diff options
| -rw-r--r-- | source3/Makefile.in | 3 | ||||
| -rw-r--r-- | source3/auth/token_util.c | 130 | ||||
| -rw-r--r-- | source3/include/proto.h | 7 | ||||
| -rw-r--r-- | source3/passdb/pdb_util.c | 158 | ||||
| -rwxr-xr-x | source3/wscript_build | 3 |
5 files changed, 167 insertions, 134 deletions
diff --git a/source3/Makefile.in b/source3/Makefile.in index 109d0801ac5..36951a7ca53 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -763,7 +763,8 @@ PASSDB_OBJ = $(PASSDB_GET_SET_OBJ) passdb/passdb.o passdb/pdb_interface.o \ passdb/util_unixsids.o passdb/lookup_sid.o \ passdb/login_cache.o @PDB_STATIC@ \ passdb/account_pol.o $(PRIVILEGES_OBJ) \ - lib/util_nscd.o lib/winbind_util.o $(SERVER_MUTEX_OBJ) + lib/util_nscd.o lib/winbind_util.o $(SERVER_MUTEX_OBJ) \ + passdb/pdb_util.o DEVEL_HELP_WEIRD_OBJ = modules/weird.o CP850_OBJ = modules/CP850.o diff --git a/source3/auth/token_util.c b/source3/auth/token_util.c index 3afc4438a50..025baa6e84d 100644 --- a/source3/auth/token_util.c +++ b/source3/auth/token_util.c @@ -204,136 +204,6 @@ static NTSTATUS add_builtin_administrators(struct security_token *token, return NT_STATUS_OK; } -/** - * Create the requested BUILTIN if it doesn't already exist. This requires - * winbindd to be running. - * - * @param[in] rid BUILTIN rid to create - * @return Normal NTSTATUS return. - */ -static NTSTATUS create_builtin(uint32 rid) -{ - NTSTATUS status = NT_STATUS_OK; - struct dom_sid sid; - gid_t gid; - - if (!sid_compose(&sid, &global_sid_Builtin, rid)) { - return NT_STATUS_NO_SUCH_ALIAS; - } - - if (!sid_to_gid(&sid, &gid)) { - if (!lp_winbind_nested_groups() || !winbind_ping()) { - return NT_STATUS_PROTOCOL_UNREACHABLE; - } - status = pdb_create_builtin_alias(rid); - } - return status; -} - -/** - * Add sid as a member of builtin_sid. - * - * @param[in] builtin_sid An existing builtin group. - * @param[in] dom_sid sid to add as a member of builtin_sid. - * @return Normal NTSTATUS return - */ -static NTSTATUS add_sid_to_builtin(const struct dom_sid *builtin_sid, - const struct dom_sid *dom_sid) -{ - NTSTATUS status = NT_STATUS_OK; - - if (!dom_sid || !builtin_sid) { - return NT_STATUS_INVALID_PARAMETER; - } - - status = pdb_add_aliasmem(builtin_sid, dom_sid); - - if (NT_STATUS_EQUAL(status, NT_STATUS_MEMBER_IN_ALIAS)) { - DEBUG(5, ("add_sid_to_builtin %s is already a member of %s\n", - sid_string_dbg(dom_sid), - sid_string_dbg(builtin_sid))); - return NT_STATUS_OK; - } - - if (!NT_STATUS_IS_OK(status)) { - DEBUG(4, ("add_sid_to_builtin %s could not be added to %s: " - "%s\n", sid_string_dbg(dom_sid), - sid_string_dbg(builtin_sid), nt_errstr(status))); - } - return status; -} - -/******************************************************************* -*******************************************************************/ - -NTSTATUS create_builtin_users(const struct dom_sid *dom_sid) -{ - NTSTATUS status; - struct dom_sid dom_users; - - status = create_builtin(BUILTIN_RID_USERS); - if ( !NT_STATUS_IS_OK(status) ) { - DEBUG(5,("create_builtin_users: Failed to create Users\n")); - return status; - } - - /* add domain users */ - if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER)) - && sid_compose(&dom_users, dom_sid, DOMAIN_RID_USERS)) - { - status = add_sid_to_builtin(&global_sid_Builtin_Users, - &dom_users); - } - - return status; -} - -/******************************************************************* -*******************************************************************/ - -NTSTATUS