The branch, v3-3-test has been updated
via b72335fc9771ec815f3a32b6e0d9f5fb9faebc18 (commit)
via 2ebab00716509617f1980beacee09c85b6b13b91 (commit)
via c32dff226aa08dcbd1961bcafa61c0fdff3ecebc (commit)
from 9f168f594e25857bd71bbc97dab25ae6d2884e95 (commit)
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-3-test
- Log -----------------------------------------------------------------
commit b72335fc9771ec815f3a32b6e0d9f5fb9faebc18
Author: Steven Danneman <[EMAIL PROTECTED]>
Date: Mon Oct 27 23:36:36 2008 -0700
[PATCH] Clean-up various trailing space and >80 column lines.
commit 2ebab00716509617f1980beacee09c85b6b13b91
Author: Steven Danneman <[EMAIL PROTECTED]>
Date: Mon Oct 27 23:37:55 2008 -0700
[PATCH] Added ability to remove id mappings in wbinfo and libwbclient.
The idmap_tdb backend already provides an interface to remove existing id
mappings. This commit plumbs that ability up through, winbindd,
libwbclient,
and wbinfo.
Added new winbindd command:
WINBINDD_REMOVE_MAPPING
Added new libwbclient interfaces:
wbcRemoveUidMapping() and wbcRemoveGidMapping()
Added new wbinfo options:
--remove-uid-mapping
--remove-gid-mapping
Increased libwbclient version to 0.2
Increased winbind interface version to 20
commit c32dff226aa08dcbd1961bcafa61c0fdff3ecebc
Author: Steven Danneman <[EMAIL PROTECTED]>
Date: Mon Oct 27 23:46:44 2008 -0700
[PATCH] Added ability to set id mappings in wbinfo.
The two new parameters are:
--set-uid-mapping
--set-gid-mapping
These allow wbinfo to create new, or override existing id mappings in the
idmap backend. These expose the exisiting ability of libwbclient
and winbindd to do this, up through a command line utility.
-----------------------------------------------------------------------
Summary of changes:
source/include/proto.h | 1 +
source/nsswitch/libwbclient/wbc_idmap.c | 86 ++++++++++++++
source/nsswitch/libwbclient/wbclient.c | 2 +-
source/nsswitch/libwbclient/wbclient.h | 13 ++-
source/nsswitch/wb_common.c | 2 +-
source/nsswitch/wbinfo.c | 181 ++++++++++++++++++++++++++++-
source/nsswitch/winbind_struct_protocol.h | 8 +-
source/winbindd/idmap.c | 17 +++
source/winbindd/idmap_tdb.c | 63 +++++++----
source/winbindd/winbindd.c | 3 +-
source/winbindd/winbindd_idmap.c | 63 ++++++++++
source/winbindd/winbindd_proto.h | 6 +
source/winbindd/winbindd_sid.c | 45 +++++++-
13 files changed, 456 insertions(+), 34 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source/include/proto.h b/source/include/proto.h
index f93870d..a147ae5 100644
--- a/source/include/proto.h
+++ b/source/include/proto.h
@@ -10515,6 +10515,7 @@ NTSTATUS idmap_backends_sid_to_unixid(const char
*domname,
NTSTATUS idmap_new_mapping(const struct dom_sid *psid, enum id_type type,
struct unixid *pxid);
NTSTATUS idmap_set_mapping(const struct id_map *map);
+NTSTATUS idmap_remove_mapping(const struct id_map *map);
/* The following definitions come from winbindd/idmap_cache.c */
diff --git a/source/nsswitch/libwbclient/wbc_idmap.c
b/source/nsswitch/libwbclient/wbc_idmap.c
index 1615fd3..6652f67 100644
--- a/source/nsswitch/libwbclient/wbc_idmap.c
+++ b/source/nsswitch/libwbclient/wbc_idmap.c
@@ -362,6 +362,92 @@ wbcErr wbcSetGidMapping(gid_t gid, const struct
wbcDomainSid *sid)
return wbc_status;
}
+/** @brief Remove a user id mapping
+ *
+ * @param uid Uid of the mapping to remove.
