/*********************************************************** Write entries from stdin to current local idmap **********************************************************/ static int net_idmap_restore(int argc, const char **argv) { if (!idmap_init(lp_idmap_backend())) { d_fprintf(stderr, "Could not init idmap\n"); return -1; } while (!feof(stdin)) { fstring line, sid_string, fmt_string; int len; unid_t id; int type = ID_EMPTY; DOM_SID sid; if (fgets(line, sizeof(line)-1, stdin) == NULL) break; len = strlen(line); if ( (len > 0) && (line[len-1] == '\n') ) line[len-1] = '\0'; /* Yuck - this is broken for sizeof(gid_t) != sizeof(int) */ snprintf(fmt_string, sizeof(fmt_string), "GID %%d %%%us", FSTRING_LEN); if (sscanf(line, fmt_string, &id.gid, sid_string) == 2) { type = ID_GROUPID; } /* Yuck - this is broken for sizeof(uid_t) != sizeof(int) */ snprintf(fmt_string, sizeof(fmt_string), "UID %%d %%%us", FSTRING_LEN); if (sscanf(line, fmt_string, &id.uid, sid_string) == 2) { type = ID_USERID; } if (type == ID_EMPTY) { d_printf("ignoring invalid line [%s]\n", line); continue; } if (!string_to_sid(&sid, sid_string)) { d_printf("ignoring invalid sid [%s]\n", sid_string); continue; } if (!NT_STATUS_IS_OK(idmap_set_mapping(&sid, id, type))) { d_fprintf(stderr, "Could not set mapping of %s %lu to sid %s\n", (type == ID_GROUPID) ? "GID" : "UID", (type == ID_GROUPID) ? (unsigned long)id.gid: (unsigned long)id.uid, sid_string_static(&sid)); continue; } } idmap_close(); return NT_STATUS_IS_OK(net_idmap_fixup_hwm()) ? 0 : -1; }
enum winbindd_result winbindd_gid_to_sid(struct winbindd_cli_state *state) { DOM_SID sid; DEBUG(3, ("[%5lu]: gid to sid %lu\n", (unsigned long)state->pid, (unsigned long)state->request.data.gid)); if ( (state->request.data.gid < server_state.gid_low) || (state->request.data.gid > server_state.gid_high) ) { struct group *grp = NULL; enum SID_NAME_USE type; unid_t id; struct winbindd_domain *domain; /* SPECIAL CASE FOR MEMBERS OF SAMBA DOMAINS */ /* if we don't trust /etc/group then when can't know anything about this gid */ if ( !lp_winbind_trusted_domains_only() ) return WINBINDD_ERROR; /* look for an idmap entry first */ if ( NT_STATUS_IS_OK(idmap_gid_to_sid(&sid, state->request.data.gid)) ) goto done; /* if users exist in /etc/group, we should try to use that gid. Get the username and the lookup the SID */ if ( !(grp = sys_getgrgid(state->request.data.gid)) ) return WINBINDD_ERROR; if ( !(domain = find_our_domain()) ) { DEBUG(0,("winbindd_uid_to_sid: can't find my own domain!\n")); return WINBINDD_ERROR; } if ( !winbindd_lookup_sid_by_name(domain, grp->gr_name, &sid, &type) ) return WINBINDD_ERROR; if ( type!=SID_NAME_DOM_GRP && type!=SID_NAME_ALIAS ) return WINBINDD_ERROR; /* don't fail if we can't store it */ id.gid = grp->gr_gid; idmap_set_mapping( &sid, id, ID_GROUPID ); goto done; } /* Lookup sid for this uid */ if (!NT_STATUS_IS_OK(idmap_gid_to_sid(&sid, state->request.data.gid))) { DEBUG(1, ("Could not convert gid %lu to sid\n", (unsigned long)state->request.data.gid)); return WINBINDD_ERROR; } done: /* Construct sid and return it */ sid_to_string(state->response.data.sid.sid, &sid); state->response.data.sid.type = SID_NAME_DOM_GRP; return WINBINDD_OK; }
enum winbindd_result winbindd_sid_to_gid(struct winbindd_cli_state *state) { DOM_SID sid; uint32 flags = 0x0; /* Ensure null termination */ state->request.data.sid[sizeof(state->request.data.sid)-1]='\0'; DEBUG(3, ("[%5lu]: sid to gid %s\n", (unsigned long)state->pid, state->request.data.sid)); if (!string_to_sid(&sid, state->request.data.sid)) { DEBUG(1, ("Could not cvt string to sid %s\n", state->request.data.sid)); return WINBINDD_ERROR; } /* This gets a little tricky. If we assume that usernames are syncd between /etc/passwd and the windows domain (such as a member of a Samba domain), the we need to get the uid from the OS and not alocate one ourselves */ if ( lp_winbind_trusted_domains_only() ) { struct winbindd_domain *domain = NULL; DOM_SID sid2; uint32 rid; unid_t id; domain = find_our_domain(); if ( !domain ) { DEBUG(0,("winbindd_sid_to_uid: can't find my own domain!\n")); return WINBINDD_ERROR; } sid_copy( &sid2, &sid ); sid_split_rid( &sid2, &rid ); if ( sid_equal( &sid2, &domain->sid ) ) { fstring domain_name; fstring group; enum SID_NAME_USE type; struct group *grp = NULL; /* ok...here's we know that we are dealing with our own domain (the one to which we are joined). And we know that there must be a UNIX account for this group. So we lookup the sid and the call getpwnam().*/ /* But first check and see if we don't already have a mapping */ flags = ID_QUERY_ONLY; if ( NT_STATUS_IS_OK(idmap_sid_to_gid(&sid, &(state->response.data.gid), flags)) ) return WINBINDD_OK; /* now fall back to the hard way */ if ( !winbindd_lookup_name_by_sid(&sid, domain_name, group, &type) ) return WINBINDD_ERROR; if ( !(grp = sys_getgrnam(group)) ) { DEBUG(0,("winbindd_sid_to_uid: 'winbind trusted domains only' is " "set but this group [%s] doesn't exist!\n", group)); return WINBINDD_ERROR; } state->response.data.gid = grp->gr_gid; id.gid = grp->gr_gid; idmap_set_mapping( &sid, id, ID_GROUPID ); return WINBINDD_OK; } } if ( state->request.flags & WBFLAG_QUERY_ONLY ) flags = ID_QUERY_ONLY; /* Find gid for this sid and return it */ if ( !NT_STATUS_IS_OK(idmap_sid_to_gid(&sid, &(state->response.data.gid), flags)) ) { DEBUG(1, ("Could not get gid for sid %s\n", state->request.data.sid)); return WINBINDD_ERROR; } return WINBINDD_OK; }