s3: create_builtin_users/administrators belongs to passdb not auth.

Guenther

5 files changed, 167 insertions, 134 deletions

diff --git a/source3/Makefile.in b/source3/Makefile.in
index 109d0801ac..36951a7ca5 100644
--- a/source3/Makefile.in
+++ b/source3/Makefile.in
@@ -763,7 +763,8 @@ PASSDB_OBJ = $(PASSDB_GET_SET_OBJ) passdb/passdb.o passdb/pdb_interface.o \
 		passdb/util_unixsids.o passdb/lookup_sid.o \
 		passdb/login_cache.o @PDB_STATIC@ \
 		passdb/account_pol.o $(PRIVILEGES_OBJ) \
-		lib/util_nscd.o lib/winbind_util.o $(SERVER_MUTEX_OBJ)
+		lib/util_nscd.o lib/winbind_util.o $(SERVER_MUTEX_OBJ) \
+		passdb/pdb_util.o
 
 DEVEL_HELP_WEIRD_OBJ = modules/weird.o
 CP850_OBJ = modules/CP850.o
diff --git a/source3/auth/token_util.c b/source3/auth/token_util.c
index 3afc4438a5..025baa6e84 100644
--- a/source3/auth/token_util.c
+++ b/source3/auth/token_util.c
@@ -204,136 +204,6 @@ static NTSTATUS add_builtin_administrators(struct security_token *token,
 	return NT_STATUS_OK;
 }
 
-/**
- * Create the requested BUILTIN if it doesn't already exist.  This requires
- * winbindd to be running.
- *
- * @param[in] rid BUILTIN rid to create
- * @return Normal NTSTATUS return.
- */
-static NTSTATUS create_builtin(uint32 rid)
-{
-	NTSTATUS status = NT_STATUS_OK;
-	struct dom_sid sid;
-	gid_t gid;
-
-	if (!sid_compose(&sid, &global_sid_Builtin, rid)) {
-		return NT_STATUS_NO_SUCH_ALIAS;
-	}
-
-	if (!sid_to_gid(&sid, &gid)) {
-		if (!lp_winbind_nested_groups() || !winbind_ping()) {
-			return NT_STATUS_PROTOCOL_UNREACHABLE;
-		}
-		status = pdb_create_builtin_alias(rid);
-	}
-	return status;
-}
-
-/**
- * Add sid as a member of builtin_sid.
- *
- * @param[in] builtin_sid	An existing builtin group.
- * @param[in] dom_sid		sid to add as a member of builtin_sid.
- * @return Normal NTSTATUS return
- */
-static NTSTATUS add_sid_to_builtin(const struct dom_sid *builtin_sid,
-				   const struct dom_sid *dom_sid)
-{
-	NTSTATUS status = NT_STATUS_OK;
-
-	if (!dom_sid || !builtin_sid) {
-		return NT_STATUS_INVALID_PARAMETER;
-	}
-
-	status = pdb_add_aliasmem(builtin_sid, dom_sid);
-
-	if (NT_STATUS_EQUAL(status, NT_STATUS_MEMBER_IN_ALIAS)) {
-		DEBUG(5, ("add_sid_to_builtin %s is already a member of %s\n",
-			  sid_string_dbg(dom_sid),
-			  sid_string_dbg(builtin_sid)));
-		return NT_STATUS_OK;
-	}
-
-	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(4, ("add_sid_to_builtin %s could not be added to %s: "
-			  "%s\n", sid_string_dbg(dom_sid),
-			  sid_string_dbg(builtin_sid), nt_errstr(status)));
-	}
-	return status;
-}
-
-/*******************************************************************
-*******************************************************************/
-
-NTSTATUS create_builtin_users(const struct dom_sid *dom_sid)
-{
-	NTSTATUS status;
-	struct dom_sid dom_users;
-
-	status = create_builtin(BUILTIN_RID_USERS);
-	if ( !NT_STATUS_IS_OK(status) ) {
-		DEBUG(5,("create_builtin_users: Failed to create Users\n"));
-		return status;
-	}
-
-	/* add domain users */
-	if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
-		&& sid_compose(&dom_users, dom_sid, DOMAIN_RID_USERS))
-	{
-		status = add_sid_to_builtin(&global_sid_Builtin_Users,
-					    &dom_users);
-	}
-
-	return status;
-}
-
-/*******************************************************************
-*******************************************************************/
-
-NTSTATUS create_builtin_administrators(const struct dom_sid *dom_sid)
-{
-	NTSTATUS status;
-	struct dom_sid dom_admins, root_sid;
-	fstring root_name;
-	enum lsa_SidType type;
-	TALLOC_CTX *ctx;
-	bool ret;
-
-	status = create_builtin(BUILTIN_RID_ADMINISTRATORS);
-	if ( !NT_STATUS_IS_OK(status) ) {
-		DEBUG(5,("create_builtin_administrators: Failed to create Administrators\n"));
-		return status;
-	}
-
-	/* add domain admins */
-	if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
-		&& sid_compose(&dom_admins, dom_sid, DOMAIN_RID_ADMINS))
-	{
-		status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
-					    &dom_admins);
-		if (!NT_STATUS_IS_OK(status)) {
-			return status;
-		}
-	}
-
-	/* add root */
-	if ( (ctx = talloc_init("create_builtin_administrators")) == NULL ) {
-		return NT_STATUS_NO_MEMORY;
-	}
-	fstr_sprintf( root_name, "%s\\root", get_global_sam_name() );
-	ret = lookup_name(ctx, root_name, LOOKUP_NAME_DOMAIN, NULL, NULL,
-			  &root_sid, &type);
-	TALLOC_FREE( ctx );
-
-	if ( ret ) {
-		status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
-					    &root_sid);
-	}
-
-	return status;
-}
-
 static NTSTATUS finalize_local_nt_token(struct security_token *result,
 					bool is_guest);
 
