xref: /titanic_41/usr/src/cmd/smbsrv/smbadm/smbadm.c (revision 7206bf49b1fe641544165ee97f63856da95e0868)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
24  */
25 
26 /*
27  * This module contains smbadm CLI which offers smb configuration
28  * functionalities.
29  */
30 #include <errno.h>
31 #include <err.h>
32 #include <ctype.h>
33 #include <stdlib.h>
34 #include <unistd.h>
35 #include <stdio.h>
36 #include <syslog.h>
37 #include <strings.h>
38 #include <limits.h>
39 #include <getopt.h>
40 #include <libintl.h>
41 #include <zone.h>
42 #include <pwd.h>
43 #include <grp.h>
44 #include <libgen.h>
45 #include <netinet/in.h>
46 #include <auth_attr.h>
47 #include <locale.h>
48 #include <smbsrv/libsmb.h>
49 
50 #if !defined(TEXT_DOMAIN)
51 #define	TEXT_DOMAIN "SYS_TEST"
52 #endif
53 
54 typedef enum {
55 	HELP_ADD_MEMBER,
56 	HELP_CREATE,
57 	HELP_DELETE,
58 	HELP_DEL_MEMBER,
59 	HELP_GET,
60 	HELP_JOIN,
61 	HELP_LIST,
62 	HELP_LOOKUP,
63 	HELP_RENAME,
64 	HELP_SET,
65 	HELP_SHOW,
66 	HELP_USER_DISABLE,
67 	HELP_USER_ENABLE
68 } smbadm_help_t;
69 
70 #define	SMBADM_CMDF_NONE	0x00
71 #define	SMBADM_CMDF_USER	0x01
72 #define	SMBADM_CMDF_GROUP	0x02
73 #define	SMBADM_CMDF_TYPEMASK	0x0F
74 
75 typedef enum {
76 	SMBADM_GRP_ADDMEMBER = 0,
77 	SMBADM_GRP_DELMEMBER,
78 } smbadm_grp_action_t;
79 
80 #define	SMBADM_ANSBUFSIZ	64
81 
82 typedef struct smbadm_cmdinfo {
83 	char *name;
84 	int (*func)(int, char **);
85 	smbadm_help_t usage;
86 	uint32_t flags;
87 	char *auth;
88 } smbadm_cmdinfo_t;
89 
90 smbadm_cmdinfo_t *curcmd;
91 static char *progname;
92 
93 #define	SMBADM_ACTION_AUTH	"solaris.smf.manage.smb"
94 #define	SMBADM_VALUE_AUTH	"solaris.smf.value.smb"
95 #define	SMBADM_BASIC_AUTH	"solaris.network.hosts.read"
96 
97 static boolean_t smbadm_checkauth(const char *);
98 
99 static void smbadm_usage(boolean_t);
100 static int smbadm_join_workgroup(const char *);
101 static int smbadm_join_domain(const char *, const char *);
102 static void smbadm_extract_domain(char *, char **, char **);
103 
104 static int smbadm_join(int, char **);
105 static int smbadm_list(int, char **);
106 static int smbadm_lookup(int, char **);
107 static void smbadm_lookup_name(char *);
108 static void smbadm_lookup_sid(char *);
109 static int smbadm_group_create(int, char **);
110 static int smbadm_group_delete(int, char **);
111 static int smbadm_group_rename(int, char **);
112 static int smbadm_group_show(int, char **);
113 static void smbadm_group_show_name(const char *, const char *);
114 static int smbadm_group_getprop(int, char **);
115 static int smbadm_group_setprop(int, char **);
116 static int smbadm_group_addmember(int, char **);
117 static int smbadm_group_delmember(int, char **);
118 static int smbadm_group_add_del_member(char *, char *, smbadm_grp_action_t);
119 
120 static int smbadm_user_disable(int, char **);
121 static int smbadm_user_enable(int, char **);
122 
123 static smbadm_cmdinfo_t smbadm_cmdtable[] =
124 {
125 	{ "add-member",		smbadm_group_addmember,	HELP_ADD_MEMBER,
126 		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
127 	{ "create",		smbadm_group_create,	HELP_CREATE,
128 		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
129 	{ "delete",		smbadm_group_delete,	HELP_DELETE,
130 		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
131 	{ "disable-user",	smbadm_user_disable,	HELP_USER_DISABLE,
132 		SMBADM_CMDF_USER,	SMBADM_ACTION_AUTH },
133 	{ "enable-user",	smbadm_user_enable,	HELP_USER_ENABLE,
134 		SMBADM_CMDF_USER,	SMBADM_ACTION_AUTH },
135 	{ "get",		smbadm_group_getprop,	HELP_GET,
136 		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
137 	{ "join",		smbadm_join,		HELP_JOIN,
138 		SMBADM_CMDF_NONE,	SMBADM_VALUE_AUTH },
139 	{ "list",		smbadm_list,		HELP_LIST,
140 		SMBADM_CMDF_NONE,	SMBADM_BASIC_AUTH },
141 	{ "lookup",		smbadm_lookup,		HELP_LOOKUP,
142 		SMBADM_CMDF_NONE,	SMBADM_BASIC_AUTH },
143 	{ "remove-member",	smbadm_group_delmember,	HELP_DEL_MEMBER,
144 		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
145 	{ "rename",		smbadm_group_rename,	HELP_RENAME,
146 		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
147 	{ "set",		smbadm_group_setprop,	HELP_SET,
148 		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
149 	{ "show",		smbadm_group_show,	HELP_SHOW,
150 		SMBADM_CMDF_GROUP,	SMBADM_ACTION_AUTH },
151 };
152 
153 #define	SMBADM_NCMD	(sizeof (smbadm_cmdtable) / sizeof (smbadm_cmdtable[0]))
154 
155 typedef struct smbadm_prop {
156 	char *p_name;
157 	char *p_value;
158 } smbadm_prop_t;
159 
160 typedef struct smbadm_prop_handle {
161 	char *p_name;
162 	char *p_dispvalue;
163 	int (*p_setfn)(char *, smbadm_prop_t *);
164 	int (*p_getfn)(char *, smbadm_prop_t *);
165 	boolean_t (*p_chkfn)(smbadm_prop_t *);
166 } smbadm_prop_handle_t;
167 
168 static boolean_t smbadm_prop_validate(smbadm_prop_t *prop, boolean_t chkval);
169 static int smbadm_prop_parse(char *arg, smbadm_prop_t *prop);
170 static smbadm_prop_handle_t *smbadm_prop_gethandle(char *pname);
171 
172 static boolean_t smbadm_chkprop_priv(smbadm_prop_t *prop);
173 static int smbadm_setprop_tkowner(char *gname, smbadm_prop_t *prop);
174 static int smbadm_getprop_tkowner(char *gname, smbadm_prop_t *prop);
