\n", string_sid);
|
||||
d_printf("\tUnix group: %s\n", gidtoname(map.gid));
|
||||
d_printf("\tGroup type: %s\n", group_type);
|
||||
d_printf("\tComment : %s\n", map.comment);
|
||||
d_printf("\tPrivilege : %s\n\n", priv_text);
|
||||
}
|
||||
|
||||
}
|
||||
/*********************************************************
|
||||
List the groups.
|
||||
**********************************************************/
|
||||
int net_groupmap_list(int argc, const char **argv)
|
||||
{
|
||||
int entries;
|
||||
BOOL long_list = False;
|
||||
int i;
|
||||
fstring ntgroup = "";
|
||||
|
||||
/* get the options */
|
||||
for ( i=0; i<argc; i++ ) {
|
||||
if ( !StrCaseCmp(argv[i], "verbose")) {
|
||||
long_list = True;
|
||||
}
|
||||
else if ( !StrnCaseCmp(argv[i], "name", strlen("name")) ) {
|
||||
fstrcpy( ntgroup, get_string_param( argv[i] ) );
|
||||
if ( !ntgroup[0] ) {
|
||||
d_printf("must supply a name\n");
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
else {
|
||||
d_printf("Bad option: %s\n", argv[i]);
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
/* list a single group is given a name */
|
||||
if ( ntgroup[0] ) {
|
||||
DOM_SID sid;
|
||||
GROUP_MAP map;
|
||||
|
||||
if (!get_sid_from_input(&sid, ntgroup)) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* Get the current mapping from the database */
|
||||
if(!pdb_getgrsid(&map, sid, MAPPING_WITH_PRIV)) {
|
||||
d_printf("Failure to local group SID in the database\n");
|
||||
return -1;
|
||||
}
|
||||
|
||||
print_map_entry( map, long_list );
|
||||
free_privilege(&(map.priv_set));
|
||||
}
|
||||
else {
|
||||
GROUP_MAP *map=NULL;
|
||||
/* enumerate all group mappings */
|
||||
if ( !pdb_enum_group_mapping(SID_NAME_UNKNOWN, &map, &entries, ENUM_ALL_MAPPED, MAPPING_WITH_PRIV) )
|
||||
return -1;
|
||||
|
||||
for (i=0; i<entries; i++) {
|
||||
print_map_entry( map[i], long_list );
|
||||
free_privilege(&(map[i].priv_set));
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*********************************************************
|
||||
Add a new group mapping entry
|
||||
**********************************************************/
|
||||
|
||||
int net_groupmap_add(int argc, const char **argv)
|
||||
{
|
||||
PRIVILEGE_SET se_priv;
|
||||
DOM_SID sid;
|
||||
fstring ntgroup = "";
|
||||
fstring string_sid = "";
|
||||
fstring type = "";
|
||||
fstring ntcomment = "";
|
||||
enum SID_NAME_USE sid_type = SID_NAME_UNKNOWN;
|
||||
uint32 rid = 0;
|
||||
gid_t gid;
|
||||
int i;
|
||||
|
||||
/* get the options */
|
||||
for ( i=0; i<argc; i++ ) {
|
||||
if ( !StrnCaseCmp(argv[i], "rid", strlen("rid")) ) {
|
||||
rid = get_int_param(argv[i]);
|
||||
if ( rid < DOMAIN_GROUP_RID_ADMINS ) {
|
||||
d_printf("RID must be greater than %d\n", (uint32)DOMAIN_GROUP_RID_ADMINS-1);
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
else if ( !StrnCaseCmp(argv[i], "name", strlen("name")) ) {
|
||||
fstrcpy( ntgroup, get_string_param( argv[i] ) );
|
||||
if ( !ntgroup[0] ) {
|
||||
d_printf("must supply a name\n");
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
else if ( !StrnCaseCmp(argv[i], "comment", strlen("comment")) ) {
|
||||
fstrcpy( ntcomment, get_string_param( argv[i] ) );
|
||||
if ( !ntcomment[0] ) {
|
||||
d_printf("must supply a comment string\n");
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
else if ( !StrnCaseCmp(argv[i], "type", strlen("type")) ) {
|
||||
fstrcpy( type, get_string_param( argv[i] ) );
|
||||
switch ( type[0] ) {
|
||||
case 'b':
|
||||
case 'B':
|
||||
sid_type = SID_NAME_WKN_GRP;
|
||||
break;
|
||||
case 'd':
|
||||
case 'D':
|
||||
sid_type = SID_NAME_DOM_GRP;
|
||||
break;
