sidmap.c

samba最新软件

				 s, dom_sid_string(tmp_ctx, sid)));
			talloc_free(tmp_ctx);
			return NT_STATUS_NO_SUCH_GROUP;
		}
		*gid = grp->gr_gid;
		talloc_free(tmp_ctx);
		return NT_STATUS_OK;
	}

	/* finally try via the sAMAccountName attribute */
	s = samdb_result_string(res[0], "sAMAccountName", NULL);
	if (s != NULL) {
		struct group *grp = getgrnam(s);
		if (!grp) {
			DEBUG(0,("sAMAccountName '%s' for sid %s does not exist as a local group\n", s, dom_sid_string(tmp_ctx, sid)));
			talloc_free(tmp_ctx);
			return NT_STATUS_NO_SUCH_GROUP;
		}
		*gid = grp->gr_gid;
		talloc_free(tmp_ctx);
		return NT_STATUS_OK;
	}

allocated_sid:
	status = sidmap_primary_domain_sid(sidmap, tmp_ctx, &domain_sid);
	if (!NT_STATUS_IS_OK(status)) {
		talloc_free(tmp_ctx);
		return NT_STATUS_NO_SUCH_DOMAIN;
	}

	if (dom_sid_in_domain(domain_sid, sid)) {
		uint32_t rid = sid->sub_auths[sid->num_auths-1];
		if (rid >= SIDMAP_LOCAL_GROUP_BASE) {
			*gid = rid - SIDMAP_LOCAL_GROUP_BASE;
			talloc_free(tmp_ctx);
			return NT_STATUS_OK;
		}
	}

	DEBUG(0,("sid_to_unixgid: no gidNumber, unixName or sAMAccountName for sid %s\n", 
		 dom_sid_string(tmp_ctx, sid)));

	talloc_free(tmp_ctx);
	return NT_STATUS_NONE_MAPPED;
}


/*
  map a unix uid to a dom_sid
  the returned sid is allocated in the supplied mem_ctx
*/
NTSTATUS sidmap_uid_to_sid(struct sidmap_context *sidmap,
				    TALLOC_CTX *mem_ctx,
				    const uid_t uid, struct dom_sid **sid)
{
	const char *attrs[] = { "sAMAccountName", "objectSid", "sAMAccountType", NULL };
	int ret, i;
	TALLOC_CTX *tmp_ctx;
	struct ldb_message **res;
	struct passwd *pwd;
	struct dom_sid *domain_sid;
	NTSTATUS status;

	/*
	  we search for the mapping in the following order:

	    - check if the uid is in the dynamic uid range assigned for winbindd
	      use. If it is, then look in winbindd sid mapping
	      database (not implemented yet)
	    - look for a user account in samdb that has uidNumber set to the
	      given uid
	    - look for a user account in samdb that has unixName or
	      sAMAccountName set to the name given by getpwuid()
	    - assign a SID by adding the uid to SIDMAP_LOCAL_USER_BASE in the local
	      domain
	*/


	tmp_ctx = talloc_new(mem_ctx);


	/*
	  step 2: look for a user account in samdb that has uidNumber set to the
                  given uid
	*/

	ret = gendb_search(sidmap->samctx, tmp_ctx, NULL, &res, attrs, 
			   "uidNumber=%u", (unsigned int)uid);
	for (i=0;i<ret;i++) {
		if (!is_user_account(res[i])) continue;

		*sid = samdb_result_dom_sid(mem_ctx, res[i], "objectSid");
		talloc_free(tmp_ctx);
		NT_STATUS_HAVE_NO_MEMORY(*sid);
		return NT_STATUS_OK;
	}

	/*
	  step 3: look for a user account in samdb that has unixName
	          or sAMAccountName set to the name given by getpwuid()
	*/
	pwd = getpwuid(uid);
	if (pwd == NULL) {
		goto allocate_sid;
	}

	ret = gendb_search(sidmap->samctx, tmp_ctx, NULL, &res, attrs, 
			   "(|(unixName=%s)(sAMAccountName=%s))", 
			   pwd->pw_name, pwd->pw_name);
	for (i=0;i<ret;i++) {
		if (!is_user_account(res[i])) continue;

		*sid = samdb_result_dom_sid(mem_ctx, res[i], "objectSid");
		talloc_free(tmp_ctx);
		NT_STATUS_HAVE_NO_MEMORY(*sid);
		return NT_STATUS_OK;
	}


	/*
	    step 4: assign a SID by adding the uid to
	            SIDMAP_LOCAL_USER_BASE in the local domain
	*/
allocate_sid:
	if (uid > SIDMAP_MAX_LOCAL_UID) {
		return NT_STATUS_NONE_MAPPED;
	}

	status = sidmap_primary_domain_sid(sidmap, tmp_ctx, &domain_sid);
	if (!NT_STATUS_IS_OK(status)) {
		talloc_free(tmp_ctx);
		return status;
	}

	*sid = dom_sid_add_rid(mem_ctx, domain_sid, SIDMAP_LOCAL_USER_BASE + uid);
	talloc_free(tmp_ctx);

	if (*sid == NULL) {
		return NT_STATUS_NO_MEMORY;
	}

	return NT_STATUS_OK;
}


/*
  map a unix gid to a dom_sid
  the returned sid is allocated in the supplied mem_ctx
*/
NTSTATUS sidmap_gid_to_sid(struct sidmap_context *sidmap,
				    TALLOC_CTX *mem_ctx,
				    const gid_t gid, struct dom_sid **sid)
{
	const char *attrs[] = { "sAMAccountName", "objectSid", "sAMAccountType", NULL };
	int ret, i;
	TALLOC_CTX *tmp_ctx;
	struct ldb_message **res;
	struct group *grp;
	struct dom_sid *domain_sid;
	NTSTATUS status;

