sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Code

Changed how the privileges are stored in the group mapping code. It's now

Browse Source 
an array of uint32. That's not perfect but that's better.

Added more privileges too.

Changed the local_lookup_rid/name functions in passdb.c to check if the
group is mapped. Makes the LSA rpc calls return correct groups

Corrected the return code in the LSA server code enum_sids.

Only enumerate well known aliases if they are mapped to real unix groups.
Won't confuse user seeing groups not available.

Added a short/long view to smbgroupedit.

now decoding rpc calls to add/remove privileges to sid.

        J.F.
This commit is contained in:
Jean-François Micouleau 0001-01-01 00:00:00 +00:00
parent a58d0f91f9
commit f29774e589
8 changed files with 266 additions and 95 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

215
source/groupdb/mapping.c
View File

@ -30,11 +30,13 @@ static TDB_CONTEXT *tdb; /* used for driver files */
#define GROUP_PREFIX "UNIXGROUP/" #define GROUP_PREFIX "UNIXGROUP/"
PRIVS privs[] = { PRIVS privs[] = {
{SE_PRIV_NONE, "no_privs", "No privilege"}, {SE_PRIV_NONE, "no_privs", "No privilege" }, /* this one MUST be first */
{SE_PRIV_ADD_USERS, "add_users", "add users"}, {SE_PRIV_ADD_MACHINES, "SeMachineAccountPrivilege", "Add workstations to the domain" },
{SE_PRIV_ADD_MACHINES, "add_computers", "add computers to domain"}, {SE_PRIV_SEC_PRIV, "SeSecurityPrivilege", "Manage the audit logs" },
{SE_PRIV_PRINT_OPERATOR, "print_op", "printer operator"}, {SE_PRIV_TAKE_OWNER, "SeTakeOwnershipPrivilege", "Take ownership of file" },
{SE_PRIV_ALL, "all_privs", "all privileges"} {SE_PRIV_ADD_USERS, "SaAddUsers", "Add users to the domain - Samba" },
{SE_PRIV_PRINT_OPERATOR, "SaPrintOp", "Add or remove printers - Samba" },
{SE_PRIV_ALL, "SaAllPrivs", "all privileges" }
}; };
/* /*
PRIVS privs[] = { PRIVS privs[] = {
@ -61,6 +63,9 @@ PRIVS privs[] = {
{ 22, "SeSystemEnvironmentPrivilege" }, { 22, "SeSystemEnvironmentPrivilege" },
{ 23, "SeChangeNotifyPrivilege" }, { 23, "SeChangeNotifyPrivilege" },
{ 24, "SeRemoteShutdownPrivilege" }, { 24, "SeRemoteShutdownPrivilege" },
{ 25, "SeUndockPrivilege" },
{ 26, "SeSyncAgentPrivilege" },
{ 27, "SeEnableDelegationPrivilege" },
}; };
*/ */
@ -157,11 +162,15 @@ BOOL add_mapping_entry(GROUP_MAP *map, int flag)
pstring key, buf; pstring key, buf;
fstring string_sid=""; fstring string_sid="";
int len; int len;
int i;
sid_to_string(string_sid, &map->sid); sid_to_string(string_sid, &map->sid);
len = tdb_pack(buf, sizeof(buf), "ddffd", len = tdb_pack(buf, sizeof(buf), "ddff",
map->gid, map->sid_name_use, map->nt_name, map->comment, map->privilege); map->gid, map->sid_name_use, map->nt_name, map->comment);
for (i=0; i<PRIV_ALL_INDEX; i++)
len += tdb_pack(buf+len, sizeof(buf)-len, "d", map->privileges[i]);
if (len > sizeof(buf)) return False; if (len > sizeof(buf)) return False;
@ -180,22 +189,97 @@ BOOL add_mapping_entry(GROUP_MAP *map, int flag)
initialise first time the mapping list initialise first time the mapping list
****************************************************************************/ ****************************************************************************/
BOOL add_initial_entry(gid_t gid, fstring sid, enum SID_NAME_USE sid_name_use, BOOL add_initial_entry(gid_t gid, fstring sid, enum SID_NAME_USE sid_name_use,
fstring nt_name, fstring comment, uint32 privilege) fstring nt_name, fstring comment, uint32 *privilege)
{ {
GROUP_MAP map; GROUP_MAP map;
int i;
map.gid=gid; map.gid=gid;
string_to_sid(&map.sid, sid); string_to_sid(&map.sid, sid);
map.sid_name_use=sid_name_use; map.sid_name_use=sid_name_use;
fstrcpy(map.nt_name, nt_name); fstrcpy(map.nt_name, nt_name);
fstrcpy(map.comment, comment); fstrcpy(map.comment, comment);
map.privilege=privilege; for (i=0; i<PRIV_ALL_INDEX; i++)
map.privileges[i]=privilege[i];
add_mapping_entry(&map, TDB_INSERT); add_mapping_entry(&map, TDB_INSERT);
return True; return True;
} }
/****************************************************************************
initialise a privilege list
****************************************************************************/
void init_privilege(uint32 *privilege)
{
int i;
for (i=0; i<PRIV_ALL_INDEX; i++)
privilege[i]=0;
}
/****************************************************************************
add a privilege to a privilege array