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 307853f50e..19bc1ca263 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -250,8 +250,6 @@ bool nt_token_check_domain_rid( struct security_token *token, uint32 rid );
 struct security_token *get_root_nt_token( void );
 NTSTATUS add_aliases(const struct dom_sid *domain_sid,
 		     struct security_token *token);
-NTSTATUS create_builtin_users(const struct dom_sid *sid);
-NTSTATUS create_builtin_administrators(const struct dom_sid *sid);
 struct security_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
 					    const struct dom_sid *user_sid,
 					    bool is_guest,
@@ -3621,6 +3619,11 @@ NTSTATUS pdb_wbc_sam_init(void);
 
 NTSTATUS pdb_tdbsam_init(void);
 
+/* The following definitions come from passdb/pdb_util.c  */
+
+NTSTATUS create_builtin_users(const struct dom_sid *sid);
+NTSTATUS create_builtin_administrators(const struct dom_sid *sid);
+
 /* The following definitions come from passdb/util_builtin.c  */
 
 bool lookup_builtin_rid(TALLOC_CTX *mem_ctx, uint32 rid, const char **name);
diff --git a/source3/passdb/pdb_util.c b/source3/passdb/pdb_util.c
new file mode 100644
index 0000000000..3b7377c312
--- /dev/null
+++ b/source3/passdb/pdb_util.c
@@ -0,0 +1,158 @@
+/*
+ *  Unix SMB/CIFS implementation.
+ *  Authentication utility functions
+ *  Copyright (C) Andrew Tridgell 1992-1998
+ *  Copyright (C) Andrew Bartlett 2001
+ *  Copyright (C) Jeremy Allison 2000-2001
+ *  Copyright (C) Rafal Szczesniak 2002
+ *  Copyright (C) Volker Lendecke 2006
+ *  Copyright (C) Michael Adam 2007
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "includes.h"
+#include "../libcli/security/security.h"
+#include "passdb.h"
+#include "lib/winbind_util.h"
+
+/**
+ * Add sid as a member of builtin_sid.
+ *
+ * @param[in] builtin_sid	An existing builtin group.
+ * @param[in] dom_sid		sid to add as a member of builtin_sid.
+ * @return Normal NTSTATUS return
+ */
+static NTSTATUS add_sid_to_builtin(const struct dom_sid *builtin_sid,
+				   const struct dom_sid *dom_sid)
+{
+	NTSTATUS status = NT_STATUS_OK;
+
+	if (!dom_sid || !builtin_sid) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	status = pdb_add_aliasmem(builtin_sid, dom_sid);
+
+	if (NT_STATUS_EQUAL(status, NT_STATUS_MEMBER_IN_ALIAS)) {
+		DEBUG(5, ("add_sid_to_builtin %s is already a member of %s\n",
+			  sid_string_dbg(dom_sid),
+			  sid_string_dbg(builtin_sid)));
+		return NT_STATUS_OK;
+	}
+
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(4, ("add_sid_to_builtin %s could not be added to %s: "
+			  "%s\n", sid_string_dbg(dom_sid),
+			  sid_string_dbg(builtin_sid), nt_errstr(status)));
+	}
+	return status;
+}
+
+/**
+ * Create the requested BUILTIN if it doesn't already exist.  This requires
+ * winbindd to be running.
+ *
+ * @param[in] rid BUILTIN rid to create
+ * @return Normal NTSTATUS return.
+ */
+static NTSTATUS create_builtin(uint32 rid)
+{
+	NTSTATUS status = NT_STATUS_OK;
+	struct dom_sid sid;