+ * @param *sid Pointer to the sid of the mapping to remove.
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcRemoveUidMapping(uid_t uid, const struct wbcDomainSid *sid)
+{
+ struct winbindd_request request;
+ struct winbindd_response response;
+ wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+ char *sid_string = NULL;
+
+ if (!sid) {
+ return WBC_ERR_INVALID_PARAM;
+ }
+
+ /* Initialise request */
+
+ ZERO_STRUCT(request);
+ ZERO_STRUCT(response);
+
+ /* Make request */
+
+ request.data.dual_idmapset.id = uid;
+ request.data.dual_idmapset.type = _ID_TYPE_UID;
+
+ wbc_status = wbcSidToString(sid, &sid_string);
+ BAIL_ON_WBC_ERROR(wbc_status);
+
+ strncpy(request.data.dual_idmapset.sid, sid_string,
+ sizeof(request.data.dual_idmapset.sid)-1);
+ wbcFreeMemory(sid_string);
+
+ wbc_status = wbcRequestResponse(WINBINDD_REMOVE_MAPPING,
+ &request, &response);
+ BAIL_ON_WBC_ERROR(wbc_status);
+
+ done:
+ return wbc_status;
+}
+
+/** @brief Remove a group id mapping
+ *
+ * @param gid Gid of the mapping to remove.
+ * @param *sid Pointer to the sid of the mapping to remove.
+ *
+ * @return #wbcErr
+ **/
+wbcErr wbcRemoveGidMapping(gid_t gid, const struct wbcDomainSid *sid)
+{
+ struct winbindd_request request;
+ struct winbindd_response response;
+ wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+ char *sid_string = NULL;
+
+ if (!sid) {
+ return WBC_ERR_INVALID_PARAM;
+ }
+
+ /* Initialise request */
+
+ ZERO_STRUCT(request);
+ ZERO_STRUCT(response);
+
+ /* Make request */
+
+ request.data.dual_idmapset.id = gid;
+ request.data.dual_idmapset.type = _ID_TYPE_GID;
+
+ wbc_status = wbcSidToString(sid, &sid_string);
+ BAIL_ON_WBC_ERROR(wbc_status);
+
+ strncpy(request.data.dual_idmapset.sid, sid_string,
+ sizeof(request.data.dual_idmapset.sid)-1);
+ wbcFreeMemory(sid_string);
+
+ wbc_status = wbcRequestResponse(WINBINDD_REMOVE_MAPPING,
+ &request, &response);
+ BAIL_ON_WBC_ERROR(wbc_status);
+
+ done:
+ return wbc_status;
+}
+
/** @brief Set the highwater mark for allocated uids.
*
* @param uid_hwm The new uid highwater mark value
diff --git a/source/nsswitch/libwbclient/wbclient.c
b/source/nsswitch/libwbclient/wbclient.c
index bdde562..c0b7e06 100644
--- a/source/nsswitch/libwbclient/wbclient.c
+++ b/source/nsswitch/libwbclient/wbclient.c
@@ -59,7 +59,7 @@ wbcErr wbcRequestResponse(int cmd,
wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
NSS_STATUS nss_status;
- /* for some calls the request and/or response cna be NULL */
+ /* for some calls the request and/or response can be NULL */
nss_status = winbindd_request_response(cmd, request, response);
diff --git a/source/nsswitch/libwbclient/wbclient.h
b/source/nsswitch/libwbclient/wbclient.h
index 797b4d7..b444914 100644