175 static int smbadm_setprop_backup(char *gname, smbadm_prop_t *prop);
176 static int smbadm_getprop_backup(char *gname, smbadm_prop_t *prop);
177 static int smbadm_setprop_restore(char *gname, smbadm_prop_t *prop);
178 static int smbadm_getprop_restore(char *gname, smbadm_prop_t *prop);
179 static int smbadm_setprop_desc(char *gname, smbadm_prop_t *prop);
180 static int smbadm_getprop_desc(char *gname, smbadm_prop_t *prop);
181 
182 static smbadm_prop_handle_t smbadm_ptable[] = {
183 	{"backup",	"on | off", 	smbadm_setprop_backup,
184 	smbadm_getprop_backup,	smbadm_chkprop_priv 	},
185 	{"restore",	"on | off",	smbadm_setprop_restore,
186 	smbadm_getprop_restore,	smbadm_chkprop_priv	},
187 	{"take-ownership", "on | off",	smbadm_setprop_tkowner,
188 	smbadm_getprop_tkowner,	smbadm_chkprop_priv	},
189 	{"description",	"<string>",	smbadm_setprop_desc,
190 	smbadm_getprop_desc,	NULL			},
191 };
192 
193 static int smbadm_init(void);
194 static void smbadm_fini(void);
195 static const char *smbadm_pwd_strerror(int error);
196 
197 /*
198  * Number of supported properties
199  */
200 #define	SMBADM_NPROP	(sizeof (smbadm_ptable) / sizeof (smbadm_ptable[0]))
201 
202 static void
smbadm_cmdusage(FILE * fp,smbadm_cmdinfo_t * cmd)203 smbadm_cmdusage(FILE *fp, smbadm_cmdinfo_t *cmd)
204 {
205 	switch (cmd->usage) {
206 	case HELP_ADD_MEMBER:
207 		(void) fprintf(fp,
208 		    gettext("\t%s -m member [[-m member] ...] group\n"),
209 		    cmd->name);
210 		return;
211 
212 	case HELP_CREATE:
213 		(void) fprintf(fp, gettext("\t%s [-d description] group\n"),
214 		    cmd->name);
215 		return;
216 
217 	case HELP_DELETE:
218 		(void) fprintf(fp, gettext("\t%s group\n"), cmd->name);
219 		return;
220 
221 	case HELP_USER_DISABLE:
222 	case HELP_USER_ENABLE:
223 		(void) fprintf(fp, gettext("\t%s user\n"), cmd->name);
224 		return;
225 
226 	case HELP_GET:
227 		(void) fprintf(fp, gettext("\t%s [[-p property] ...] group\n"),
228 		    cmd->name);
229 		return;
230 
231 	case HELP_JOIN:
232 #if 0	/* Don't document "-p" yet, still needs work (NX 11960) */
233 		(void) fprintf(fp, gettext("\t%s -p domain\n"
234 		    "\t%s -u username domain\n\t%s -w workgroup\n"),
235 		    cmd->name, cmd->name, cmd->name);
236 #else
237 		(void) fprintf(fp, gettext("\t%s -u username domain\n"
238 		    "\t%s -w workgroup\n"), cmd->name, cmd->name);
239 #endif
240 		return;
241 
242 	case HELP_LIST:
243 		(void) fprintf(fp, gettext("\t%s\n"), cmd->name);
244 		(void) fprintf(fp,
245 		    gettext("\t\t[*] primary domain\n"));
246 		(void) fprintf(fp, gettext("\t\t[.] local domain\n"));
247 		(void) fprintf(fp, gettext("\t\t[-] other domains\n"));
248 		(void) fprintf(fp,
249 		    gettext("\t\t[+] selected domain controller\n"));
250 		return;
251 
252 	case HELP_LOOKUP:
253 		(void) fprintf(fp,
254 		    gettext("\t%s user-or-group-name\n"),
255 		    cmd->name);
256 		return;
257 
258 	case HELP_DEL_MEMBER:
259 		(void) fprintf(fp,
260 		    gettext("\t%s -m member [[-m member] ...] group\n"),
261 		    cmd->name);
262 		return;
263 
264 	case HELP_RENAME:
265 		(void) fprintf(fp, gettext("\t%s group new-group\n"),
266 		    cmd->name);
267 		return;
268 
269 	case HELP_SET:
270 		(void) fprintf(fp, gettext("\t%s -p property=value "
271 		    "[[-p property=value] ...] group\n"), cmd->name);
272 		return;
273 
274 	case HELP_SHOW:
275 		(void) fprintf(fp, gettext("\t%s [-m] [-p] [group]\n"),
276 		    cmd->name);
277 		return;
278 
279 	default:
280 		break;
281 	}
282 
283 	abort();
284 	/* NOTREACHED */
285 }
286 
287 static void
smbadm_usage(boolean_t requested)288 smbadm_usage(boolean_t requested)
289 {
290 	FILE *fp = requested ? stdout : stderr;
291 	boolean_t show_props = B_FALSE;
292 	int i;
293 
294 	if (curcmd == NULL) {
295 		(void) fprintf(fp,
296 		    gettext("usage: %s [-h | <command> [options]]\n"),
297 		    progname);
298 		(void) fprintf(fp,
299 		    gettext("where 'command' is one of the following:\n\n"));
300 
301 		for (i = 0; i < SMBADM_NCMD; i++)
302 			smbadm_cmdusage(fp, &smbadm_cmdtable[i]);
303 
304 		(void) fprintf(fp,
305 		    gettext("\nFor property list, run %s %s|%s\n"),
306 		    progname, "get", "set");
307 
308 		exit(requested ? 0 : 2);
309 	}
310 
311 	(void) fprintf(fp, gettext("usage:\n"));
312 	smbadm_cmdusage(fp, curcmd);
313 
314 	if (strcmp(curcmd->name, "get") == 0 ||
315 	    strcmp(curcmd->name, "set") == 0)
316 		show_props = B_TRUE;
317 
318 	if (show_props) {
319 		(void) fprintf(fp,
320 		    gettext("\nThe following properties are supported:\n"));
321 
322 		(void) fprintf(fp, "\n\t%-16s   %s\n\n",
323 		    "PROPERTY", "VALUES");
324 
325 		for (i = 0; i < SMBADM_NPROP; i++) {
326 			(void) fprintf(fp, "\t%-16s   %s\n",
327 			    smbadm_ptable[i].p_name,
328 			    smbadm_ptable[i].p_dispvalue);
329 		}
330 	}
331 
332 	exit(requested ? 0 : 2);
333 }
334 
335 /*
336  * smbadm_strcasecmplist
337  *
338  * Find a string 's' within a list of strings.
339  *
340  * Returns the index of the matching string or -1 if there is no match.
341  */
342 static int
smbadm_strcasecmplist(const char * s,...)343 smbadm_strcasecmplist(const char *s, ...)