|
||||
case 'l':
|
||||
case 'L':
|
||||
sid_type = SID_NAME_ALIAS;
|
||||
break;
|
||||
}
|
||||
}
|
||||
else {
|
||||
d_printf("Bad option: %s\n", argv[i]);
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
if ( !ntgroup[0] || !rid || sid_type==SID_NAME_UNKNOWN ) {
|
||||
d_printf("Usage: net groupmap add rid=<int> name=<string> type=<domain|local|builtin> [comment=<string>]\n");
|
||||
return -1;
|
||||
}
|
||||
|
||||
sid_copy(&sid, get_global_sam_sid());
|
||||
sid_append_rid(&sid, rid);
|
||||
sid_to_string(string_sid, &sid);
|
||||
|
||||
if (ntcomment[0])
|
||||
fstrcpy(ntcomment, "Local Unix group");
|
||||
|
||||
if ( !(gid = nametogid(ntgroup)) ) {
|
||||
d_printf("Can't lookup UNIX group %s\n", ntgroup);
|
||||
return -1;
|
||||
}
|
||||
|
||||
init_privilege(&se_priv);
|
||||
#if 0
|
||||
if (privilege!=NULL)
|
||||
convert_priv_from_text(&se_priv, privilege);
|
||||
#endif
|
||||
|
||||
if (!add_initial_entry(gid, string_sid, sid_type, ntgroup,
|
||||
ntcomment, se_priv, PR_ACCESS_FROM_NETWORK) ) {
|
||||
d_printf("adding entry for group %s failed!\n", ntgroup);
|
||||
return -1;
|
||||
}
|
||||
|
||||
free_privilege(&se_priv);
|
||||
|
||||
d_printf("Successully added group %s to the mapping db\n", ntgroup);
|
||||
return 0;
|
||||
}
|
||||
|
||||
int net_groupmap_modify(int argc, const char **argv)
|
||||
{
|
||||
DOM_SID sid;
|
||||
GROUP_MAP map;
|
||||
fstring ntcomment = "";
|
||||
fstring type = "";
|
||||
fstring ntgroup = "";
|
||||
enum SID_NAME_USE sid_type = SID_NAME_UNKNOWN;
|
||||
int i;
|
||||
|
||||
/* get the options */
|
||||
for ( i=0; i<argc; i++ ) {
|
||||
if ( !StrnCaseCmp(argv[i], "name", strlen("name")) ) {
|
||||
fstrcpy( ntgroup, get_string_param( argv[i] ) );
|
||||
if ( !ntgroup[0] ) {
|
||||
d_printf("must supply a name\n");
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
else if ( !StrnCaseCmp(argv[i], "comment", strlen("comment")) ) {
|
||||
fstrcpy( ntcomment, get_string_param( argv[i] ) );
|
||||
if ( !ntcomment[0] ) {
|
||||
d_printf("must supply a comment string\n");
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
else if ( !StrnCaseCmp(argv[i], "type", strlen("type")) ) {
|
||||
fstrcpy( type, get_string_param( argv[i] ) );
|
||||
switch ( type[0] ) {
|
||||
case 'd':
|
||||
case 'D':
|
||||
sid_type = SID_NAME_DOM_GRP;
|
||||
break;
|
||||
case 'l':
|
||||
case 'L':
|
||||
sid_type = SID_NAME_ALIAS;
|
||||
break;
|
||||
}
|
||||
}
|
||||
else {
|
||||
d_printf("Bad option: %s\n", argv[i]);
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
if ( !ntgroup[0] ) {
|
||||
d_printf("Usage: net groupmap modify name=<string|SID> [comment=<string>] [type=<domain|local>\n");
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (!get_sid_from_input(&sid, ntgroup)) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* Get the current mapping from the database */
|
||||
if(!pdb_getgrsid(&map, sid, MAPPING_WITH_PRIV)) {
|
||||
d_printf("Failure to local group SID in the database\n");
|
||||
return -1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Allow changing of group type only between domain and local
|
||||
* We disallow changing Builtin groups !!! (SID problem)
|
||||
*/
|
||||
if (sid_type==SID_NAME_ALIAS
|
||||
|| sid_type==SID_NAME_DOM_GRP
|
||||
|| sid_type==SID_NAME_UNKNOWN)
|
||||
{
|
||||
if (map.sid_name_use==SID_NAME_ALIAS
|
||||
|| map.sid_name_use==SID_NAME_DOM_GRP
|
||||
|| map.sid_name_use==SID_NAME_UNKNOWN)
|
||||
{
|
||||
map.sid_name_use=sid_type;
|
||||
} else {
|
||||
printf("cannot change group type to builtin\n");
|
||||
};
|
||||
} else {
|
||||
printf("cannot change group type from builtin\n");