--- a/source/nsswitch/libwbclient/wbclient.h
+++ b/source/nsswitch/libwbclient/wbclient.h
@@ -57,9 +57,12 @@ const char *wbcErrorString(wbcErr error);
/**
* @brief Some useful details about the wbclient library
*
+ * 0.1: Initial version
+ * 0.2: Added wbcRemoveUidMapping()
+ * Added wbcRemoveGidMapping()
**/
#define WBCLIENT_MAJOR_VERSION 0
-#define WBCLIENT_MINOR_VERSION 1
+#define WBCLIENT_MINOR_VERSION 2
#define WBCLIENT_VENDOR_VERSION "Samba libwbclient"
struct wbcLibraryDetails {
uint16_t major_version;
@@ -316,7 +319,7 @@ struct wbcAuthUserInfo {
#define WBC_AUTH_USER_INFO_NOENCRYPTION 0x00000002
#define WBC_AUTH_USER_INFO_CACHED_ACCOUNT 0x00000004
#define WBC_AUTH_USER_INFO_USED_LM_PASSWORD 0x00000008
-#define WBC_AUTH_USER_INFO_EXTRA_SIDS 0x00000020
+#define WBC_AUTH_USER_INFO_EXTRA_SIDS 0x00000020
#define WBC_AUTH_USER_INFO_SUBAUTH_SESSION_KEY 0x00000040
#define WBC_AUTH_USER_INFO_SERVER_TRUST_ACCOUNT 0x00000080
#define WBC_AUTH_USER_INFO_NTLMV2_ENABLED 0x00000100
@@ -343,7 +346,7 @@ struct wbcAuthUserInfo {
#define WBC_ACB_NOT_DELEGATED 0x00004000 /* 1 Not delegated */
#define WBC_ACB_USE_DES_KEY_ONLY 0x00008000 /* 1 Use DES key
only */
#define WBC_ACB_DONT_REQUIRE_PREAUTH 0x00010000 /* 1 Preauth not
required */
-#define WBC_ACB_PW_EXPIRED 0x00020000 /* 1 Password
Expired */
+#define WBC_ACB_PW_EXPIRED 0x00020000 /* 1 Password
Expired */
#define WBC_ACB_NO_AUTH_DATA_REQD 0x00080000 /* 1 = No
authorization data required */
struct wbcAuthErrorInfo {
@@ -503,6 +506,10 @@ wbcErr wbcSetUidMapping(uid_t uid, const struct
wbcDomainSid *sid);
wbcErr wbcSetGidMapping(gid_t gid, const struct wbcDomainSid *sid);
+wbcErr wbcRemoveUidMapping(uid_t uid, const struct wbcDomainSid *sid);
+
+wbcErr wbcRemoveGidMapping(gid_t gid, const struct wbcDomainSid *sid);
+
wbcErr wbcSetUidHwm(uid_t uid_hwm);
wbcErr wbcSetGidHwm(gid_t gid_hwm);
diff --git a/source/nsswitch/wb_common.c b/source/nsswitch/wb_common.c
index 6e6d2bb..a164621 100644
--- a/source/nsswitch/wb_common.c
+++ b/source/nsswitch/wb_common.c
@@ -314,7 +314,7 @@ static int winbind_open_pipe_sock(int recursing, int
need_priv)
if ((need_priv != 0) && (is_privileged == 0)) {
winbind_close_sock();
}
-
+
if (winbindd_fd != -1) {
return winbindd_fd;
}
diff --git a/source/nsswitch/wbinfo.c b/source/nsswitch/wbinfo.c
index 84f01e1..d14cfe9 100644
--- a/source/nsswitch/wbinfo.c
+++ b/source/nsswitch/wbinfo.c
@@ -75,7 +75,7 @@ static char winbind_separator_int(bool strict)
/* HACK: (this module should not call lp_ funtions) */
sep = *lp_winbind_separator();
}
-
+
return sep;
}
@@ -130,6 +130,31 @@ static bool parse_wbinfo_domain_user(const char *domuser,
fstring domain,
return true;
}
+/* Parse string of "uid,sid" or "gid,sid" into separate int and string values.