344 {
345 	va_list ap;
346 	char *p;
347 	int ndx;
348 
349 	va_start(ap, s);
350 
351 	for (ndx = 0; ((p = va_arg(ap, char *)) != NULL); ++ndx) {
352 		if (strcasecmp(s, p) == 0) {
353 			va_end(ap);
354 			return (ndx);
355 		}
356 	}
357 
358 	va_end(ap);
359 	return (-1);
360 }
361 
362 /*
363  * smbadm_answer_prompt
364  *
365  * Prompt for the answer to a question.  A default response must be
366  * specified, which will be used if the user presses <enter> without
367  * answering the question.
368  */
369 static int
smbadm_answer_prompt(const char * prompt,char * answer,const char * dflt)370 smbadm_answer_prompt(const char *prompt, char *answer, const char *dflt)
371 {
372 	char buf[SMBADM_ANSBUFSIZ];
373 	char *p;
374 
375 	(void) printf(gettext("%s [%s]: "), prompt, dflt);
376 
377 	if (fgets(buf, SMBADM_ANSBUFSIZ, stdin) == NULL)
378 		return (-1);
379 
380 	if ((p = strchr(buf, '\n')) != NULL)
381 		*p = '\0';
382 
383 	if (*buf == '\0')
384 		(void) strlcpy(answer, dflt, SMBADM_ANSBUFSIZ);
385 	else
386 		(void) strlcpy(answer, buf, SMBADM_ANSBUFSIZ);
387 
388 	return (0);
389 }
390 
391 /*
392  * smbadm_confirm
393  *
394  * Ask a question that requires a yes/no answer.
395  * A default response must be specified.
396  */
397 static boolean_t
smbadm_confirm(const char * prompt,const char * dflt)398 smbadm_confirm(const char *prompt, const char *dflt)
399 {
400 	char buf[SMBADM_ANSBUFSIZ];
401 
402 	for (;;) {
403 		if (smbadm_answer_prompt(prompt, buf, dflt) < 0)
404 			return (B_FALSE);
405 
406 		if (smbadm_strcasecmplist(buf, "n", "no", 0) >= 0)
407 			return (B_FALSE);
408 
409 		if (smbadm_strcasecmplist(buf, "y", "yes", 0) >= 0)
410 			return (B_TRUE);
411 
412 		(void) printf(gettext("Please answer yes or no.\n"));
413 	}
414 }
415 
416 static boolean_t
smbadm_join_prompt(const char * domain)417 smbadm_join_prompt(const char *domain)
418 {
419 	(void) printf(gettext("After joining %s the smb service will be "
420 	    "restarted automatically.\n"), domain);
421 
422 	return (smbadm_confirm("Would you like to continue?", "no"));
423 }
424 
425 static void
smbadm_restart_service(void)426 smbadm_restart_service(void)
427 {
428 	if (smb_smf_restart_service() != 0) {
429 		(void) fprintf(stderr,
430 		    gettext("Unable to restart smb service. "
431 		    "Run 'svcs -xv smb/server' for more information."));
432 	}
433 }
434 
435 /*
436  * smbadm_join
437  *
438  * Join a domain or workgroup.
439  *
440  * When joining a domain, we may receive the username, password and
441  * domain name in any of the following combinations.  Note that the
442  * password is optional on the command line: if it is not provided,
443  * we will prompt for it later.
444  *
445  *	username+password domain
446  *	domain\username+password
447  *	domain/username+password
448  *	username@domain
449  *
450  * We allow domain\name+password or domain/name+password but not
451  * name+password@domain because @ is a valid password character.
452  *
453  * If the username and domain name are passed as separate command
454  * line arguments, we process them directly.  Otherwise we separate
455  * them and continue as if they were separate command line arguments.
456  */
457 static int
smbadm_join(int argc,char ** argv)458 smbadm_join(int argc, char **argv)
459 {
460 	char buf[MAXHOSTNAMELEN * 2];
461 	char *domain = NULL;
462 	char *username = NULL;
463 	uint32_t mode = 0;
464 	char option;
465 
466 	while ((option = getopt(argc, argv, "pu:w")) != -1) {
467 		if (mode != 0) {
468 			(void) fprintf(stderr, gettext(
469 			    "join options are mutually exclusive\n"));
470 			smbadm_usage(B_FALSE);
471 		}
472 		switch (option) {
473 		case 'p':
474 			mode = SMB_SECMODE_DOMAIN;
475 			/* leave username = NULL */
476 			break;
477 
478 		case 'u':
479 			mode = SMB_SECMODE_DOMAIN;
480 			username = optarg;
481 			break;
482 
483 		case 'w':
484 			mode = SMB_SECMODE_WORKGRP;
485 			break;
486 
487 		default:
488 			smbadm_usage(B_FALSE);
489 			break;
490 		}
491 	}
492 
493 	if (optind < argc)
494 		domain = argv[optind];
495 
496 	if (username != NULL && domain == NULL) {
497 		/*
498 		 * The domain was not specified as a separate
499 		 * argument, check for the combination forms.
500 		 */
501 		(void) strlcpy(buf, username, sizeof (buf));
502 		smbadm_extract_domain(buf, &username, &domain);
503 	}
504 
505 	if ((domain == NULL) || (*domain == '\0')) {
506 		(void) fprintf(stderr, gettext("missing %s name\n"),
507 		    (mode == SMB_SECMODE_WORKGRP) ? "workgroup" : "domain");
508 		smbadm_usage(B_FALSE);
509 	}
510 
511 	if (mode == SMB_SECMODE_WORKGRP) {
512 		return (smbadm_join_workgroup(domain));
513 	}
514 	return (smbadm_join_domain(domain, username));
515 }
516 
517 /*
518  * Workgroups comprise a collection of standalone, independently administered
519  * computers that use a common workgroup name.  This is a peer-to-peer model
520  * with no formal membership mechanism.
521  */
522 static int
smbadm_join_workgroup(const char * workgroup)523 smbadm_join_workgroup(const char *workgroup)
524 {
525 	smb_joininfo_t jdi;
526 	uint32_t status;
527 
528 	bzero(&jdi, sizeof (jdi));
529 	jdi.mode = SMB_SECMODE_WORKGRP;
530 	(void) strlcpy(jdi.domain_name, workgroup, sizeof (jdi.domain_name));
531 	(void) strtrim(jdi.domain_name, " \t\n");
532 
533 	if (smb_name_validate_workgroup(jdi.domain_name) != ERROR_SUCCESS) {
534 		(void) fprintf(stderr, gettext("workgroup name is invalid\n"));
535 		smbadm_usage(B_FALSE);
536 	}
537 
538 	if (!smbadm_join_prompt(jdi.domain_name))
539 		return (0);
540 
541 	if ((status = smb_join(&jdi)) != NT_STATUS_SUCCESS) {
542 		(void) fprintf(stderr, gettext("failed to join %s: %s\n"),
543 		    jdi.domain_name, xlate_nt_status(status));
544 		return (1);
545 	}
546 
547 	(void) printf(gettext("Successfully joined %s\n"), jdi.domain_name);
548 	smbadm_restart_service();
549 	return (0);
550 }
551 
552 /*
553  * Domains comprise a centrally administered group of computers and accounts
554  * that share a common security and administration policy and database.