****************************************************************************/
BOOL add_privilege(uint32 *privilege, uint32 priv)
{
int i;
while (i<PRIV_ALL_INDEX && privilege[i]!=0 && privilege[i]!=priv)
i++;
if (i==PRIV_ALL_INDEX) {
DEBUG(10,("add_privilege: the privilege array is full, can't add new priv\n"));
return False;
}
if (privilege[i]==priv) {
DEBUG(10,("add_privilege: privilege already in array\n"));
return False;
}
if (privilege[i]==0)
privilege[i]=priv;
return True;
}
/****************************************************************************
add all the privileges to a privilege array
****************************************************************************/
BOOL add_all_privilege(uint32 *privilege)
{
add_privilege(privilege, SE_PRIV_ADD_USERS);
add_privilege(privilege, SE_PRIV_ADD_MACHINES);
add_privilege(privilege, SE_PRIV_PRINT_OPERATOR);
}
/****************************************************************************
check if the privilege list is empty
****************************************************************************/
BOOL check_empty_privilege(uint32 *privilege)
{
int i;
for (i=0; i<PRIV_ALL_INDEX; i++)
if(privilege[i]!=0)
return False;
return True;
}
/****************************************************************************
check if the privilege is in the privilege list
****************************************************************************/
BOOL check_priv_in_privilege(uint32 *privilege, uint32 priv)
{
int i;
for (i=0; i<PRIV_ALL_INDEX; i++)
if(privilege[i]==priv)
return True;
return False;
}
/**************************************************************************** /****************************************************************************
initialise first time the mapping list initialise first time the mapping list
****************************************************************************/ ****************************************************************************/
@ -207,38 +291,50 @@ BOOL default_group_mapping(void)
fstring str_admins; fstring str_admins;
fstring str_users; fstring str_users;
fstring str_guests; fstring str_guests;
int i;
uint32 privilege_none[PRIV_ALL_INDEX];
uint32 privilege_all[PRIV_ALL_INDEX];
uint32 privilege_print_op[PRIV_ALL_INDEX];
init_privilege(privilege_none);
init_privilege(privilege_all);
init_privilege(privilege_print_op);
add_privilege(privilege_print_op, SE_PRIV_PRINT_OPERATOR);
add_all_privilege(privilege_all);
/* Add the Wellknown groups */ /* Add the Wellknown groups */
add_initial_entry(-1, "S-1-5-32-544", SID_NAME_WKN_GRP, "Administrators", "", SE_PRIV_ALL); add_initial_entry(-1, "S-1-5-32-544", SID_NAME_WKN_GRP, "Administrators", "", privilege_all);
add_initial_entry(-1, "S-1-5-32-545", SID_NAME_WKN_GRP, "Users", "", SE_PRIV_NONE); add_initial_entry(-1, "S-1-5-32-545", SID_NAME_WKN_GRP, "Users", "", privilege_none);
add_initial_entry(-1, "S-1-5-32-546", SID_NAME_WKN_GRP, "Guests", "", SE_PRIV_NONE); add_initial_entry(-1, "S-1-5-32-546", SID_NAME_WKN_GRP, "Guests", "", privilege_none);
add_initial_entry(-1, "S-1-5-32-547", SID_NAME_WKN_GRP, "Power Users", "", SE_PRIV_NONE); add_initial_entry(-1, "S-1-5-32-547", SID_NAME_WKN_GRP, "Power Users", "", privilege_none);
add_initial_entry(-1, "S-1-5-32-548", SID_NAME_WKN_GRP, "Account Operators", "", SE_PRIV_NONE); add_initial_entry(-1, "S-1-5-32-548", SID_NAME_WKN_GRP, "Account Operators", "", privilege_none);
add_initial_entry(-1, "S-1-5-32-549", SID_NAME_WKN_GRP, "System Operators", "", SE_PRIV_NONE); add_initial_entry(-1, "S-1-5-32-549", SID_NAME_WKN_GRP, "System Operators", "", privilege_none);
add_initial_entry(-1, "S-1-5-32-550", SID_NAME_WKN_GRP, "Print Operators", "", SE_PRIV_PRINT_OPERATOR); add_initial_entry(-1, "S-1-5-32-550", SID_NAME_WKN_GRP, "Print Operators", "", privilege_print_op);
add_initial_entry(-1, "S-1-5-32-551", SID_NAME_WKN_GRP, "Backup Operators", "", SE_PRIV_NONE); add_initial_entry(-1, "S-1-5-32-551", SID_NAME_WKN_GRP, "Backup Operators", "", privilege_none);
add_initial_entry(-1, "S-1-5-32-552", SID_NAME_WKN_GRP, "Replicators", "", SE_PRIV_NONE); add_initial_entry(-1, "S-1-5-32-552", SID_NAME_WKN_GRP, "Replicators", "", privilege_none);
/* Add the defaults domain groups */ /* Add the defaults domain groups */
sid_copy(&sid_admins, &global_sam_sid); sid_copy(&sid_admins, &global_sam_sid);
sid_append_rid(&sid_admins, DOMAIN_GROUP_RID_ADMINS); sid_append_rid(&sid_admins, DOMAIN_GROUP_RID_ADMINS);
