diff options
| -rw-r--r-- | .gitignore | 1 | ||||
| -rw-r--r-- | source4/scripting/libjs/provision.js | 4 | ||||
| -rw-r--r-- | source4/scripting/python/samba/provision.py | 24 | ||||
| -rw-r--r-- | source4/setup/idmap_init.ldif | 5 | ||||
| -rw-r--r-- | source4/winbind/config.mk | 11 | ||||
| -rw-r--r-- | source4/winbind/idmap.c | 415 | ||||
| -rw-r--r-- | source4/winbind/idmap.h | 33 | ||||
| -rw-r--r-- | source4/winbind/wb_server.c | 6 | ||||
| -rw-r--r-- | source4/winbind/wb_server.h | 2 | ||||
| -rw-r--r-- | source4/winbind/wb_uid2sid.c | 15 |
10 files changed, 511 insertions, 5 deletions
diff --git a/.gitignore b/.gitignore index 6076ddc9cd..f75f698c65 100644 --- a/.gitignore +++ b/.gitignore @@ -129,6 +129,7 @@ source/utils/net/net_proto.h source/web_server/proto.h source/winbind/wb_helper.h source/winbind/wb_proto.h +source/winbind/idmap_proto.h source/wrepl_server/wrepl_server_proto.h tags source/auth/credentials/credentials_krb5_proto.h diff --git a/source4/scripting/libjs/provision.js b/source4/scripting/libjs/provision.js index dc9eae8e72..3ba93debf9 100644 --- a/source4/scripting/libjs/provision.js +++ b/source4/scripting/libjs/provision.js @@ -389,6 +389,7 @@ function provision_default_paths(subobj) paths.smbconf = lp.filename() paths.shareconf = lp.get("private dir") + "/" + "share.ldb"; paths.samdb = lp.get("sam database"); + paths.idmapdb = lp.get("idmap database"); paths.secrets = lp.get("secrets database"); paths.templates = lp.get("private dir") + "/" + "templates.ldb"; paths.keytab = "secrets.keytab"; @@ -679,6 +680,9 @@ function provision(subobj, message, blank, paths, session_info, credentials, lda message("Setting up templates into " + paths.templates + "\n"); setup_ldb("provision_templates.ldif", info, paths.templates); + message("Setting up " + paths.idmapdb +"\n"); + setup_ldb("idmap_init.ldif", info, paths.idmapdb); + message("Setting up sam.ldb partitions\n"); /* Also wipes the database */ setup_ldb("provision_partitions.ldif", info, paths.samdb); diff --git a/source4/scripting/python/samba/provision.py b/source4/scripting/python/samba/provision.py index 3e88b68509..e3c47ff4a2 100644 --- a/source4/scripting/python/samba/provision.py +++ b/source4/scripting/python/samba/provision.py @@ -59,6 +59,7 @@ class ProvisionPaths: self.hkpd = None self.hkpt = None self.samdb = None + self.idmapdb = None self.secrets = None self.keytab = None self.dns_keytab = None @@ -202,6 +203,7 @@ def provision_paths_from_lp(lp, dnsdomain): paths.shareconf = os.path.join(private_dir, "share.ldb") paths.samdb = os.path.join(private_dir, lp.get("sam database") or "samdb.ldb") + paths.idmapdb = os.path.join(private_dir, lp.get("idmap database") or "idmap.ldb") paths.secrets = os.path.join(private_dir, lp.get("secrets database") or "secrets.ldb") paths.templates = os.path.join(private_dir, "templates.ldb") paths.dns = os.path.join(private_dir, dnsdomain + ".zone") @@ -471,6 +473,24 @@ def setup_registry(path, setup_path, session_info, credentials, lp): assert os.path.exists(provision_reg) reg.diff_apply(provision_reg) +def setup_idmapdb(path, setup_path, session_info, credentials, lp): + """Setup the idmap database. + + :param path: path to the idmap database + :param setup_path: Function that returns a path to a setup file + :param session_info: Session information + :param credentials: Credentials + :param lp: Loadparm context + """ + if os.path.exists(path): + os.unlink(path) + + idmap_ldb = Ldb(path, session_info=session_info, credentials=credentials, + lp=lp) + + idmap_ldb.erase() + idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif")) + return idmap_ldb def setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname, dnsdomain, realm, rootdn, configdn, netbiosname, @@ -844,6 +864,10 @@ def