555  * Computers must join a domain and become domain members, which requires
556  * an administrator level account name.
557  *
558  * The '+' character is invalid within a username.  We allow the password
559  * to be appended to the username using '+' as a scripting convenience.
560  */
561 static int
smbadm_join_domain(const char * domain,const char * username)562 smbadm_join_domain(const char *domain, const char *username)
563 {
564 	smb_joininfo_t jdi;
565 	uint32_t status;
566 	char *prompt;
567 	char *p;
568 	int len;
569 
570 	bzero(&jdi, sizeof (jdi));
571 	jdi.mode = SMB_SECMODE_DOMAIN;
572 	(void) strlcpy(jdi.domain_name, domain, sizeof (jdi.domain_name));
573 	(void) strtrim(jdi.domain_name, " \t\n");
574 
575 	if (smb_name_validate_domain(jdi.domain_name) != ERROR_SUCCESS) {
576 		(void) fprintf(stderr, gettext("domain name is invalid\n"));
577 		smbadm_usage(B_FALSE);
578 	}
579 
580 	if (!smbadm_join_prompt(jdi.domain_name))
581 		return (0);
582 
583 	/*
584 	 * Note: username is null for "unsecure join"
585 	 * (join using a pre-created computer account)
586 	 * No password either.
587 	 */
588 	if (username != NULL) {
589 		if ((p = strchr(username, '+')) != NULL) {
590 			++p;
591 
592 			len = (int)(p - username);
593 			if (len > sizeof (jdi.domain_name))
594 				len = sizeof (jdi.domain_name);
595 
596 			(void) strlcpy(jdi.domain_username, username, len);
597 			(void) strlcpy(jdi.domain_passwd, p,
598 			    sizeof (jdi.domain_passwd));
599 		} else {
600 			(void) strlcpy(jdi.domain_username, username,
601 			    sizeof (jdi.domain_username));
602 		}
603 
604 		if (smb_name_validate_account(jdi.domain_username)
605 		    != ERROR_SUCCESS) {
606 			(void) fprintf(stderr,
607 			    gettext("username contains invalid characters\n"));
608 			smbadm_usage(B_FALSE);
609 		}
610 
611 		if (*jdi.domain_passwd == '\0') {
612 			prompt = gettext("Enter domain password: ");
613 
614 			if ((p = getpassphrase(prompt)) == NULL) {
615 				(void) fprintf(stderr, gettext(
616 				    "missing password\n"));
617 				smbadm_usage(B_FALSE);
618 			}
619 
620 			(void) strlcpy(jdi.domain_passwd, p,
621 			    sizeof (jdi.domain_passwd));
622 		}
623 	}
624 
625 	(void) printf(gettext("Joining %s ... this may take a minute ...\n"),
626 	    jdi.domain_name);
627 
628 	status = smb_join(&jdi);
629 
630 	switch (status) {
631 	case NT_STATUS_SUCCESS:
632 		(void) printf(gettext("Successfully joined %s\n"),
633 		    jdi.domain_name);
634 		bzero(&jdi, sizeof (jdi));
635 		smbadm_restart_service();
636 		return (0);
637 
638 	case NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND:
639 		(void) fprintf(stderr,
640 		    gettext("failed to find any domain controllers for %s\n"),
641 		    jdi.domain_name);
642 		bzero(&jdi, sizeof (jdi));
643 		return (1);
644 
645 	case NT_STATUS_BAD_NETWORK_PATH:
646 		(void) fprintf(stderr,
647 		    gettext("failed to resolve domain controller name\n"));
648 		bzero(&jdi, sizeof (jdi));
649 		return (1);
650 
651 	case NT_STATUS_NETWORK_ACCESS_DENIED:
652 	case NT_STATUS_BAD_NETWORK_NAME:
653 		(void) fprintf(stderr,
654 		    gettext("failed connecting to domain controller\n"));
655 		bzero(&jdi, sizeof (jdi));
656 		return (1);
657 
658 	default:
659 		(void) fprintf(stderr, gettext("failed to join %s: %s\n"),
660 		    jdi.domain_name, xlate_nt_status(status));
661 		(void) fprintf(stderr, gettext("Please refer to the system log"
662 		    " for more information.\n"));
663 		bzero(&jdi, sizeof (jdi));
664 		return (1);
665 	}
666 }
667 
668 /*
669  * We want to process the user and domain names as separate strings.
670  * Check for names of the forms below and separate the components as
671  * required.
672  *
673  *	name@domain
674  *	domain\name
675  *	domain/name
676  *
677  * If we encounter any of the forms above in arg, the @, / or \
678  * separator is replaced by \0 and the username and domain pointers
679  * are changed to point to the appropriate components (in arg).
680  *
681  * If none of the separators are encountered, the username and domain
682  * pointers remain unchanged.
683  */
684 static void
smbadm_extract_domain(char * arg,char ** username,char ** domain)685 smbadm_extract_domain(char *arg, char **username, char **domain)
686 {
687 	char *p;
688 
689 	if ((p = strpbrk(arg, "/\\@")) != NULL) {
690 		if (*p == '@') {
691 			*p = '\0';
692 			++p;
693 
694 			if (strchr(arg, '+') != NULL)
695 				return;
696 
697 			*domain = p;
698 			*username = arg;
699 		} else {
700 			*p = '\0';
701 			++p;
702 			*username = p;
703 			*domain = arg;
704 		}
705 	}
706 }
707 
708 /*
709  * smbadm_list
710  *
711  * Displays current security mode and domain/workgroup name.