sid_to_string(str_admins, &sid_admins); sid_to_string(str_admins, &sid_admins);
add_initial_entry(-1, str_admins, SID_NAME_DOM_GRP, "Domain Admins", "", SE_PRIV_ALL); add_initial_entry(-1, str_admins, SID_NAME_DOM_GRP, "Domain Admins", "", privilege_all);
sid_copy(&sid_users, &global_sam_sid); sid_copy(&sid_users, &global_sam_sid);
sid_append_rid(&sid_users, DOMAIN_GROUP_RID_USERS); sid_append_rid(&sid_users, DOMAIN_GROUP_RID_USERS);
sid_to_string(str_users, &sid_users); sid_to_string(str_users, &sid_users);
add_initial_entry(-1, str_users, SID_NAME_DOM_GRP, "Domain Users", "", SE_PRIV_NONE); add_initial_entry(-1, str_users, SID_NAME_DOM_GRP, "Domain Users", "", privilege_none);
sid_copy(&sid_guests, &global_sam_sid); sid_copy(&sid_guests, &global_sam_sid);
sid_append_rid(&sid_guests, DOMAIN_GROUP_RID_GUESTS); sid_append_rid(&sid_guests, DOMAIN_GROUP_RID_GUESTS);
sid_to_string(str_guests, &sid_guests); sid_to_string(str_guests, &sid_guests);
add_initial_entry(-1, str_guests, SID_NAME_DOM_GRP, "Domain Guests", "", SE_PRIV_NONE); add_initial_entry(-1, str_guests, SID_NAME_DOM_GRP, "Domain Guests", "", privilege_none);
return True; return True;
} }
@ -253,6 +349,7 @@ BOOL get_group_map_from_sid(DOM_SID sid, GROUP_MAP *map)
pstring key; pstring key;
fstring string_sid; fstring string_sid;
int ret; int ret;
int i;
/* the key is the SID, retrieving is direct */ /* the key is the SID, retrieving is direct */
@ -265,12 +362,15 @@ BOOL get_group_map_from_sid(DOM_SID sid, GROUP_MAP *map)
dbuf = tdb_fetch(tdb, kbuf); dbuf = tdb_fetch(tdb, kbuf);
if (!dbuf.dptr) return False; if (!dbuf.dptr) return False;
ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddffd", ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff",
&map->gid, &map->sid_name_use, &map->nt_name, &map->comment, &map->privilege); &map->gid, &map->sid_name_use, &map->nt_name, &map->comment);
for (i=0; i<PRIV_ALL_INDEX; i++)
ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "d", &map->privileges[i]);
SAFE_FREE(dbuf.dptr); SAFE_FREE(dbuf.dptr);
if (ret != dbuf.dsize) { if (ret != dbuf.dsize) {
DEBUG(0,("get_group_map_from_sid: mapping TDB corrupted ?\n")); DEBUG(0,("get_group_map_from_sid: group mapping TDB corrupted ?\n"));
return False; return False;
} }
@ -288,6 +388,7 @@ BOOL get_group_map_from_gid(gid_t gid, GROUP_MAP *map)
TDB_DATA kbuf, dbuf, newkey; TDB_DATA kbuf, dbuf, newkey;
fstring string_sid; fstring string_sid;
int ret; int ret;
int i;
/* we need to enumerate the TDB to find the GID */ /* we need to enumerate the TDB to find the GID */
@ -304,8 +405,11 @@ BOOL get_group_map_from_gid(gid_t gid, GROUP_MAP *map)
string_to_sid(&map->sid, string_sid); string_to_sid(&map->sid, string_sid);
ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddffd", ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff",
&map->gid, &map->sid_name_use, &map->nt_name, &map->comment, &map->privilege); &map->gid, &map->sid_name_use, &map->nt_name, &map->comment);
for (i=0; i<PRIV_ALL_INDEX; i++)
ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "d", &map->privileges[i]);
SAFE_FREE(dbuf.dptr); SAFE_FREE(dbuf.dptr);
if (ret != dbuf.dsize) continue; if (ret != dbuf.dsize) continue;
@ -325,8 +429,9 @@ BOOL get_group_map_from_ntname(char *name, GROUP_MAP *map)
TDB_DATA kbuf, dbuf, newkey; TDB_DATA kbuf, dbuf, newkey;
fstring string_sid; fstring string_sid;
int ret; int ret;
int i;
/* we need to enumerate the TDB to find the GID */ /* we need to enumerate the TDB to find the SID */
for (kbuf = tdb_firstkey(tdb); for (kbuf = tdb_firstkey(tdb);
kbuf.dptr; kbuf.dptr;
@ -341,8 +446,11 @@ BOOL get_group_map_from_ntname(char *name, GROUP_MAP *map)
string_to_sid(&map->sid, string_sid); string_to_sid(&map->sid, string_sid);
ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddffd", ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff",
&map->gid, &map->sid_name_use, &map->nt_name, &map->comment, &map->privilege); &map->gid, &map->sid_name_use, &map->nt_name, &map->comment);
for (i=0; i<PRIV_ALL_INDEX; i++)
ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "d", &map->privileges[i]);
SAFE_FREE(dbuf.dptr); SAFE_FREE(dbuf.dptr);
if (ret != dbuf.dsize) continue; if (ret != dbuf.dsize) continue;
@ -397,6 +505,7 @@ BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap,
GROUP_MAP *mapt; GROUP_MAP *mapt;
int ret; int ret;
int entries=0; int entries=0;
int i;
*num_entries=0; *num_entries=0;
*rmap=NULL; *rmap=NULL;