+ * Return true if input was valid, false otherwise. */
+static bool parse_mapping_arg(char *arg, int *id, char **sid)
+{
+ char *tmp, *endptr;
+
+ if (!arg || !*arg)
+ return false;
+
+ tmp = strtok(arg, ",");
+ *sid = strtok(NULL, ",");
+
+ if (!tmp || !*tmp || !*sid || !**sid)
+ return false;
+
+ /* Because atoi() can return 0 on invalid input, which would be a valid
+ * UID/GID we must use strtol() and do error checking */
+ *id = strtol(tmp, &endptr, 10);
+
+ if (endptr[0] != '\0')
+ return false;
+
+ return true;
+}
+
/* pull pwent info for a given user */
static bool wbinfo_get_userinfo(char *user)
@@ -738,6 +763,102 @@ static bool wbinfo_allocate_gid(void)
return true;
}
+static bool wbinfo_set_uid_mapping(uid_t uid, const char *sid_str)
+{
+ wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+ struct wbcDomainSid sid;
+
+ /* Send request */
+
+ wbc_status = wbcStringToSid(sid_str, &sid);
+ if (!WBC_ERROR_IS_OK(wbc_status)) {
+ return false;
+ }
+
+ wbc_status = wbcSetUidMapping(uid, &sid);
+ if (!WBC_ERROR_IS_OK(wbc_status)) {
+ return false;
+ }
+
+ /* Display response */
+
+ d_printf("uid %d now mapped to sid %s\n", uid, sid_str);
+
+ return true;
+}
+
+static bool wbinfo_set_gid_mapping(gid_t gid, const char *sid_str)
+{
+ wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+ struct wbcDomainSid sid;
+
+ /* Send request */
+
+ wbc_status = wbcStringToSid(sid_str, &sid);
+ if (!WBC_ERROR_IS_OK(wbc_status)) {
+ return false;
+ }
+
+ wbc_status = wbcSetGidMapping(gid, &sid);
+ if (!WBC_ERROR_IS_OK(wbc_status)) {
+ return false;
+ }
+
+ /* Display response */
+
+ d_printf("gid %d now mapped to sid %s\n", gid, sid_str);
+
+ return true;
+}
+
+static bool wbinfo_remove_uid_mapping(uid_t uid, const char *sid_str)
+{
+ wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+ struct wbcDomainSid sid;
+
+ /* Send request */
+
+ wbc_status = wbcStringToSid(sid_str, &sid);
+ if (!WBC_ERROR_IS_OK(wbc_status)) {
+ return false;
+ }
+
+ wbc_status = wbcRemoveUidMapping(uid, &sid);
+ if (!WBC_ERROR_IS_OK(wbc_status)) {
+ return false;
+ }
+
+ /* Display response */
+
+ d_printf("Removed uid %d to sid %s mapping\n", uid, sid_str);
+
+ return true;
+}
+
+static bool wbinfo_remove_gid_mapping(gid_t gid, const char *sid_str)
+{
+ wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+ struct wbcDomainSid sid;
+
+ /* Send request */
+
+ wbc_status = wbcStringToSid(sid_str, &sid);
+ if (!WBC_ERROR_IS_OK(wbc_status)) {
+ return false;
+ }
+
+ wbc_status = wbcRemoveGidMapping(gid, &sid);
+ if (!WBC_ERROR_IS_OK(wbc_status)) {
+ return false;
+ }
+
+ /* Display response */
+
+ d_printf("Removed gid %d to sid %s mapping\n", gid, sid_str);
+
+ return true;
+}
+
/* Convert sid to string */
static bool wbinfo_lookupsid(const char *sid_str)
@@ -1414,6 +1535,10 @@ enum {
OPT_USERSIDS,
OPT_ALLOCATE_UID,
OPT_ALLOCATE_GID,
+ OPT_SET_UID_MAPPING,
+ OPT_SET_GID_MAPPING,
+ OPT_REMOVE_UID_MAPPING,
+ OPT_REMOVE_GID_MAPPING,
OPT_SEPARATOR,
OPT_LIST_ALL_DOMAINS,
OPT_LIST_OWN_DOMAIN,