712  */
713 /*ARGSUSED*/
714 static int
smbadm_list(int argc,char ** argv)715 smbadm_list(int argc, char **argv)
716 {
717 	char domain[MAXHOSTNAMELEN];
718 	char fqdn[MAXHOSTNAMELEN];
719 	char srvname[MAXHOSTNAMELEN];
720 	char modename[16];
721 	int rc;
722 	smb_inaddr_t srvipaddr;
723 	char ipstr[INET6_ADDRSTRLEN];
724 
725 	rc = smb_config_getstr(SMB_CI_SECURITY, modename, sizeof (modename));
726 	if (rc != SMBD_SMF_OK) {
727 		(void) fprintf(stderr,
728 		    gettext("cannot determine the operational mode\n"));
729 		return (1);
730 	}
731 
732 	if (smb_getdomainname(domain, sizeof (domain)) != 0) {
733 		(void) fprintf(stderr, gettext("failed to get the %s name\n"),
734 		    modename);
735 		return (1);
736 	}
737 
738 	if (strcmp(modename, "workgroup") == 0) {
739 		(void) printf(gettext("[*] [%s]\n"), domain);
740 		return (0);
741 	}
742 
743 	(void) printf(gettext("[*] [%s]\n"), domain);
744 	if ((smb_getfqdomainname(fqdn, sizeof (fqdn)) == 0) && (*fqdn != '\0'))
745 		(void) printf(gettext("[*] [%s]\n"), fqdn);
746 
747 	if ((smb_get_dcinfo(srvname, MAXHOSTNAMELEN, &srvipaddr)
748 	    == NT_STATUS_SUCCESS) && (*srvname != '\0') &&
749 	    (!smb_inet_iszero(&srvipaddr))) {
750 		(void) smb_inet_ntop(&srvipaddr, ipstr,
751 		    SMB_IPSTRLEN(srvipaddr.a_family));
752 		(void) printf(gettext("\t[+%s.%s] [%s]\n"),
753 		    srvname, fqdn, ipstr);
754 	}
755 
756 	smb_domain_show();
757 	return (0);
758 }
759 
760 /*
761  * smbadm_lookup
762  *
763  * Lookup the SID for a given account (user or group)
764  */
765 static int
smbadm_lookup(int argc,char ** argv)766 smbadm_lookup(int argc, char **argv)
767 {
768 	int i;
769 
770 	if (argc < 2) {
771 		(void) fprintf(stderr, gettext("missing account name\n"));
772 		smbadm_usage(B_FALSE);
773 	}
774 
775 	for (i = 1; i < argc; i++) {
776 		if (strncmp(argv[i], "S-1-", 4) == 0)
777 			smbadm_lookup_sid(argv[i]);
778 		else
779 			smbadm_lookup_name(argv[i]);
780 	}
781 	return (0);
782 }
783 
784 static void
smbadm_lookup_name(char * name)785 smbadm_lookup_name(char *name)
786 {
787 	lsa_account_t	acct;
788 	int rc;
789 
790 	if ((rc = smb_lookup_name(name, SidTypeUnknown, &acct)) != 0) {
791 		(void) fprintf(stderr, gettext(
792 		    "\t\t%s: lookup name failed, rc=%d\n"),
793 		    name, rc);
794 		return;
795 	}
796 	if (acct.a_status != NT_STATUS_SUCCESS) {
797 		(void) fprintf(stderr, gettext("\t\t%s [%s]\n"),
798 		    name, xlate_nt_status(acct.a_status));
799 		return;
800 	}
801 	(void) printf("\t%s\n", acct.a_sid);
802 }
803 
804 static void
smbadm_lookup_sid(char * sidstr)805 smbadm_lookup_sid(char *sidstr)
806 {
807 	lsa_account_t	acct;
808 	int rc;
809 
810 	if ((rc = smb_lookup_sid(sidstr, &acct)) != 0) {
811 		(void) fprintf(stderr, gettext(
812 		    "\t\t%s: lookup SID failed, rc=%d\n"),
813 		    sidstr, rc);
814 		return;
815 	}
816 	if (acct.a_status != NT_STATUS_SUCCESS) {
817 		(void) fprintf(stderr, gettext("\t\t%s [%s]\n"),
818 		    sidstr, xlate_nt_status(acct.a_status));
819 		return;
820 	}
821 	(void) printf("\t%s\\%s\n", acct.a_domain, acct.a_name);
822 }
823 
824 /*
825  * smbadm_group_create
826  *
827  * Creates a local SMB group
828  */
829 static int
smbadm_group_create(int argc,char ** argv)830 smbadm_group_create(int argc, char **argv)
831 {
832 	char *gname = NULL;
833 	char *desc = NULL;
834 	char option;
835 	int status;
836 
837 	while ((option = getopt(argc, argv, "d:")) != -1) {
838 		switch (option) {
839 		case 'd':
840 			desc = optarg;
841 			break;
842 
843 		default:
844 			smbadm_usage(B_FALSE);
845 		}
846 	}
847 
848 	gname = argv[optind];
849 	if (optind >= argc || gname == NULL || *gname == '\0') {
850 		(void) fprintf(stderr, gettext("missing group name\n"));
851 		smbadm_usage(B_FALSE);
852 	}
853 
854 	status = smb_lgrp_add(gname, desc);
855 	if (status != SMB_LGRP_SUCCESS) {
856 		(void) fprintf(stderr,
857 		    gettext("failed to create %s (%s)\n"), gname,
858 		    smb_lgrp_strerror(status));
859 	} else {
860 		(void) printf(gettext("%s created\n"), gname);
861 	}
862 
863 	return (status);
864 }
865 
866 /*
867  * smbadm_group_dump_members
868  *
869  * Dump group members details.
870  */
871 static void
smbadm_group_dump_members(smb_gsid_t * members,int num)872 smbadm_group_dump_members(smb_gsid_t *members, int num)
873 {
874 	char		sidstr[SMB_SID_STRSZ];
875 	lsa_account_t	acct;
876 	int		i;
877 
878 	if (num == 0) {
879 		(void) printf(gettext("\tNo members\n"));
880 		return;
881 	}
882 
883 	(void) printf(gettext("\tMembers:\n"));
884 	for (i = 0; i < num; i++) {
885 		smb_sid_tostr(members[i].gs_sid, sidstr);
886 
887 		if (smb_lookup_sid(sidstr, &acct) == 0) {
888 			if (acct.a_status == NT_STATUS_SUCCESS)
889 				smbadm_group_show_name(acct.a_domain,
890 				    acct.a_name);
891 			else
892 				(void) printf(gettext("\t\t%s [%s]\n"),
893 				    sidstr, xlate_nt_status(acct.a_status));
894 		} else {
895 			(void) printf(gettext("\t\t%s\n"), sidstr);
896 		}
897 	}
898 }
899 
900 static void
smbadm_group_show_name(const char * domain,const char * name)901 smbadm_group_show_name(const char *domain, const char *name)
902 {
903 	if (strchr(domain, '.') != NULL)
904 		(void) printf("\t\t%s@%s\n", name, domain);
905 	else
906 		(void) printf("\t\t%s\\%s\n", domain, name);
907 }
908 
909 /*
910  * smbadm_group_dump_privs
911  *
912  * Dump group privilege details.
913  */
914 static void
smbadm_group_dump_privs(smb_privset_t * privs)915 smbadm_group_dump_privs(smb_privset_t *privs)
916 {
917 	smb_privinfo_t *pinfo;
918 	char *pstatus;
919 	int i;
920 
921 	(void) printf(gettext("\tPrivileges: \n"));
922 
923 	for (i = 0; i < privs->priv_cnt; i++) {
924 		pinfo = smb_priv_getbyvalue(privs->priv[i].luid.lo_part);
925 		if ((pinfo == NULL) || (pinfo->flags & PF_PRESENTABLE) == 0)
926 			continue;
927 
928 		switch (privs->priv[i].attrs) {
929 		case SE_PRIVILEGE_ENABLED:
930 			pstatus = "On";
931 			break;
932 		case SE_PRIVILEGE_DISABLED:
933 			pstatus = "Off";
934 			break;
935 		default:
936 			pstatus = "Unknown";
937 			break;
938 		}
939 		(void) printf(gettext("\t\t%s: %s\n"), pinfo->name, pstatus);
940 	}
941 
942 	if (privs->priv_cnt == 0)
943 		(void) printf(gettext("\t\tNo privileges\n"));
944 }
945 
946 /*
947  * smbadm_group_dump
948  *
949  * Dump group details.