@ -414,8 +523,11 @@ BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap,
fstrcpy(string_sid, kbuf.dptr+strlen(GROUP_PREFIX)); fstrcpy(string_sid, kbuf.dptr+strlen(GROUP_PREFIX));
ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddffd", ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff",
&map.gid, &map.sid_name_use, &map.nt_name, &map.comment, &map.privilege); &map.gid, &map.sid_name_use, &map.nt_name, &map.comment);
for (i=0; i<PRIV_ALL_INDEX; i++)
ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "d", &map.privileges[i]);
SAFE_FREE(dbuf.dptr); SAFE_FREE(dbuf.dptr);
if (ret != dbuf.dsize) if (ret != dbuf.dsize)
@ -445,7 +557,8 @@ BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap,
mapt[entries].sid_name_use = map.sid_name_use; mapt[entries].sid_name_use = map.sid_name_use;
fstrcpy(mapt[entries].nt_name, map.nt_name); fstrcpy(mapt[entries].nt_name, map.nt_name);
fstrcpy(mapt[entries].comment, map.comment); fstrcpy(mapt[entries].comment, map.comment);
mapt[entries].privilege = map.privilege; for (i=0; i<PRIV_ALL_INDEX; i++)
mapt[entries].privileges[i] = map.privileges[i];
entries++; entries++;
} }
@ -456,7 +569,7 @@ BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap,
/**************************************************************************** /****************************************************************************
convert a privilege list to a privilege value convert a privilege string to a privilege array
****************************************************************************/ ****************************************************************************/
void convert_priv_from_text(uint32 *se_priv, char *privilege) void convert_priv_from_text(uint32 *se_priv, char *privilege)
{ {
@ -465,46 +578,44 @@ void convert_priv_from_text(uint32 *se_priv, char *privilege)
int i; int i;
/* By default no privilege */ /* By default no privilege */
(*se_priv)=0x0; init_privilege(se_priv);
if (privilege==NULL) if (privilege==NULL)
return; return;
while(next_token(&p, tok, " ", sizeof(tok)) ) { while(next_token(&p, tok, " ", sizeof(tok)) ) {
for (i=0; i<=PRIV_ALL_INDEX; i++) { for (i=0; i<=PRIV_ALL_INDEX; i++) {
if (StrCaseCmp(privs[i].priv, tok)==0) if (StrCaseCmp(privs[i].priv, tok)==0)
(*se_priv)+=privs[i].se_priv; add_privilege(se_priv, privs[i].se_priv);
} }
} }
} }
/**************************************************************************** /****************************************************************************
convert a privilege value to a privilege list convert a privilege array to a privilege string
****************************************************************************/ ****************************************************************************/
void convert_priv_to_text(uint32 se_priv, char *privilege) void convert_priv_to_text(uint32 *se_priv, char *privilege)
{ {
int i; int i=0,j;
if (privilege==NULL) if (privilege==NULL)
return; return;
ZERO_STRUCTP(privilege); ZERO_STRUCTP(privilege);
if (se_priv==SE_PRIV_NONE) { if (check_empty_privilege(se_priv)) {
fstrcat(privilege, privs[0].priv); fstrcat(privilege, "No privilege");
return; return;
} }
if (se_priv==SE_PRIV_ALL) { while(i<PRIV_ALL_INDEX && se_priv[i]!=0) {
fstrcat(privilege, privs[PRIV_ALL_INDEX].priv); j=1;
return; while (privs[j].se_priv!=se_priv[i])
} j++;
for (i=1; privs[i].se_priv!=SE_PRIV_ALL; i++) { fstrcat(privilege, privs[j].priv);
if ( (se_priv & privs[i].se_priv) == privs[i].se_priv) { fstrcat(privilege, " ");
fstrcat(privilege, privs[i].priv); i++;
fstrcat(privilege, " ");
}
} }
} }
@ -585,7 +696,7 @@ BOOL get_local_group_from_sid(DOM_SID sid, GROUP_MAP *map)
fstrcpy(map->nt_name, grp->gr_name); fstrcpy(map->nt_name, grp->gr_name);
fstrcpy(map->comment, "Local Unix Group"); fstrcpy(map->comment, "Local Unix Group");
map->privilege=SE_PRIV_NONE; init_privilege(map->privileges);
sid_copy(&map->sid, &sid); sid_copy(&map->sid, &sid);
} }
@ -632,7 +743,7 @@ BOOL get_group_from_gid(gid_t gid, GROUP_MAP *map)
if (!get_group_map_from_gid(gid, map)) { if (!get_group_map_from_gid(gid, map)) {
map->gid=gid; map->gid=gid;
map->sid_name_use=SID_NAME_ALIAS; map->sid_name_use=SID_NAME_ALIAS;
map->privilege=SE_PRIV_NONE; init_privilege(map->privileges);
sid_copy(&map->sid, &global_sam_sid); sid_copy(&map->sid, &global_sam_sid);
sid_append_rid(&map->sid, pdb_gid_to_group_rid(gid)); sid_append_rid(&map->sid, pdb_gid_to_group_rid(gid));