@@ -1431,8 +1556,10 @@ int main(int argc, char **argv, char **envp)
TALLOC_CTX *frame = talloc_stackframe();
poptContext pc;
static char *string_arg;
+ char *string_subarg = NULL;
static char *opt_domain_name;
static int int_arg;
+ int int_subarg = -1;
int result = 1;
bool verbose = false;
@@ -1459,6 +1586,10 @@ int main(int argc, char **argv, char **envp)
"Get a new UID out of idmap" },
{ "allocate-gid", 0, POPT_ARG_NONE, 0, OPT_ALLOCATE_GID,
"Get a new GID out of idmap" },
+ { "set-uid-mapping", 0, POPT_ARG_STRING, &string_arg,
OPT_SET_UID_MAPPING, "Create or modify uid to sid mapping in idmap", "UID,SID"
},
+ { "set-gid-mapping", 0, POPT_ARG_STRING, &string_arg,
OPT_SET_GID_MAPPING, "Create or modify gid to sid mapping in idmap", "GID,SID"
},
+ { "remove-uid-mapping", 0, POPT_ARG_STRING, &string_arg,
OPT_REMOVE_UID_MAPPING, "Remove uid to sid mapping in idmap", "UID,SID" },
+ { "remove-gid-mapping", 0, POPT_ARG_STRING, &string_arg,
OPT_REMOVE_GID_MAPPING, "Remove gid to sid mapping in idmap", "GID,SID" },
{ "check-secret", 't', POPT_ARG_NONE, 0, 't', "Check shared
secret" },
{ "trusted-domains", 'm', POPT_ARG_NONE, 0, 'm', "List trusted
domains" },
{ "all-domains", 0, POPT_ARG_NONE, 0, OPT_LIST_ALL_DOMAINS,
"List all domains (trusted and own domain)" },
@@ -1473,7 +1604,7 @@ int main(int argc, char **argv, char **envp)
{ "user-domgroups", 0, POPT_ARG_STRING, &string_arg,
OPT_USERDOMGROUPS, "Get user domain groups", "SID" },
{ "user-sids", 0, POPT_ARG_STRING, &string_arg, OPT_USERSIDS,
"Get user group sids for user SID", "SID" },
- { "authenticate", 'a', POPT_ARG_STRING, &string_arg, 'a',
"authenticate user", "user%password" },
+ { "authenticate", 'a', POPT_ARG_STRING, &string_arg, 'a',
"authenticate user", "user%password" },
{ "set-auth-user", 0, POPT_ARG_STRING, &string_arg,
OPT_SET_AUTH_USER, "Store user and password used by winbindd (root only)",
"user%password" },
{ "getdcname", 0, POPT_ARG_STRING, &string_arg, OPT_GETDCNAME,
"Get a DC name for a foreign domain", "domainname" },
@@ -1482,7 +1613,7 @@ int main(int argc, char **argv, char **envp)
{ "ping", 'p', POPT_ARG_NONE, 0, 'p', "Ping winbindd to see if
it is alive" },
{ "domain", 0, POPT_ARG_STRING, &opt_domain_name,
OPT_DOMAIN_NAME, "Define to the domain to restrict operation", "domain" },
#ifdef WITH_FAKE_KASERVER
- { "klog", 'k', POPT_ARG_STRING, &string_arg, 'k', "set an AFS
token from winbind", "user%password" },
+ { "klog", 'k', POPT_ARG_STRING, &string_arg, 'k', "set an AFS
token from winbind", "user%password" },
#endif
#ifdef HAVE_KRB5
{ "krb5auth", 'K', POPT_ARG_STRING, &string_arg, 'K',
"authenticate user using Kerberos", "user%password" },
@@ -1534,7 +1665,7 @@ int main(int argc, char **argv, char **envp)
load_interfaces();
- pc = poptGetContext(NULL, argc, (const char **)argv, long_options,
+ pc = poptGetContext(NULL, argc, (const char **)argv, long_options,
POPT_CONTEXT_KEEP_FIRST);
while((opt = poptGetNextOpt(pc)) != -1) {
@@ -1627,6 +1758,48 @@ int main(int argc, char **argv, char **envp)