950  */
951 static void
smbadm_group_dump(smb_group_t * grp,boolean_t show_mem,boolean_t show_privs)952 smbadm_group_dump(smb_group_t *grp, boolean_t show_mem, boolean_t show_privs)
953 {
954 	char sidstr[SMB_SID_STRSZ];
955 
956 	(void) printf(gettext("%s (%s)\n"), grp->sg_name, grp->sg_cmnt);
957 
958 	smb_sid_tostr(grp->sg_id.gs_sid, sidstr);
959 	(void) printf(gettext("\tSID: %s\n"), sidstr);
960 
961 	if (show_privs)
962 		smbadm_group_dump_privs(grp->sg_privs);
963 
964 	if (show_mem)
965 		smbadm_group_dump_members(grp->sg_members, grp->sg_nmembers);
966 }
967 
968 /*
969  * smbadm_group_show
970  *
971  */
972 static int
smbadm_group_show(int argc,char ** argv)973 smbadm_group_show(int argc, char **argv)
974 {
975 	char *gname = NULL;
976 	boolean_t show_privs;
977 	boolean_t show_members;
978 	char option;
979 	int status;
980 	smb_group_t grp;
981 	smb_giter_t gi;
982 
983 	show_privs = show_members = B_FALSE;
984 
985 	while ((option = getopt(argc, argv, "mp")) != -1) {
986 		switch (option) {
987 		case 'm':
988 			show_members = B_TRUE;
989 			break;
990 		case 'p':
991 			show_privs = B_TRUE;
992 			break;
993 
994 		default:
995 			smbadm_usage(B_FALSE);
996 		}
997 	}
998 
999 	gname = argv[optind];
1000 	if (optind >= argc || gname == NULL || *gname == '\0')
1001 		gname = "*";
1002 
1003 	if (strcmp(gname, "*")) {
1004 		status = smb_lgrp_getbyname(gname, &grp);
1005 		if (status == SMB_LGRP_SUCCESS) {
1006 			smbadm_group_dump(&grp, show_members, show_privs);
1007 			smb_lgrp_free(&grp);
1008 		} else {
1009 			(void) fprintf(stderr,
1010 			    gettext("failed to find %s (%s)\n"),
1011 			    gname, smb_lgrp_strerror(status));
1012 		}
1013 		return (status);
1014 	}
1015 
1016 	if ((status = smb_lgrp_iteropen(&gi)) != SMB_LGRP_SUCCESS) {
1017 		(void) fprintf(stderr, gettext("failed to list groups (%s)\n"),
1018 		    smb_lgrp_strerror(status));
1019 		return (status);
1020 	}
1021 
1022 	while ((status = smb_lgrp_iterate(&gi, &grp)) == SMB_LGRP_SUCCESS) {
1023 		smbadm_group_dump(&grp, show_members, show_privs);
1024 		smb_lgrp_free(&grp);
1025 	}
1026 
1027 	smb_lgrp_iterclose(&gi);
1028 
1029 	if ((status != SMB_LGRP_NO_MORE) || smb_lgrp_itererror(&gi)) {
1030 		if (status != SMB_LGRP_NO_MORE)
1031 			smb_syslog(LOG_ERR, "smb_lgrp_iterate: %s",
1032 			    smb_lgrp_strerror(status));
1033 
1034 		(void) fprintf(stderr,
1035 		    gettext("\nAn error occurred while retrieving group data.\n"
1036 		    "Check the system log for more information.\n"));
1037 		return (status);
1038 	}
1039 
1040 	return (0);
1041 }
1042 
1043 /*
1044  * smbadm_group_delete
1045  */
1046 static int
smbadm_group_delete(int argc,char ** argv)1047 smbadm_group_delete(int argc, char **argv)
1048 {
1049 	char *gname = NULL;
1050 	int status;
1051 
1052 	gname = argv[optind];
1053 	if (optind >= argc || gname == NULL || *gname == '\0') {
1054 		(void) fprintf(stderr, gettext("missing group name\n"));
1055 		smbadm_usage(B_FALSE);
1056 	}
1057 
1058 	status = smb_lgrp_delete(gname);
1059 	if (status != SMB_LGRP_SUCCESS) {
1060 		(void) fprintf(stderr,
1061 		    gettext("failed to delete %s (%s)\n"), gname,
1062 		    smb_lgrp_strerror(status));
1063 	} else {
1064 		(void) printf(gettext("%s deleted\n"), gname);
1065 	}
1066 
1067 	return (status);
1068 }
1069 
1070 /*
1071  * smbadm_group_rename
1072  */
1073 static int
smbadm_group_rename(int argc,char ** argv)1074 smbadm_group_rename(int argc, char **argv)
1075 {
1076 	char *gname = NULL;
1077 	char *ngname = NULL;
1078 	int status;
1079 
1080 	gname = argv[optind];
1081 	if (optind++ >= argc || gname == NULL || *gname == '\0') {
1082 		(void) fprintf(stderr, gettext("missing group name\n"));
1083 		smbadm_usage(B_FALSE);
1084 	}
1085 
1086 	ngname = argv[optind];
1087 	if (optind >= argc || ngname == NULL || *ngname == '\0') {
1088 		(void) fprintf(stderr, gettext("missing new group name\n"));
1089 		smbadm_usage(B_FALSE);
1090 	}
1091 
1092 	status = smb_lgrp_rename(gname, ngname);
1093 	if (status != SMB_LGRP_SUCCESS) {
1094 		if (status == SMB_LGRP_EXISTS)
1095 			(void) fprintf(stderr,
1096 			    gettext("failed to rename '%s' (%s already "
1097 			    "exists)\n"), gname, ngname);
1098 		else
1099 			(void) fprintf(stderr,
1100 			    gettext("failed to rename '%s' (%s)\n"), gname,
1101 			    smb_lgrp_strerror(status));
1102 	} else {
1103 		(void) printf(gettext("'%s' renamed to '%s'\n"), gname, ngname);
1104 	}
1105 
1106 	return (status);
1107 }
1108 
1109 /*
1110  * smbadm_group_setprop
1111  *
1112  * Set the group properties.