26
source/include/mapping.h
View File

@ -20,13 +20,26 @@
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/ */
#define PRIV_ALL_INDEX 5
#define SE_PRIV_NONE 0x0000
#define SE_PRIV_ADD_MACHINES 0x0006
#define SE_PRIV_SEC_PRIV 0x0008
#define SE_PRIV_TAKE_OWNER 0x0009
#define SE_PRIV_ADD_USERS 0xff01
#define SE_PRIV_PRINT_OPERATOR 0xff03
#define SE_PRIV_ALL 0xffff
#define ENUM_ONLY_MAPPED True
#define ENUM_ALL_MAPPED False
typedef struct _GROUP_MAP { typedef struct _GROUP_MAP {
gid_t gid; gid_t gid;
DOM_SID sid; DOM_SID sid;
enum SID_NAME_USE sid_name_use; enum SID_NAME_USE sid_name_use;
fstring nt_name; fstring nt_name;
fstring comment; fstring comment;
uint32 privilege; uint32 privileges[PRIV_ALL_INDEX];
} GROUP_MAP; } GROUP_MAP;
typedef struct _PRIVS { typedef struct _PRIVS {
@ -35,14 +48,3 @@ typedef struct _PRIVS {
char *description; char *description;
} PRIVS; } PRIVS;
#define SE_PRIV_NONE 0x0000
#define SE_PRIV_ADD_USERS 0x0001
#define SE_PRIV_ADD_MACHINES 0x0002
#define SE_PRIV_PRINT_OPERATOR 0x0004
#define SE_PRIV_ALL 0xffff
#define PRIV_ALL_INDEX 3
#define ENUM_ONLY_MAPPED True
#define ENUM_ALL_MAPPED False

2
source/libsmb/cli_lsarpc.c
View File

@ -787,6 +787,8 @@ NTSTATUS cli_lsa_enum_sids(struct cli_state *cli, TALLOC_CTX *mem_ctx,
goto done; goto done;
} }
if (r.sids.num_entries==0)
goto done;
/* Return output parameters */ /* Return output parameters */

39
source/passdb/passdb.c
View File

@ -75,7 +75,6 @@ static BOOL pdb_fill_default_sam(SAM_ACCOUNT *user)
user->logoff_time = user->logoff_time =
user->kickoff_time = user->kickoff_time =
user->pass_must_change_time = get_time_t_max(); user->pass_must_change_time = get_time_t_max();
user->unknown_3 = 0x00ffffff; /* don't know */ user->unknown_3 = 0x00ffffff; /* don't know */
user->logon_divs = 168; /* hours per week */ user->logon_divs = 168; /* hours per week */
user->hours_len = 21; /* 21 times 8 bits = 168 */ user->hours_len = 21; /* 21 times 8 bits = 168 */
@ -536,6 +535,11 @@ BOOL local_lookup_rid(uint32 rid, char *name, enum SID_NAME_USE *psid_name_use)
} else { } else {
gid_t gid; gid_t gid;
struct group *gr; struct group *gr;
GROUP_MAP map;
DOM_SID local_sid;
sid_copy(&local_sid, &global_sam_sid);
sid_append_rid(&local_sid, rid);
/* /*
* Don't try to convert the rid to a name if running * Don't try to convert the rid to a name if running
@ -544,6 +548,16 @@ BOOL local_lookup_rid(uint32 rid, char *name, enum SID_NAME_USE *psid_name_use)
if (lp_hide_local_users()) if (lp_hide_local_users())
return False; return False;
/* check if it's a mapped group */
if (get_group_map_from_sid(local_sid, &map)) {
if (map.gid!=-1) {
DEBUG(5,("local_local_rid: mapped group %s to gid %u\n", map.nt_name, (unsigned int)map.gid));
fstrcpy(name, map.nt_name);
*psid_name_use = map.sid_name_use;
return True;
}
}
gid = pdb_user_rid_to_gid(rid); gid = pdb_user_rid_to_gid(rid);
gr = getgrgid(gid); gr = getgrgid(gid);
@ -617,13 +631,24 @@ BOOL local_lookup_name(const char *c_domain, const char *c_user, DOM_SID *psid,
/* /*
* Maybe it was a group ? * Maybe it was a group ?
*/ */
struct group *grp = getgrnam(user); struct group *grp;
GROUP_MAP map;
/* check if it's a mapped group */
if (get_group_map_from_ntname(user, &map)) {
if (map.gid!=-1) {
/* yes it's a mapped group to a valid unix group */
sid_copy(&local_sid, &map.sid);
*psid_name_use = map.sid_name_use;
}
} else {
grp = getgrnam(user);
if(!grp)
return False;
if(!grp) sid_append_rid( &local_sid, pdb_gid_to_group_rid(grp->gr_gid));
return False; *psid_name_use = SID_NAME_ALIAS;
}
sid_append_rid( &local_sid, pdb_gid_to_group_rid(grp->gr_gid));
*psid_name_use = SID_NAME_ALIAS;
} }
sid_copy( psid, &local_sid); sid_copy( psid, &local_sid);