provision(lp, setup_dir, message, paths, session_info, setup_templatesdb(paths.templates, setup_path, session_info=session_info, credentials=credentials, lp=lp) + message("Setting up idmap db") + setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info, + credentials=credentials, lp=lp) + samdb = setup_samdb(paths.samdb, setup_path, session_info=session_info, credentials=credentials, lp=lp, schemadn=schemadn, configdn=configdn, domaindn=domaindn, diff --git a/source4/setup/idmap_init.ldif b/source4/setup/idmap_init.ldif new file mode 100644 index 0000000000..a397cfd0d2 --- /dev/null +++ b/source4/setup/idmap_init.ldif @@ -0,0 +1,5 @@ +dn: CN=CONFIG +cn: CONFIG +lowerBound: 10000 +upperBound: 20000 + diff --git a/source4/winbind/config.mk b/source4/winbind/config.mk index da5b71f2ae..2567d617da 100644 --- a/source4/winbind/config.mk +++ b/source4/winbind/config.mk @@ -37,6 +37,7 @@ OBJ_FILES = \ wb_sam_logon.o PRIVATE_DEPENDENCIES = \ WB_HELPER \ + IDMAP \ NDR_WINBIND \ process_model \ RPC_NDR_LSA \ @@ -56,3 +57,13 @@ OBJ_FILES = \ PUBLIC_DEPENDENCIES = RPC_NDR_LSA dcerpc_samr # End SUBSYSTEM WB_HELPER ################################################ + +################################################ +# Start SUBYSTEM IDMAP +[SUBSYSTEM::IDMAP] +PRIVATE_PROTO_HEADER = idmap_proto.h +OBJ_FILES = \ + idmap.o +PUBLIC_DEPENDENCIES = SAMDB_COMMON +# End SUBSYSTEM IDMAP +################################################ diff --git a/source4/winbind/idmap.c b/source4/winbind/idmap.c new file mode 100644 index 0000000000..b14885213e --- /dev/null +++ b/source4/winbind/idmap.c @@ -0,0 +1,415 @@ +/* + Unix SMB/CIFS implementation. + + Map SIDs to uids/gids and back + + Copyright (C) Kai Blin 2008 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "auth/auth.h" +#include "librpc/gen_ndr/lsa.h" +#include "librpc/gen_ndr/samr.h" +#include "librpc/gen_ndr/ndr_security.h" +#include "lib/ldb/include/ldb.h" +#include "lib/ldb/include/ldb_errors.h" +#include "lib/ldb_wrap.h" +#include "param/param.h" +#include "winbind/idmap.h" +#include "libcli/security/proto.h" +#include "libcli/ldap/ldap_ndr.h" + +/** + * Get uid/gid bounds from idmap database + * + * \param idmap_ctx idmap context to use + * \param low lower uid/gid bound is stored here + * \param high upper uid/gid bound is stored here + * \return 0 on success, nonzero on failure + */ +static int idmap_get_bounds(struct idmap_context *idmap_ctx, uint32_t *low, + uint32_t *high) +{ + int ret = -1; + struct ldb_context *ldb = idmap_ctx->ldb_ctx; + struct ldb_dn *dn; + struct ldb_result *res = NULL; + TALLOC_CTX *tmp_ctx = talloc_new(idmap_ctx); + uint32_t lower_bound = (uint32_t) -1; + uint32_t upper_bound = (uint32_t) -1; + + dn = ldb_dn_new(tmp_ctx, ldb, "CN=CONFIG"); + if (dn == NULL) goto failed; + + ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, NULL, NULL, &res); + if (ret != LDB_SUCCESS) goto failed; + + talloc_steal(tmp_ctx, res); + + if (res->count != 1) { + ret = -1; + goto failed; + } + + lower_bound = ldb_msg_find_attr_as_uint(res->msgs[0], "lowerBound", -1); + if (lower_bound != (uint32_t) -1) { + ret = LDB_SUCCESS; + } else { + ret = -1; + goto failed; + } + + upper_bound = ldb_msg_find_attr_as_uint(res->msgs[0], "upperBound", -1); + if (upper_bound != (uint32_t) -1) { + ret = LDB_SUCCESS; + } else { + ret = -1; + } + +failed: + talloc_free(tmp_ctx); + *low = lower_bound; + *high = upper_bound; + return ret; +} + +/** + * Add a dom_sid structure to a ldb_message + * \param idmap_ctx idmap context to use + * \param mem_ctx talloc context to use + * \param ldb_message ldb message to add dom_sid to + * \param attr_name name of the attribute to store the dom_sid in + * \param sid dom_sid to store + * \return 0 on success, an ldb error code on failure. + */ +static int idmap_msg_add_dom_sid(struct idmap_context *idmap_ctx, + TALLOC_CTX *mem_ctx, struct ldb_message *msg, + const char *attr_name, const struct dom_sid *sid) +{ + struct ldb_val val; + enum ndr_err_code ndr_err; + + ndr_err = ndr_push_struct_blob(&val, mem_ctx, + lp_iconv_convenience(idmap_ctx->lp_ctx), + sid, + (ndr_push_flags_fn_t)ndr_push_dom_sid); + + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + return -1; + } + + return ldb_msg_add_value(msg, attr_name, &val, NULL); +} + +/** + * Get a dom_sid structure from a ldb message. + * + * \param mem_ctx talloc context to allocate dom_sid memory in + * \param msg ldb_message to get dom_sid from + * \param attr_name key that has the dom_sid as data + * \return dom_sid structure on success, NULL on failure + */ +static struct dom_sid *idmap_msg_get_dom_sid(TALLOC_CTX *mem_ctx, + struct ldb_message *msg, const char *attr_name) +{ + struct dom_sid *sid; + const struct ldb_val *val; + enum ndr_err_code ndr_err; + + val = ldb_msg_find_ldb_val(msg, attr_name); + if (val == NULL) { + return NULL; + } + + sid = talloc(mem_ctx, struct dom_sid); + if (sid == NULL) { + return NULL; + } + + ndr_err = ndr_pull_struct_blob(val, sid, NULL, sid, + (ndr_pull_flags_fn_t)ndr_pull_dom_sid); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + talloc_free(sid); + return NULL; + } + + return sid; +} + +/** + * Initialize idmap context + * + * talloc_free to close. + * + * \param mem_ctx talloc context to use. + * \return allocated idmap_context on success, NULL on error + */ +struct idmap_context *idmap_init(TALLOC_CTX *mem_ctx, + struct loadparm_context *lp_ctx) +{ + struct idmap_context *idmap_ctx; + + idmap_ctx = talloc(mem_ctx, struct idmap_context); + if (idmap_ctx == NULL) { + return NULL; + } + + idmap_ctx->lp_ctx = lp_ctx; + + idmap_ctx->ldb_ctx = ldb_wrap_connect(mem_ctx, lp_ctx, + lp_idmap_url(lp_ctx), + system_session(mem_ctx, lp_ctx), + NULL, 0, NULL); + if (idmap_ctx->ldb_ctx == NULL) { + return NULL; + } + + return idmap_ctx; +} + +/** + * Convert a uid to the corresponding SID + * + * \param idmap_ctx idmap context to use + * \param mem_ctx talloc context the memory for the struct dom_sid is allocated + * from. + * \param uid Unix uid to map to a SID + * \param sid Pointer that will take the struct dom_sid pointer if the mapping + * succeeds. + * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping not + * possible or some other NTSTATUS that is more descriptive on failure. + */ + +NTSTATUS idmap_uid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx, + const uid_t uid, struct dom_sid **sid) +{ + int ret; + NTSTATUS status = NT_STATUS_NONE_MAPPED; + struct ldb_context *ldb = idmap_ctx->ldb_ctx; + struct ldb_message *msg; + struct ldb_result *res = NULL; + int trans = -1; + uid_t low, high; + char *sid_string, *uid_string; + struct dom_sid *unix_users_sid, *new_sid; + TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx); + + ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, + NULL, "(&(objectClass=sidMap)(uidNumber=%u))", + uid); + if (ret != LDB_SUCCESS) { + DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb))); + status = NT_STATUS_NONE_MAPPED; + goto failed; + } + + if (res->count == 1) { + *sid = idmap_msg_get_dom_sid(mem_ctx, res->msgs[0], + "objectSid"); + if (*sid == NULL) { + DEBUG(1, ("Failed to get sid from db: %u\n", ret)); + status = NT_STATUS_NONE_MAPPED; + goto failed; + } + talloc_free(tmp_ctx); + return NT_STATUS_OK; + } + + DEBUG(6, ("uid not found in idmap db, trying to allocate SID.\n")); + + trans = ldb_transaction_start(ldb); + if (trans != LDB_SUCCESS) { + status = NT_STATUS_NONE_MAPPED; + goto failed; + } + + /* Now redo the search to make sure noone added a mapping for that SID + * while we weren't looking.