1113  */
1114 static int
smbadm_group_setprop(int argc,char ** argv)1115 smbadm_group_setprop(int argc, char **argv)
1116 {
1117 	char *gname = NULL;
1118 	smbadm_prop_t props[SMBADM_NPROP];
1119 	smbadm_prop_handle_t *phandle;
1120 	char option;
1121 	int pcnt = 0;
1122 	int ret;
1123 	int p;
1124 
1125 	bzero(props, SMBADM_NPROP * sizeof (smbadm_prop_t));
1126 
1127 	while ((option = getopt(argc, argv, "p:")) != -1) {
1128 		switch (option) {
1129 		case 'p':
1130 			if (pcnt >= SMBADM_NPROP) {
1131 				(void) fprintf(stderr,
1132 				    gettext("exceeded number of supported"
1133 				    " properties\n"));
1134 				smbadm_usage(B_FALSE);
1135 			}
1136 
1137 			if (smbadm_prop_parse(optarg, &props[pcnt++]) != 0)
1138 				smbadm_usage(B_FALSE);
1139 			break;
1140 
1141 		default:
1142 			smbadm_usage(B_FALSE);
1143 		}
1144 	}
1145 
1146 	if (pcnt == 0) {
1147 		(void) fprintf(stderr,
1148 		    gettext("missing property=value argument\n"));
1149 		smbadm_usage(B_FALSE);
1150 	}
1151 
1152 	gname = argv[optind];
1153 	if (optind >= argc || gname == NULL || *gname == '\0') {
1154 		(void) fprintf(stderr, gettext("missing group name\n"));
1155 		smbadm_usage(B_FALSE);
1156 	}
1157 
1158 	for (p = 0; p < pcnt; p++) {
1159 		phandle = smbadm_prop_gethandle(props[p].p_name);
1160 		if (phandle) {
1161 			if (phandle->p_setfn(gname, &props[p]) != 0)
1162 				ret = 1;
1163 		}
1164 	}
1165 
1166 	return (ret);
1167 }
1168 
1169 /*
1170  * smbadm_group_getprop
1171  *
1172  * Get the group properties.
1173  */
1174 static int
smbadm_group_getprop(int argc,char ** argv)1175 smbadm_group_getprop(int argc, char **argv)
1176 {
1177 	char *gname = NULL;
1178 	smbadm_prop_t props[SMBADM_NPROP];
1179 	smbadm_prop_handle_t *phandle;
1180 	char option;
1181 	int pcnt = 0;
1182 	int ret;
1183 	int p;
1184 
1185 	bzero(props, SMBADM_NPROP * sizeof (smbadm_prop_t));
1186 
1187 	while ((option = getopt(argc, argv, "p:")) != -1) {
1188 		switch (option) {
1189 		case 'p':
1190 			if (pcnt >= SMBADM_NPROP) {
1191 				(void) fprintf(stderr,
1192 				    gettext("exceeded number of supported"
1193 				    " properties\n"));
1194 				smbadm_usage(B_FALSE);
1195 			}
1196 
1197 			if (smbadm_prop_parse(optarg, &props[pcnt++]) != 0)
1198 				smbadm_usage(B_FALSE);
1199 			break;
1200 
1201 		default:
1202 			smbadm_usage(B_FALSE);
1203 		}
1204 	}
1205 
1206 	gname = argv[optind];
1207 	if (optind >= argc || gname == NULL || *gname == '\0') {
1208 		(void) fprintf(stderr, gettext("missing group name\n"));
1209 		smbadm_usage(B_FALSE);
1210 	}
1211 
1212 	if (pcnt == 0) {
1213 		/*
1214 		 * If no property has be specified then get
1215 		 * all the properties.
1216 		 */
1217 		pcnt = SMBADM_NPROP;
1218 		for (p = 0; p < pcnt; p++)
1219 			props[p].p_name = smbadm_ptable[p].p_name;
1220 	}
1221 
1222 	for (p = 0; p < pcnt; p++) {
1223 		phandle = smbadm_prop_gethandle(props[p].p_name);
1224 		if (phandle) {
1225 			if (phandle->p_getfn(gname, &props[p]) != 0)
1226 				ret = 1;
1227 		}
1228 	}
1229 
1230 	return (ret);
1231 }
1232 
1233 /*
1234  * smbadm_group_addmember
1235  *
1236  */
1237 static int
smbadm_group_addmember(int argc,char ** argv)1238 smbadm_group_addmember(int argc, char **argv)
1239 {
1240 	char *gname = NULL;
1241 	char **mname;
1242 	char option;
1243 	int mcnt = 0;
1244 	int ret = 0;
1245 	int i;
1246 
1247 
1248 	mname = (char **)malloc(argc * sizeof (char *));
1249 	if (mname == NULL) {
1250 		warn(gettext("failed to add group member"));
1251 		return (1);
1252 	}
1253 	bzero(mname, argc * sizeof (char *));
1254 
1255 	while ((option = getopt(argc, argv, "m:")) != -1) {
1256 		switch (option) {
1257 		case 'm':
1258 			mname[mcnt++] = optarg;
1259 			break;
1260 
1261 		default:
1262 			free(mname);
1263 			smbadm_usage(B_FALSE);
1264 		}
1265 	}
1266 
1267 	if (mcnt == 0) {
1268 		(void) fprintf(stderr, gettext("missing member name\n"));
1269 		free(mname);
1270 		smbadm_usage(B_FALSE);
1271 	}
1272 
1273 	gname = argv[optind];
1274 	if (optind >= argc || gname == NULL || *gname == 0) {
1275 		(void) fprintf(stderr, gettext("missing group name\n"));
1276 		free(mname);
1277 		smbadm_usage(B_FALSE);
1278 	}
1279 
1280 	for (i = 0; i < mcnt; i++) {
1281 		if (mname[i] == NULL)
1282 			continue;
1283 		ret |= smbadm_group_add_del_member(
1284 		    gname, mname[i], SMBADM_GRP_ADDMEMBER);
1285 	}
1286 
1287 	free(mname);
1288 	return (ret);
1289 }
1290 
1291 /*
1292  * smbadm_group_delmember
1293  */
1294 static int
smbadm_group_delmember(int argc,char ** argv)1295 smbadm_group_delmember(int argc, char **argv)
1296 {
1297 	char *gname = NULL;
1298 	char **mname;
1299 	char option;
1300 	int mcnt = 0;
1301 	int ret = 0;
1302 	int i;
1303 
1304 	mname = (char **)malloc(argc * sizeof (char *));
1305 	if (mname == NULL) {
1306 		warn(gettext("failed to delete group member"));
1307 		return (1);
1308 	}
1309 	bzero(mname, argc * sizeof (char *));
1310 
1311 	while ((option = getopt(argc, argv, "m:")) != -1) {
1312 		switch (option) {
1313 		case 'm':
1314 			mname[mcnt++] = optarg;
1315 			break;
1316 
1317 		default:
1318 			free(mname);
1319 			smbadm_usage(B_FALSE);
1320 		}
1321 	}
1322 
1323 	if (mcnt == 0) {
1324 		(void) fprintf(stderr, gettext("missing member name\n"));
1325 		free(mname);
1326 		smbadm_usage(B_FALSE);
1327 	}
1328 
1329 	gname = argv[optind];
1330 	if (optind >= argc || gname == NULL || *gname == 0) {
1331 		(void) fprintf(stderr, gettext("missing group name\n"));
1332 		free(mname);
1333 		smbadm_usage(B_FALSE);
1334 	}
1335 
1336 
1337 	for (i = 0; i < mcnt; i++) {
1338 		ret = 0;
1339 		if (mname[i] == NULL)
1340 			continue;
1341 		ret |= smbadm_group_add_del_member(
1342 		    gname, mname[i], SMBADM_GRP_DELMEMBER);
1343 	}
1344 
1345 	free(mname);
1346 	return (ret);
1347 }
1348 
1349 static int
smbadm_group_add_del_member(char * gname,char * mname,smbadm_grp_action_t act)1350 smbadm_group_add_del_member(char *gname, char *mname,
1351 	smbadm_grp_action_t act)
1352 {
1353 	lsa_account_t	acct;
1354 	smb_gsid_t msid;
1355 	char *sidstr;
1356 	char *act_str;
1357 	int rc;
1358 
1359 	if (strncmp(mname, "S-1-", 4) == 0) {
1360 		/*
1361 		 * We are given a SID.  Just use it.