9
source/rpc_parse/parse_lsa.c
View File

@ -854,6 +854,15 @@ static BOOL lsa_io_sid_enum(char *desc, LSA_SID_ENUM *sen, prs_struct *ps,
return False; return False;
if(!prs_uint32("ptr_sid_enum", ps, depth, &sen->ptr_sid_enum)) if(!prs_uint32("ptr_sid_enum", ps, depth, &sen->ptr_sid_enum))
return False; return False;
/*
if the ptr is NULL, leave here. checked from a real w2k trace.
JFM, 11/23/2001
*/
if (sen->ptr_sid_enum==0)
return True;
if(!prs_uint32("num_entries2", ps, depth, &sen->num_entries2)) if(!prs_uint32("num_entries2", ps, depth, &sen->num_entries2))
return False; return False;

12
source/rpc_server/srv_lsa_nt.c
View File

@ -543,7 +543,7 @@ NTSTATUS _lsa_enum_privs(pipes_struct *p, LSA_Q_ENUM_PRIVS *q_u, LSA_R_ENUM_PRIV
return NT_STATUS_INVALID_HANDLE; return NT_STATUS_INVALID_HANDLE;
if (enum_context >= PRIV_ALL_INDEX) if (enum_context >= PRIV_ALL_INDEX)
return NT_STATUS_UNABLE_TO_FREE_VM; return NT_STATUS_NO_MORE_ENTRIES;
entries = (LSA_PRIV_ENTRY *)talloc_zero(p->mem_ctx, sizeof(LSA_PRIV_ENTRY) * (PRIV_ALL_INDEX)); entries = (LSA_PRIV_ENTRY *)talloc_zero(p->mem_ctx, sizeof(LSA_PRIV_ENTRY) * (PRIV_ALL_INDEX));
if (entries==NULL) if (entries==NULL)
@ -625,6 +625,9 @@ NTSTATUS _lsa_enum_accounts(pipes_struct *p, LSA_Q_ENUM_ACCOUNTS *q_u, LSA_R_ENU
if(!enum_group_mapping(SID_NAME_UNKNOWN, &map, &num_entries, ENUM_ONLY_MAPPED)) if(!enum_group_mapping(SID_NAME_UNKNOWN, &map, &num_entries, ENUM_ONLY_MAPPED))
return NT_STATUS_OK; return NT_STATUS_OK;
if (q_u->enum_context >= num_entries)
return NT_STATUS_NO_MORE_ENTRIES;
sids->ptr_sid = (uint32 *)talloc_zero(p->mem_ctx, (num_entries-q_u->enum_context)*sizeof(uint32)); sids->ptr_sid = (uint32 *)talloc_zero(p->mem_ctx, (num_entries-q_u->enum_context)*sizeof(uint32));
sids->sid = (DOM_SID2 *)talloc_zero(p->mem_ctx, (num_entries-q_u->enum_context)*sizeof(DOM_SID2)); sids->sid = (DOM_SID2 *)talloc_zero(p->mem_ctx, (num_entries-q_u->enum_context)*sizeof(DOM_SID2));
@ -707,7 +710,7 @@ NTSTATUS _lsa_open_account(pipes_struct *p, LSA_Q_OPENACCOUNT *q_u, LSA_R_OPENAC
} }
/*************************************************************************** /***************************************************************************
For a given SID, enumerate all the privilege this account has.
***************************************************************************/ ***************************************************************************/
NTSTATUS _lsa_enum_privsaccount(pipes_struct *p, LSA_Q_ENUMPRIVSACCOUNT *q_u, LSA_R_ENUMPRIVSACCOUNT *r_u) NTSTATUS _lsa_enum_privsaccount(pipes_struct *p, LSA_Q_ENUMPRIVSACCOUNT *q_u, LSA_R_ENUMPRIVSACCOUNT *r_u)
@ -729,7 +732,7 @@ NTSTATUS _lsa_enum_privsaccount(pipes_struct *p, LSA_Q_ENUMPRIVSACCOUNT *q_u, LS
return NT_STATUS_NO_SUCH_GROUP; return NT_STATUS_NO_SUCH_GROUP;
for (i=1; privs[i].se_priv!=SE_PRIV_ALL; i++) { for (i=1; privs[i].se_priv!=SE_PRIV_ALL; i++) {
if ( (map.privilege & privs[i].se_priv) == privs[i].se_priv) { if ( check_priv_in_privilege(map.privileges, privs[i].se_priv)) {
set=(LUID_ATTR *)talloc_realloc(p->mem_ctx, set, (count+1)*sizeof(LUID_ATTR)); set=(LUID_ATTR *)talloc_realloc(p->mem_ctx, set, (count+1)*sizeof(LUID_ATTR));
if (set == NULL) return NT_STATUS_NO_MEMORY; if (set == NULL) return NT_STATUS_NO_MEMORY;
@ -738,8 +741,7 @@ NTSTATUS _lsa_enum_privsaccount(pipes_struct *p, LSA_Q_ENUMPRIVSACCOUNT *q_u, LS
set[count].luid.high=1; set[count].luid.high=1;
set[count].attr=0; set[count].attr=0;
count++; count++;
} }
} }