create_builtin_administrators(const struct dom_sid *dom_sid) -{ - NTSTATUS status; - struct dom_sid dom_admins, root_sid; - fstring root_name; - enum lsa_SidType type; - TALLOC_CTX *ctx; - bool ret; - - status = create_builtin(BUILTIN_RID_ADMINISTRATORS); - if ( !NT_STATUS_IS_OK(status) ) { - DEBUG(5,("create_builtin_administrators: Failed to create Administrators\n")); - return status; - } - - /* add domain admins */ - if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER)) - && sid_compose(&dom_admins, dom_sid, DOMAIN_RID_ADMINS)) - { - status = add_sid_to_builtin(&global_sid_Builtin_Administrators, - &dom_admins); - if (!NT_STATUS_IS_OK(status)) { - return status; - } - } - - /* add root */ - if ( (ctx = talloc_init("create_builtin_administrators")) == NULL ) { - return NT_STATUS_NO_MEMORY; - } - fstr_sprintf( root_name, "%s\\root", get_global_sam_name() ); - ret = lookup_name(ctx, root_name, LOOKUP_NAME_DOMAIN, NULL, NULL, - &root_sid, &type); - TALLOC_FREE( ctx ); - - if ( ret ) { - status = add_sid_to_builtin(&global_sid_Builtin_Administrators, - &root_sid); - } - - return status; -} - static NTSTATUS finalize_local_nt_token(struct security_token *result, bool is_guest); diff --git a/source3/include/proto.h b/source3/include/proto.h index 307853f50ea..19bc1ca2637 100644 --- a/source3/include/proto.h +++ b/source3/include/proto.h @@ -250,8 +250,6 @@ bool nt_token_check_domain_rid( struct security_token *token, uint32 rid ); struct security_token *get_root_nt_token( void ); NTSTATUS add_aliases(const struct dom_sid *domain_sid, struct security_token *token); -NTSTATUS create_builtin_users(const struct dom_sid *sid); -NTSTATUS create_builtin_administrators(const struct dom_sid *sid); struct security_token *create_local_nt_token(TALLOC_CTX *mem_ctx, const struct dom_sid *user_sid, bool is_guest, @@ -3621,6 +3619,11 @@ NTSTATUS pdb_wbc_sam_init(void); NTSTATUS pdb_tdbsam_init(void); +/* The following definitions come from passdb/pdb_util.c */ + +NTSTATUS create_builtin_users(const struct dom_sid *sid); +NTSTATUS create_builtin_administrators(const struct dom_sid *sid); + /* The following definitions come from passdb/util_builtin.c */ bool lookup_builtin_rid(TALLOC_CTX *mem_ctx, uint32 rid, const char **name); diff --git a/source3/passdb/pdb_util.c b/source3/passdb/pdb_util.c new file mode 100644 index 00000000000..3b7377c3127 --- /dev/null +++ b/source3/passdb/pdb_util.c @@ -0,0 +1,158 @@ +/* + * Unix SMB/CIFS implementation. + * Authentication utility functions + * Copyright (C) Andrew Tridgell 1992-1998 + * Copyright (C) Andrew Bartlett 2001 + * Copyright (C) Jeremy Allison 2000-2001 + * Copyright (C) Rafal Szczesniak 2002 + * Copyright (C) Volker Lendecke 2006 + * Copyright (C) Michael Adam 2007 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see <http://www.gnu.org/licenses/>. + */ + +#include "includes.h" +#include "../libcli/security/security.h" +#include "passdb.h" +#include "lib/winbind_util.h" + +/** + * Add sid as a member of builtin_sid. + * + * @param[in] builtin_sid An existing builtin group. + * @param[in] dom_sid sid to add as a member of builtin_sid. + * @return Normal NTSTATUS return + */ +static NTSTATUS add_sid_to_builtin(const struct dom_sid *builtin_sid, + const struct dom_sid *dom_sid) +{ + NTSTATUS status = NT_STATUS_OK; + + if (!dom_sid || !builtin_sid) { + return NT_STATUS_INVALID_PARAMETER; + } + + status = pdb_add_aliasmem(builtin_sid, dom_sid); + + if (NT_STATUS_EQUAL(status, NT_STATUS_MEMBER_IN_ALIAS)) { + DEBUG(5, ("add_sid_to_builtin %s is already a member of %s\n", + sid_string_dbg(dom_sid), + sid_string_dbg(builtin_sid))); + return NT_STATUS_OK; + } + + if (!NT_STATUS_IS_OK(status)) { + DEBUG(4, ("add_sid_to_builtin %s could not be added to %s: " + "%s\n", sid_string_dbg(dom_sid), + sid_string_dbg(builtin_sid), nt_errstr(status))); + } + return status; +} + +/** + * Create the requested BUILTIN if it doesn't already exist. This requires + * winbindd to be running. + * + * @param[in] rid BUILTIN rid to create + * @return Normal NTSTATUS return. + */ +static NTSTATUS create_builtin(uint32 rid) +{ + NTSTATUS status = NT_STATUS_OK; + struct dom_sid sid; + gid_t gid; + + if (!sid_compose(&sid, &global_sid_Builtin, rid)) { + return NT_STATUS_NO_SUCH_ALIAS; + } + + if (!sid_to_gid(&sid, &gid)) { + if (!lp_winbind_nested_groups() || !winbind_ping()) { + return NT_STATUS_PROTOCOL_UNREACHABLE; + } + status = pdb_create_builtin_alias(rid); + } + return status; +} + +/******************************************************************* +*******************************************************************/ + +NTSTATUS create_builtin_users(const struct dom_sid *dom_sid) +{ + NTSTATUS status; + struct dom_sid dom_users; + + status = create_builtin(BUILTIN_RID_USERS); + if ( !NT_STATUS_IS_OK(status) ) { + DEBUG(5,("create_builtin_users: Failed to create Users\n")); + return status; + } + + /* add domain users */ + if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER)) + && sid_compose(&dom_users, dom_sid, DOMAIN_RID_USERS)) + { + status = add_sid_to_builtin(&global_sid_Builtin_Users, + &dom_users); + } + + return status; +} + +/******************************************************************* +*******************************************************************/ + +NTSTATUS create_builtin_administrators(const struct dom_sid *dom_sid) +{ + NTSTATUS status; + struct dom_sid dom_admins, root_sid; + fstring root_name; + enum lsa_SidType type; + TALLOC_CTX *ctx; + bool ret; + + status = create_builtin(BUILTIN_RID_ADMINISTRATORS); + if ( !NT_STATUS_IS_OK(status) ) { + DEBUG(5,("create_builtin_administrators: Failed to create Administrators\n")); + return status; + } + + /* add domain admins */ + if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER)) + && sid_compose(&dom_admins, dom_sid, DOMAIN_RID_ADMINS)) + { + status = add_sid_to_builtin(&global_sid_Builtin_Administrators, + &dom_admins); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + } + + /* add root */ + if ( (ctx = talloc_init("create_builtin_administrators")) == NULL ) { + return NT_STATUS_NO_MEMORY; + } + fstr_sprintf( root_name, "%s\\root", get_global_sam_name() ); + ret = lookup_name(ctx, root_name, LOOKUP_NAME_DOMAIN, NULL, NULL, + &root_sid, &type); + TALLOC_FREE( ctx ); + + if ( ret ) { + status = add_sid_to_builtin(&global_sid_Builtin_Administrators, + &root_sid); + } + + return status; +} diff --git a/source3/wscript_build b/source3/wscript_build index 76abe0b9bb2..9e3c7eeb43b 100755 --- a/source3/wscript_build +++ b/source3/wscript_build @@ -231,7 +231,8 @@ PASSDB_SRC = '''${PASSDB_GET_SET_SRC} passdb/passdb.c passdb/util_unixsids.c passdb/lookup_sid.c passdb/login_cache.c passdb/account_pol.c ${PRIVILEGES_SRC} - lib/util_nscd.c lib/winbind_util.c ${SERVER_MUTEX_SRC}''' + lib/util_nscd.c lib/winbind_util.c ${SERVER_MUTEX_SRC} + passdb/pdb_util.c''' #FIXME: lib/winbind_util.c probably is not part of PASSDB_SRC GROUPDB_SRC = '''groupdb/mapping.c groupdb/mapping_tdb.c''' |