From 00c6271d5cbbfe808b81906d5be2b328e4f25b30 Mon Sep 17 00:00:00 2001
From: Steven Danneman <steven.danneman@isilon.com>
Date: Mon, 27 Oct 2008 23:37:55 -0700
Subject: Added ability to remove id mappings in wbinfo and libwbclient.

The idmap_tdb backend already provides an interface to remove existing id
mappings.  This commit plumbs that ability up through, winbindd, libwbclient,
and wbinfo.

Added new winbindd command:
        WINBINDD_REMOVE_MAPPING
Added new libwbclient interfaces:
        wbcRemoveUidMapping() and wbcRemoveGidMapping()
Added new wbinfo options:
        --remove-uid-mapping
        --remove-gid-mapping

Increased libwbclient version to 0.2
Increased winbind interface version to 20
---
 source3/nsswitch/wbinfo.c | 74 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 74 insertions(+)

(limited to 'source3/nsswitch/wbinfo.c')

diff --git a/source3/nsswitch/wbinfo.c b/source3/nsswitch/wbinfo.c
index 27df52f92c..d5eee7e8f8 100644
--- a/source3/nsswitch/wbinfo.c
+++ b/source3/nsswitch/wbinfo.c
@@ -811,6 +811,54 @@ static bool wbinfo_set_gid_mapping(gid_t gid, const char *sid_str)
 	return true;
 }
 
+static bool wbinfo_remove_uid_mapping(uid_t uid, const char *sid_str)
+{
+	wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+	struct wbcDomainSid sid;
+
+	/* Send request */
+
+	wbc_status = wbcStringToSid(sid_str, &sid);
+	if (!WBC_ERROR_IS_OK(wbc_status)) {
+		return false;
+	}
+
+	wbc_status = wbcRemoveUidMapping(uid, &sid);
+	if (!WBC_ERROR_IS_OK(wbc_status)) {
+		return false;
+	}
+
+	/* Display response */
+
+	d_printf("Removed uid %d to sid %s mapping\n", uid, sid_str);
+
+	return true;
+}
+
+static bool wbinfo_remove_gid_mapping(gid_t gid, const char *sid_str)
+{
+	wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+	struct wbcDomainSid sid;
+
+	/* Send request */
+
+	wbc_status = wbcStringToSid(sid_str, &sid);
+	if (!WBC_ERROR_IS_OK(wbc_status)) {
+		return false;
+	}
+
+	wbc_status = wbcRemoveGidMapping(gid, &sid);
+	if (!WBC_ERROR_IS_OK(wbc_status)) {
+		return false;
+	}
+
+	/* Display response */
+
+	d_printf("Removed gid %d to sid %s mapping\n", gid, sid_str);
+
+	return true;
+}
+
 /* Convert sid to string */
 
 static bool wbinfo_lookupsid(const char *sid_str)
@@ -1489,6 +1537,8 @@ enum {
 	OPT_ALLOCATE_GID,
 	OPT_SET_UID_MAPPING,
 	OPT_SET_GID_MAPPING,
+	OPT_REMOVE_UID_MAPPING,
+	OPT_REMOVE_GID_MAPPING,
 	OPT_SEPARATOR,
 	OPT_LIST_ALL_DOMAINS,
 	OPT_LIST_OWN_DOMAIN,
@@ -1538,6 +1588,8 @@ int main(int argc, char **argv, char **envp)
 		  "Get a new GID out of idmap" },
 		{ "set-uid-mapping", 0, POPT_ARG_STRING, &string_arg, OPT_SET_UID_MAPPING, "Create or modify uid to sid mapping in idmap", "UID,SID" },
 		{ "set-gid-mapping", 0, POPT_ARG_STRING, &string_arg, OPT_SET_GID_MAPPING, "Create or modify gid to sid mapping in idmap", "GID,SID" },
+		{ "remove-uid-mapping", 0, POPT_ARG_STRING, &string_arg, OPT_REMOVE_UID_MAPPING, "Remove uid to sid mapping in idmap", "UID,SID" },
+		{ "remove-gid-mapping", 0, POPT_ARG_STRING, &string_arg, OPT_REMOVE_GID_MAPPING, "Remove gid to sid mapping in idmap", "GID,SID" },
 		{ "check-secret", 't', POPT_ARG_NONE, 0, 't', "Check shared secret" },
 		{ "trusted-domains", 'm', POPT_ARG_NONE, 0, 'm', "List trusted domains" },
 		{ "all-domains", 0, POPT_ARG_NONE, 0, OPT_LIST_ALL_DOMAINS, "List all domains (trusted and own domain)" },
@@ -1726,6 +1778,28 @@ int main(int argc, char **argv, char **envp)
 				goto done;
 			}
 			break;
+		case OPT_REMOVE_UID_MAPPING:
+			if (!parse_mapping_arg(string_arg, &int_subarg,
+				&string_subarg) ||
+			    !wbinfo_remove_uid_mapping(int_subarg,
+				string_subarg))
+			{
+				d_fprintf(stderr, "Could not remove uid to sid "
+				    "mapping\n");
+				goto done;
+			}
+			break;
+		case OPT_REMOVE_GID_MAPPING:
+			if (!parse_mapping_arg(string_arg, &int_subarg,
+			        &string_subarg) ||
+			    !wbinfo_remove_gid_mapping(int_subarg,
+			        string_subarg))
+			{
+				d_fprintf(stderr, "Could not remove gid to sid "
+				    "mapping\n");
+				goto done;
+			}
+			break;
 		case 't':
 			if (!wbinfo_check_secret()) {
 				d_fprintf(stderr, "Could not check secret\n");
-- 
cgit