*/ + ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, + NULL, "(&(objectClass=sidMap)(uidNumber=%u))", + uid); + if (ret != LDB_SUCCESS) { + DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb))); + status = NT_STATUS_NONE_MAPPED; + goto failed; + } + + if (res->count > 0) { + DEBUG(1, ("sidMap modified while trying to add a mapping.\n")); + status = NT_STATUS_RETRY; + goto failed; + } + + ret = idmap_get_bounds(idmap_ctx, &low, &high); + if (ret != LDB_SUCCESS) { + DEBUG(1, ("Failed to get id bounds from db: %u\n", ret)); + status = NT_STATUS_NONE_MAPPED; + goto failed; + } + + if (uid >= low && uid <= high) { + /* An existing user would have been mapped before */ + status = NT_STATUS_NO_SUCH_USER; + goto failed; + } + + /* For local users, we just create a rid = uid +1, so root doesn't end + * up with a 0 rid */ + unix_users_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-1"); + if (unix_users_sid == NULL) { + status = NT_STATUS_NO_MEMORY; + goto failed; + } + + new_sid = dom_sid_add_rid(mem_ctx, unix_users_sid, uid + 1); + if (new_sid == NULL) { + status = NT_STATUS_NO_MEMORY; + goto failed; + } + + sid_string = dom_sid_string(tmp_ctx, new_sid); + if (sid_string == NULL) { + status = NT_STATUS_NO_MEMORY; + goto failed; + } + + uid_string = talloc_asprintf(tmp_ctx, "%u", uid); + if (uid_string == NULL) { + status = NT_STATUS_NO_MEMORY; + goto failed; + } + + msg = ldb_msg_new(tmp_ctx); + if (msg == NULL) { + status = NT_STATUS_NO_MEMORY; + goto failed; + } + + msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string); + if (msg->dn == NULL) { + status = NT_STATUS_NO_MEMORY; + goto failed; + } + + ret = ldb_msg_add_string(msg, "uidNumber", uid_string); + if (ret != LDB_SUCCESS) { + status = NT_STATUS_NONE_MAPPED; + goto failed; + } + + ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, msg, "objectSid", + new_sid); + if (ret != LDB_SUCCESS) { + status = NT_STATUS_NONE_MAPPED; + goto failed; + } + + ret = ldb_msg_add_string(msg, "objectClass", "sidMap"); + if (ret != LDB_SUCCESS) { + status = NT_STATUS_NONE_MAPPED; + goto failed; + } + + ret = ldb_msg_add_string(msg, "cn", sid_string); + if (ret != LDB_SUCCESS) { + status = NT_STATUS_NONE_MAPPED; + goto failed; + } + + ret = ldb_add(ldb, msg); + if (ret != LDB_SUCCESS) { + status = NT_STATUS_NONE_MAPPED; + goto failed; + } + + trans = ldb_transaction_commit(ldb); + if (trans != LDB_SUCCESS) { + status = NT_STATUS_NONE_MAPPED; + goto failed; + } + + *sid = new_sid; + talloc_free(tmp_ctx); + return NT_STATUS_OK; + +failed: + if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb); + talloc_free(tmp_ctx); + return status; +} + +/** + * Map a Unix gid to the corresponding SID + * + * \todo Create a SID from the S-1-22-2 range for unmapped groups + * + * \param idmap_ctx idmap context to use + * \param mem_ctx talloc context the memory for the struct dom_sid is allocated + * from. + * \param gid Unix gid to map to a SID + * \param sid Pointer that will take the struct dom_sid pointer if mapping + * succeeds. + * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping not + * possible or some other NTSTATUS that is more descriptive on failure. + */ +NTSTATUS idmap_gid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx, + const gid_t gid, struct dom_sid **sid) +{ + return NT_STATUS_NONE_MAPPED; +} + +/** + * Map a SID to a Unix uid. + * + * If no mapping exists, a new mapping will be created. + * + * \todo Create mappings for users not from our primary domain. + * + * \param idmap_ctx idmap context to use + * \param mem_ctx talloc context to use + * \param sid SID to map to a Unix uid + * \param uid pointer to receive the mapped uid + * \return NT_STATUS_OK on success, NT_STATUS_INVALID_SID if the sid is not from + * a trusted domain and