	/*
	  we search for the mapping in the following order:

	    - check if the gid is in the dynamic gid range assigned for winbindd
	      use. If it is, then look in winbindd sid mapping
	      database (not implemented yet)
	    - look for a group account in samdb that has gidNumber set to the
	      given gid
	    - look for a group account in samdb that has unixName or
	      sAMAccountName set to the name given by getgrgid()
	    - assign a SID by adding the gid to SIDMAP_LOCAL_GROUP_BASE in the local
	      domain
	*/


	tmp_ctx = talloc_new(sidmap);


	/*
	  step 2: look for a group account in samdb that has gidNumber set to the
                  given gid
	*/

	ret = gendb_search(sidmap->samctx, tmp_ctx, NULL, &res, attrs, 
			   "gidNumber=%u", (unsigned int)gid);
	for (i=0;i<ret;i++) {
		if (!is_group_account(res[i])) continue;

		*sid = samdb_result_dom_sid(mem_ctx, res[i], "objectSid");
		talloc_free(tmp_ctx);
		NT_STATUS_HAVE_NO_MEMORY(*sid);
		return NT_STATUS_OK;
	}

	/*
	  step 3: look for a group account in samdb that has unixName
	          or sAMAccountName set to the name given by getgrgid()
	*/
	grp = getgrgid(gid);
	if (grp == NULL) {
		goto allocate_sid;
	}

	ret = gendb_search(sidmap->samctx, tmp_ctx, NULL, &res, attrs, 
			   "(|(unixName=%s)(sAMAccountName=%s))", 
			   grp->gr_name, grp->gr_name);
	for (i=0;i<ret;i++) {
		if (!is_group_account(res[i])) continue;

		*sid = samdb_result_dom_sid(mem_ctx, res[i], "objectSid");
		talloc_free(tmp_ctx);
		NT_STATUS_HAVE_NO_MEMORY(*sid);
		return NT_STATUS_OK;
	}


	/*
	    step 4: assign a SID by adding the gid to
	            SIDMAP_LOCAL_GROUP_BASE in the local domain
	*/
allocate_sid:
	if (gid > SIDMAP_MAX_LOCAL_GID) {
		return NT_STATUS_NONE_MAPPED;
	}

	status = sidmap_primary_domain_sid(sidmap, tmp_ctx, &domain_sid);
	if (!NT_STATUS_IS_OK(status)) {
		talloc_free(tmp_ctx);
		return status;
	}

	*sid = dom_sid_add_rid(mem_ctx, domain_sid, SIDMAP_LOCAL_GROUP_BASE + gid);
	talloc_free(tmp_ctx);

	if (*sid == NULL) {
		return NT_STATUS_NO_MEMORY;
	}

	return NT_STATUS_OK;
}

/*
  check if a sid is in the range of auto-allocated SIDs from our primary domain,
  and if it is, then return the name and atype
*/
NTSTATUS sidmap_allocated_sid_lookup(struct sidmap_context *sidmap, 
					      TALLOC_CTX *mem_ctx, 
					      const struct dom_sid *sid,
					      const char **name,
					      enum lsa_SidType *rtype)
{
	NTSTATUS status;
	struct dom_sid *domain_sid;
	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
	uint32_t rid, atype;
	
	status = sidmap_primary_domain_sid(sidmap, tmp_ctx, &domain_sid);
	if (!NT_STATUS_IS_OK(status)) {
		return NT_STATUS_NO_SUCH_DOMAIN;
	}

	if (!dom_sid_in_domain(domain_sid, sid)) {
		talloc_free(tmp_ctx);
		return NT_STATUS_NONE_MAPPED;
	}

	talloc_free(tmp_ctx);

	rid = sid->sub_auths[sid->num_auths-1];
	if (rid < SIDMAP_LOCAL_USER_BASE) {
		return NT_STATUS_NONE_MAPPED;
	}

	if (rid < SIDMAP_LOCAL_GROUP_BASE) {
		struct passwd *pwd;
		uid_t uid = rid - SIDMAP_LOCAL_USER_BASE;
		atype = ATYPE_NORMAL_ACCOUNT;
		*rtype = samdb_atype_map(atype);

		pwd = getpwuid(uid);
		if (pwd == NULL) {
			*name = talloc_asprintf(mem_ctx, "uid%u", uid);
		} else {
			*name = talloc_strdup(mem_ctx, pwd->pw_name);
		}
	} else {
		struct group *grp;
		gid_t gid = rid - SIDMAP_LOCAL_GROUP_BASE;
		atype = ATYPE_LOCAL_GROUP;
		*rtype = samdb_atype_map(atype);
		grp = getgrgid(gid);
		if (grp == NULL) {
			*name = talloc_asprintf(mem_ctx, "gid%u", gid);
		} else {
			*name = talloc_strdup(mem_ctx, grp->gr_name);
		}
	}

	if (*name == NULL) {
		return NT_STATUS_NO_MEMORY;
	}

	return NT_STATUS_OK;
}