|
||||
}
|
||||
|
||||
/* Change comment if new one */
|
||||
if ( ntcomment[0] )
|
||||
fstrcpy( map.comment, ntcomment );
|
||||
|
||||
#if 0
|
||||
/* Change the privilege if new one */
|
||||
if (privilege!=NULL)
|
||||
convert_priv_from_text(&map.priv_set, privilege);
|
||||
#endif
|
||||
|
||||
if ( !pdb_update_group_mapping_entry(&map) ) {
|
||||
d_printf("Could not update group database\n");
|
||||
free_privilege(&map.priv_set);
|
||||
return -1;
|
||||
}
|
||||
|
||||
free_privilege(&map.priv_set);
|
||||
|
||||
d_printf("Updated mapping entry for %s\n", ntgroup);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int net_groupmap_delete(int argc, const char **argv)
|
||||
{
|
||||
DOM_SID sid;
|
||||
fstring ntgroup = "";
|
||||
int i;
|
||||
|
||||
/* get the options */
|
||||
for ( i=0; i<argc; i++ ) {
|
||||
if ( !StrnCaseCmp(argv[i], "name", strlen("name")) ) {
|
||||
fstrcpy( ntgroup, get_string_param( argv[i] ) );
|
||||
if ( !ntgroup[0] ) {
|
||||
d_printf("must supply a name\n");
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
else {
|
||||
d_printf("Bad option: %s\n", argv[i]);
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
if ( !ntgroup[0] ) {
|
||||
d_printf("Usage: net groupmap delete name=<string|SID>\n");
|
||||
return -1;
|
||||
}
|
||||
|
||||
if ( !get_sid_from_input(&sid, ntgroup) ) {
|
||||
d_printf("Unable to resolve group %s to a SID\n", ntgroup);
|
||||
return -1;
|
||||
}
|
||||
|
||||
if ( !pdb_delete_group_mapping_entry(sid) ) {
|
||||
printf("Failed to removing group %s from the mapping db!\n", ntgroup);
|
||||
return -1;
|
||||
}
|
||||
|
||||
d_printf("Sucessfully removed %s from the mapping db\n", ntgroup);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
#if 0
|
||||
/*********************************************************
|
||||
Change a group.
|
||||
**********************************************************/
|
||||
static int changegroup(char *sid_string, char *group, enum SID_NAME_USE sid_type, char *ntgroup, char *groupdesc, char *privilege)
|
||||
{
|
||||
}
|
||||
#endif
|
||||
@ -99,6 +99,25 @@ int net_help_group(int argc, const char **argv)
|
||||
return -1;
|
||||
}
|
||||
|
||||
int net_help_groupmap(int argc, const char **argv)
|
||||
{
|
||||
if (getuid() != 0) {
|
||||
d_printf("You must be root to edit group mappings.\nExiting...\n");
|
||||
return -1;
|
||||
}
|
||||
|
||||
d_printf("net groupmap add"\
|
||||
"\n Create a new group mapping\n");
|
||||
d_printf("net groupmap modify"\
|
||||
"\n Update a group mapping\n");
|
||||
d_printf("net groupmap delete"\
|
||||
"\n Remove a group mapping\n");
|
||||
d_printf("net groupmap list"\
|
||||
"\n List current group map\n");
|
||||
|
||||
return -1;
|
||||
}
|
||||
|
||||
|
||||
int net_help_join(int argc, const char **argv)
|
||||
{
|
||||
@ -152,6 +171,7 @@ static int net_usage(int argc, const char **argv)
|
||||
" net lookup\t\tto lookup host name or ip address\n"\
|
||||
" net user\t\tto manage users\n"\
|
||||
" net group\t\tto manage groups\n"\
|
||||
" net groupmap\t\tto manage group mappings\n"\
|
||||
" net join\t\tto join a domain\n"\
|
||||
" net cache\t\tto operate on cache tdb file\n"\
|
||||
" net getlocalsid [NAME]\tto get the SID for local name\n"\
|
||||
@ -184,6 +204,7 @@ int net_help(int argc, const char **argv)
|
||||
{"PRINTQ", net_rap_printq_usage},
|
||||
{"USER", net_help_user},
|
||||
{"GROUP", net_help_group},
|
||||
{"GROUPMAP", net_help_groupmap},
|
||||
{"JOIN", net_help_join},
|
||||
{"VALIDATE", net_rap_validate_usage},
|
||||
{"GROUPMEMBER", net_rap_groupmember_usage},
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user