2
source/rpc_server/srv_samr_nt.c
View File

@ -810,7 +810,7 @@ static NTSTATUS get_group_alias_entries(TALLOC_CTX *ctx, DOMAIN_GRP **d_grp, DOM
/* well-known aliases */ /* well-known aliases */
if (sid_equal(sid, &global_sid_Builtin) && !lp_hide_local_users()) { if (sid_equal(sid, &global_sid_Builtin) && !lp_hide_local_users()) {
enum_group_mapping(SID_NAME_WKN_GRP, &map, (int *)&num_entries, ENUM_ALL_MAPPED); enum_group_mapping(SID_NAME_WKN_GRP, &map, (int *)&num_entries, ENUM_ONLY_MAPPED);
if (num_entries != 0) { if (num_entries != 0) {
*d_grp=(DOMAIN_GRP *)talloc_zero(ctx, num_entries*sizeof(DOMAIN_GRP)); *d_grp=(DOMAIN_GRP *)talloc_zero(ctx, num_entries*sizeof(DOMAIN_GRP));

56
source/utils/smbgroupedit.c
View File

@ -38,7 +38,7 @@ extern int optind;
static void usage(void) static void usage(void)
{ {
if (getuid() == 0) { if (getuid() == 0) {
printf("groupedit options\n"); printf("smbgroupedit options\n");
} else { } else {
printf("You need to be root to use this tool!\n"); printf("You need to be root to use this tool!\n");
} }
@ -47,6 +47,8 @@ static void usage(void)
printf(" -n group NT group name\n"); printf(" -n group NT group name\n");
printf(" -p privilege only local\n"); printf(" -p privilege only local\n");
printf(" -v list groups\n"); printf(" -v list groups\n");
printf(" -l long list (include details)\n");
printf(" -s short list (default)\n");
printf(" -c SID change group\n"); printf(" -c SID change group\n");
printf(" -u unix group\n"); printf(" -u unix group\n");
printf(" -x group delete this group\n"); printf(" -x group delete this group\n");
@ -60,16 +62,12 @@ static void usage(void)
**********************************************************/ **********************************************************/
int addgroup(char *group, enum SID_NAME_USE sid_type, char *ntgroup, char *ntcomment, char *privilege) int addgroup(char *group, enum SID_NAME_USE sid_type, char *ntgroup, char *ntcomment, char *privilege)
{ {
uint32 se_priv; uint32 se_priv[PRIV_ALL_INDEX];
gid_t gid; gid_t gid;
DOM_SID sid; DOM_SID sid;
fstring string_sid; fstring string_sid;
fstring name, comment; fstring name, comment;
/* convert_priv_from_text(&se_priv, privilege);*/
se_priv=0x0;
gid=nametogid(group); gid=nametogid(group);
if (gid==-1) if (gid==-1)
return -1; return -1;
@ -87,6 +85,10 @@ int addgroup(char *group, enum SID_NAME_USE sid_type, char *ntgroup, char *ntcom
else else
fstrcpy(comment, ntcomment); fstrcpy(comment, ntcomment);
init_privilege(se_priv);
if (privilege!=NULL)
convert_priv_from_text(se_priv, privilege);
if(!add_initial_entry(gid, string_sid, sid_type, name, comment, se_priv)) if(!add_initial_entry(gid, string_sid, sid_type, name, comment, se_priv))
return -1; return -1;
@ -101,7 +103,7 @@ int changegroup(char *sid_string, char *group, enum SID_NAME_USE sid_type, char
DOM_SID sid; DOM_SID sid;
GROUP_MAP map; GROUP_MAP map;
gid_t gid; gid_t gid;
uint32 se_priv; uint32 se_priv[PRIV_ALL_INDEX];
string_to_sid(&sid, sid_string); string_to_sid(&sid, sid_string);
@ -139,8 +141,10 @@ int changegroup(char *sid_string, char *group, enum SID_NAME_USE sid_type, char
/* Change the privilege if new one */ /* Change the privilege if new one */
if (privilege!=NULL) { if (privilege!=NULL) {
convert_priv_from_text(&se_priv, privilege); int i;
map.privilege=se_priv; convert_priv_from_text(se_priv, privilege);
for(i=0; i<PRIV_ALL_INDEX; i++)
map.privileges[i]=se_priv[i];