goto done;
}
break;
+ case OPT_SET_UID_MAPPING:
+ if (!parse_mapping_arg(string_arg, &int_subarg,
+ &string_subarg) ||
+ !wbinfo_set_uid_mapping(int_subarg, string_subarg))
+ {
+ d_fprintf(stderr, "Could not create or modify "
+ "uid to sid mapping\n");
+ goto done;
+ }
+ break;
+ case OPT_SET_GID_MAPPING:
+ if (!parse_mapping_arg(string_arg, &int_subarg,
+ &string_subarg) ||
+ !wbinfo_set_gid_mapping(int_subarg, string_subarg))
+ {
+ d_fprintf(stderr, "Could not create or modify "
+ "gid to sid mapping\n");
+ goto done;
+ }
+ break;
+ case OPT_REMOVE_UID_MAPPING:
+ if (!parse_mapping_arg(string_arg, &int_subarg,
+ &string_subarg) ||
+ !wbinfo_remove_uid_mapping(int_subarg,
+ string_subarg))
+ {
+ d_fprintf(stderr, "Could not remove uid to sid "
+ "mapping\n");
+ goto done;
+ }
+ break;
+ case OPT_REMOVE_GID_MAPPING:
+ if (!parse_mapping_arg(string_arg, &int_subarg,
+ &string_subarg) ||
+ !wbinfo_remove_gid_mapping(int_subarg,
+ string_subarg))
+ {
+ d_fprintf(stderr, "Could not remove gid to sid "
+ "mapping\n");
+ goto done;
+ }
+ break;
case 't':
if (!wbinfo_check_secret()) {
d_fprintf(stderr, "Could not check secret\n");
diff --git a/source/nsswitch/winbind_struct_protocol.h
b/source/nsswitch/winbind_struct_protocol.h
index 169b4a8..36873f2 100644
--- a/source/nsswitch/winbind_struct_protocol.h
+++ b/source/nsswitch/winbind_struct_protocol.h
@@ -41,7 +41,9 @@
/* Update this when you change the interface. */
-#define WINBIND_INTERFACE_VERSION 19
+/* Version 20: added WINBINDD_REMOVE_MAPPING command */
+
+#define WINBIND_INTERFACE_VERSION 20
/* Have to deal with time_t being 4 or 8 bytes due to structure alignment.
On a 64bit Linux box, we have to support a constant structure size
@@ -95,7 +97,7 @@ enum winbindd_cmd {
/* Lookup functions */
- WINBINDD_SID_TO_UID,
+ WINBINDD_SID_TO_UID,
WINBINDD_SID_TO_GID,
WINBINDD_SIDS_TO_XIDS,
WINBINDD_UID_TO_SID,
@@ -104,6 +106,7 @@ enum winbindd_cmd {
WINBINDD_ALLOCATE_UID,
WINBINDD_ALLOCATE_GID,
WINBINDD_SET_MAPPING,
+ WINBINDD_REMOVE_MAPPING,
WINBINDD_SET_HWM,
/* Miscellaneous other stuff */
@@ -150,6 +153,7 @@ enum winbindd_cmd {
WINBINDD_DUAL_UID2SID,
WINBINDD_DUAL_GID2SID,
WINBINDD_DUAL_SET_MAPPING,
+ WINBINDD_DUAL_REMOVE_MAPPING,
WINBINDD_DUAL_SET_HWM,
/* Wrapper around possibly blocking unix nss calls */
diff --git a/source/winbindd/idmap.c b/source/winbindd/idmap.c
index cfc5597..054df9b 100644
--- a/source/winbindd/idmap.c
+++ b/source/winbindd/idmap.c
@@ -788,3 +788,20 @@ NTSTATUS idmap_set_mapping(const struct id_map *map)
return dom->methods->set_mapping(dom, map);
}
+
+NTSTATUS idmap_remove_mapping(const struct id_map *map)
+{
+ struct idmap_domain *dom;
+
+ dom = idmap_find_domain(NULL);
+ if (dom == NULL) {
+ DEBUG(3, ("no default domain, no place to write\n"));
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ if (dom->methods->remove_mapping == NULL) {
+ DEBUG(3, ("default domain not writable\n"));
+ return NT_STATUS_MEDIA_WRITE_PROTECTED;
--
Samba Shared Repository