+	gid_t gid;
+
+	if (!sid_compose(&sid, &global_sid_Builtin, rid)) {
+		return NT_STATUS_NO_SUCH_ALIAS;
+	}
+
+	if (!sid_to_gid(&sid, &gid)) {
+		if (!lp_winbind_nested_groups() || !winbind_ping()) {
+			return NT_STATUS_PROTOCOL_UNREACHABLE;
+		}
+		status = pdb_create_builtin_alias(rid);
+	}
+	return status;
+}
+
+/*******************************************************************
+*******************************************************************/
+
+NTSTATUS create_builtin_users(const struct dom_sid *dom_sid)
+{
+	NTSTATUS status;
+	struct dom_sid dom_users;
+
+	status = create_builtin(BUILTIN_RID_USERS);
+	if ( !NT_STATUS_IS_OK(status) ) {
+		DEBUG(5,("create_builtin_users: Failed to create Users\n"));
+		return status;
+	}
+
+	/* add domain users */
+	if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
+		&& sid_compose(&dom_users, dom_sid, DOMAIN_RID_USERS))
+	{
+		status = add_sid_to_builtin(&global_sid_Builtin_Users,
+					    &dom_users);
+	}
+
+	return status;
+}
+
+/*******************************************************************
+*******************************************************************/
+
+NTSTATUS create_builtin_administrators(const struct dom_sid *dom_sid)
+{
+	NTSTATUS status;
+	struct dom_sid dom_admins, root_sid;
+	fstring root_name;
+	enum lsa_SidType type;
+	TALLOC_CTX *ctx;
+	bool ret;
+
+	status = create_builtin(BUILTIN_RID_ADMINISTRATORS);
+	if ( !NT_STATUS_IS_OK(status) ) {
+		DEBUG(5,("create_builtin_administrators: Failed to create Administrators\n"));
+		return status;
+	}
+
+	/* add domain admins */
+	if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
+		&& sid_compose(&dom_admins, dom_sid, DOMAIN_RID_ADMINS))
+	{
+		status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
+					    &dom_admins);
+		if (!NT_STATUS_IS_OK(status)) {
+			return status;
+		}
+	}
+
+	/* add root */
+	if ( (ctx = talloc_init("create_builtin_administrators")) == NULL ) {
+		return NT_STATUS_NO_MEMORY;
+	}
+	fstr_sprintf( root_name, "%s\\root", get_global_sam_name() );
+	ret = lookup_name(ctx, root_name, LOOKUP_NAME_DOMAIN, NULL, NULL,
+			  &root_sid, &type);
+	TALLOC_FREE( ctx );
+
+	if ( ret ) {
+		status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
+					    &root_sid);
+	}
+
+	return status;
+}
diff --git a/source3/wscript_build b/source3/wscript_build
index 76abe0b9bb..9e3c7eeb43 100755
--- a/source3/wscript_build
+++ b/source3/wscript_build
@@ -231,7 +231,8 @@ PASSDB_SRC = '''${PASSDB_GET_SET_SRC} passdb/passdb.c
                 passdb/util_unixsids.c passdb/lookup_sid.c
                 passdb/login_cache.c
                 passdb/account_pol.c ${PRIVILEGES_SRC}
-                lib/util_nscd.c lib/winbind_util.c ${SERVER_MUTEX_SRC}'''
+                lib/util_nscd.c lib/winbind_util.c ${SERVER_MUTEX_SRC}
+                passdb/pdb_util.c'''
 #FIXME: lib/winbind_util.c probably is not part of PASSDB_SRC
 
 GROUPDB_SRC = '''groupdb/mapping.c groupdb/mapping_tdb.c'''