} }
if (!add_mapping_entry(&map, TDB_REPLACE)) { if (!add_mapping_entry(&map, TDB_REPLACE)) {
@ -169,7 +173,7 @@ BOOL deletegroup(char *group)
/********************************************************* /*********************************************************
List the groups. List the groups.
**********************************************************/ **********************************************************/
int listgroup(enum SID_NAME_USE sid_type) int listgroup(enum SID_NAME_USE sid_type, BOOL long_list)
{ {
int entries,i; int entries,i;
GROUP_MAP *map=NULL; GROUP_MAP *map=NULL;
@ -177,7 +181,8 @@ int listgroup(enum SID_NAME_USE sid_type)
fstring group_type; fstring group_type;
fstring priv_text; fstring priv_text;
printf("Unix\tSID\ttype\tnt name\tnt comment\tprivilege\n"); if (!long_list)
printf("NT group (SID) -> Unix group\n");
if (!enum_group_mapping(sid_type, &map, &entries, ENUM_ALL_MAPPED)) if (!enum_group_mapping(sid_type, &map, &entries, ENUM_ALL_MAPPED))
return -1; return -1;
@ -185,10 +190,18 @@ int listgroup(enum SID_NAME_USE sid_type)
for (i=0; i<entries; i++) { for (i=0; i<entries; i++) {
decode_sid_name_use(group_type, (map[i]).sid_name_use); decode_sid_name_use(group_type, (map[i]).sid_name_use);
sid_to_string(string_sid, &map[i].sid); sid_to_string(string_sid, &map[i].sid);
convert_priv_to_text(map[i].privilege, priv_text); convert_priv_to_text(map[i].privileges, priv_text);
printf("%s\t%s\t%s\n\t%s\t%s\t%s\n\n", gidtoname(map[i].gid), map[i].nt_name, string_sid, if (!long_list)
group_type, map[i].comment, priv_text); printf("%s (%s) -> %s\n", map[i].nt_name, string_sid, gidtoname(map[i].gid));
else {
printf("%s\n", map[i].nt_name);
printf("\tSID : %s\n", string_sid);
printf("\tUnix group: %s\n", gidtoname(map[i].gid));
printf("\tGroup type: %s\n", group_type);
printf("\tComment : %s\n", map[i].comment);
printf("\tPrivilege : %s\n\n", priv_text);
}
} }
return 0; return 0;
@ -207,7 +220,8 @@ int main (int argc, char **argv)
BOOL nt_group = False; BOOL nt_group = False;
BOOL priv = False; BOOL priv = False;
BOOL group_type = False; BOOL group_type = False;
BOOL long_list = False;
char *group = NULL; char *group = NULL;
char *sid = NULL; char *sid = NULL;
char *ntgroup = NULL; char *ntgroup = NULL;
@ -235,7 +249,7 @@ int main (int argc, char **argv)
exit(1); exit(1);
} }
while ((ch = getopt(argc, argv, "a:c:d:n:p:t:u:vx:")) != EOF) { while ((ch = getopt(argc, argv, "a:c:d:ln:p:st:u:vx:")) != EOF) {
switch(ch) { switch(ch) {
case 'a': case 'a':
add_group = True; add_group = True;
@ -248,6 +262,9 @@ int main (int argc, char **argv)
case 'd': case 'd':
group_desc=optarg; group_desc=optarg;
break; break;
case 'l':
long_list = True;
break;
case 'n': case 'n':
nt_group = True; nt_group = True;
ntgroup=optarg; ntgroup=optarg;
@ -256,6 +273,9 @@ int main (int argc, char **argv)
priv = True; priv = True;
privilege=optarg; privilege=optarg;
break; break;
case 's':
long_list = False;
break;
case 't': case 't':
group_type = True; group_type = True;
groupt=optarg; groupt=optarg;
@ -325,7 +345,7 @@ int main (int argc, char **argv)
return addgroup(group, sid_type, ntgroup, group_desc, privilege); return addgroup(group, sid_type, ntgroup, group_desc, privilege);
if (view_group) if (view_group)
return listgroup(sid_type); return listgroup(sid_type, long_list);
if (delete_group) if (delete_group)
return deletegroup(group); return deletegroup(group);