idmap trusted only = true, NT_STATUS_NONE_MAPPED if the + * mapping failed. + */ +NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx, + const struct dom_sid *sid, uid_t *uid) +{ + return NT_STATUS_NONE_MAPPED; +} + +/** + * Map a SID to a Unix gid. + * + * If no mapping exist, a new mapping will be created. + * + * \todo Create mappings for groups not from our primary domain. + * + * \param idmap_ctx idmap context to use + * \param mem_ctx talloc context to use + * \param sid SID to map to a Unix gid + * \param gid pointer to receive the mapped gid + * \return NT_STATUS_OK on success, NT_STATUS_INVALID_SID if the sid is not from + * a trusted domain and idmap trusted only = true, NT_STATUS_NONE_MAPPED if the + * mapping failed. + */ +NTSTATUS idmap_sid_to_gid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx, + const struct dom_sid *sid, gid_t *gid) +{ + return NT_STATUS_NONE_MAPPED; +} + diff --git a/source4/winbind/idmap.h b/source4/winbind/idmap.h new file mode 100644 index 0000000000..8781819be0 --- /dev/null +++ b/source4/winbind/idmap.h @@ -0,0 +1,33 @@ +/* + Unix SMB/CIFS implementation. + + Map SIDs to uids/gids and back + + Copyright (C) Kai Blin 2008 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#ifndef _IDMAP_H_ +#define _IDMAP_H_ + +struct idmap_context { + struct loadparm_context *lp_ctx; + struct ldb_context *ldb_ctx; +}; + +#include "winbind/idmap_proto.h" + +#endif + diff --git a/source4/winbind/wb_server.c b/source4/winbind/wb_server.c index 9b303f3615..99191f3c6c 100644 --- a/source4/winbind/wb_server.c +++ b/source4/winbind/wb_server.c @@ -149,6 +149,12 @@ static void winbind_task_init(struct task_server *task) return; } + service->idmap_ctx = idmap_init(service, task->lp_ctx); + if (service->idmap_ctx == NULL) { + task_server_terminate(task, "Failed to load idmap database"); + return; + } + /* setup the unprivileged samba3 socket */ listen_socket = talloc(service, struct wbsrv_listen_socket); if (!listen_socket) goto nomem; diff --git a/source4/winbind/wb_server.h b/source4/winbind/wb_server.h index f3cfc18565..ce972932f5 100644 --- a/source4/winbind/wb_server.h +++ b/source4/winbind/wb_server.h @@ -21,6 +21,7 @@ #include "nsswitch/winbind_nss_config.h" #include "nsswitch/winbind_struct_protocol.h" +#include "winbind/idmap.h" #include "libnet/libnet.h" #define WINBINDD_SAMBA3_SOCKET "pipe" @@ -33,6 +34,7 @@ struct wbsrv_service { const struct dom_sid *primary_sid; struct wbsrv_domain *domains; + struct idmap_context *idmap_ctx; }; struct wbsrv_samconn { diff --git a/source4/winbind/wb_uid2sid.c b/source4/winbind/wb_uid2sid.c index d7a909fda2..e81d2e4671 100644 --- a/source4/winbind/wb_uid2sid.c +++ b/source4/winbind/wb_uid2sid.c @@ -3,7 +3,7 @@ Command backend for wbinfo -U - Copyright (C) Kai Blin 2007 + Copyright (C) Kai Blin 2007-2008 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -25,6 +25,7 @@ #include "smbd/service_task.h" #include "winbind/wb_helper.h" #include "libcli/security/proto.h" +#include "winbind/idmap.h" struct uid2sid_state { struct composite_context *ctx; @@ -50,10 +51,14 @@ struct composite_context *wb_uid2sid_send(TALLOC_CTX *mem_ctx, result->private_data = state; state->service = service; - /* FIXME: This is a stub so far. - * We cheat by just using the uid as RID with the domain SID.*/ - state->sid = dom_sid_add_rid(result, service->primary_sid, uid); - if (composite_nomem(state->sid, state->ctx)) return result; + state->ctx->status = idmap_uid_to_sid(service->idmap_ctx, mem_ctx, uid, + &state->sid); + if (NT_STATUS_EQUAL(state->ctx->status, NT_STATUS_RETRY)) { + state->ctx->status = idmap_uid_to_sid(service->idmap_ctx, + mem_ctx, uid, + &state->sid); + } + if (!composite_is_ok(state->ctx)) return result; composite_done(state->ctx); return result; |