1362 		 *
1363 		 * We'e like the real account type if we can get it,
1364 		 * but don't want to error out if we can't get it.
1365 		 */
1366 		sidstr = mname;
1367 		rc = smb_lookup_sid(sidstr, &acct);
1368 		if ((rc != 0) || (acct.a_status != NT_STATUS_SUCCESS))
1369 			acct.a_sidtype = SidTypeUnknown;
1370 	} else {
1371 		rc = smb_lookup_name(mname, SidTypeUnknown, &acct);
1372 		if ((rc != 0) || (acct.a_status != NT_STATUS_SUCCESS)) {
1373 			(void) fprintf(stderr,
1374 			    gettext("%s: name lookup failed\n"), mname);
1375 			return (1);
1376 		}
1377 		sidstr = acct.a_sid;
1378 	}
1379 
1380 	msid.gs_type = acct.a_sidtype;
1381 	if ((msid.gs_sid = smb_sid_fromstr(sidstr)) == NULL) {
1382 		(void) fprintf(stderr,
1383 		    gettext("%s: no memory for SID\n"), sidstr);
1384 		return (1);
1385 	}
1386 
1387 	switch (act) {
1388 	case SMBADM_GRP_ADDMEMBER:
1389 		act_str = gettext("add");
1390 		rc = smb_lgrp_add_member(gname,
1391 		    msid.gs_sid, msid.gs_type);
1392 		break;
1393 	case SMBADM_GRP_DELMEMBER:
1394 		act_str = gettext("remove");
1395 		rc = smb_lgrp_del_member(gname,
1396 		    msid.gs_sid, msid.gs_type);
1397 		break;
1398 	default:
1399 		rc = SMB_LGRP_INTERNAL_ERROR;
1400 		break;
1401 	}
1402 
1403 	smb_sid_free(msid.gs_sid);
1404 
1405 	if (rc != SMB_LGRP_SUCCESS) {
1406 		(void) fprintf(stderr,
1407 		    gettext("failed to %s %s (%s)\n"),
1408 		    act_str, mname, smb_lgrp_strerror(rc));
1409 		return (1);
1410 	}
1411 	return (0);
1412 }
1413 
1414 static int
smbadm_user_disable(int argc,char ** argv)1415 smbadm_user_disable(int argc, char **argv)
1416 {
1417 	int error;
1418 	char *user = NULL;
1419 
1420 	user = argv[optind];
1421 	if (optind >= argc || user == NULL || *user == '\0') {
1422 		(void) fprintf(stderr, gettext("missing user name\n"));
1423 		smbadm_usage(B_FALSE);
1424 	}
1425 
1426 	error = smb_pwd_setcntl(user, SMB_PWC_DISABLE);
1427 	if (error == SMB_PWE_SUCCESS)
1428 		(void) printf(gettext("%s is disabled.\n"), user);
1429 	else
1430 		(void) fprintf(stderr, "%s\n", smbadm_pwd_strerror(error));
1431 
1432 	return (error);
1433 }
1434 
1435 static int
smbadm_user_enable(int argc,char ** argv)1436 smbadm_user_enable(int argc, char **argv)
1437 {
1438 	int error;
1439 	char *user = NULL;
1440 
1441 	user = argv[optind];
1442 	if (optind >= argc || user == NULL || *user == '\0') {
1443 		(void) fprintf(stderr, gettext("missing user name\n"));
1444 		smbadm_usage(B_FALSE);
1445 	}
1446 
1447 	error = smb_pwd_setcntl(user, SMB_PWC_ENABLE);
1448 	if (error == SMB_PWE_SUCCESS)
1449 		(void) printf(gettext("%s is enabled.\n"), user);
1450 	else
1451 		(void) fprintf(stderr, "%s\n", smbadm_pwd_strerror(error));
1452 
1453 	return (error);
1454 }
1455 
1456 
1457 int
main(int argc,char ** argv)1458 main(int argc, char **argv)
1459 {
1460 	int ret;
1461 	int i;
1462 
1463 	(void) setlocale(LC_ALL, "");
1464 	(void) textdomain(TEXT_DOMAIN);
1465 
1466 	(void) malloc(0);	/* satisfy libumem dependency */
1467 
1468 	progname = basename(argv[0]);
1469 
1470 	if (is_system_labeled()) {
1471 		(void) fprintf(stderr,
1472 		    gettext("Trusted Extensions not supported\n"));
1473 		return (1);
1474 	}
1475 
1476 	if (argc < 2) {
1477 		(void) fprintf(stderr, gettext("missing command\n"));
1478 		smbadm_usage(B_FALSE);
1479 	}
1480 
1481 	/*
1482 	 * Special case "cmd --help/-?"
1483 	 */
1484 	if (strcmp(argv[1], "-?") == 0 ||
1485 	    strcmp(argv[1], "--help") == 0 ||
1486 	    strcmp(argv[1], "-h") == 0)
1487 		smbadm_usage(B_TRUE);
1488 
1489 	for (i = 0; i < SMBADM_NCMD; ++i) {
1490 		curcmd = &smbadm_cmdtable[i];
1491 		if (strcasecmp(argv[1], curcmd->name) == 0) {
1492 			if (argc > 2) {
1493 				/* cmd subcmd --help/-? */
1494 				if (strcmp(argv[2], "-?") == 0 ||
1495 				    strcmp(argv[2], "--help") == 0 ||
1496 				    strcmp(argv[2], "-h") == 0)
1497 					smbadm_usage(B_TRUE);
1498 			}
1499 
1500 			if (!smbadm_checkauth(curcmd->auth)) {
1501 				(void) fprintf(stderr,
1502 				    gettext("%s: %s: authorization denied\n"),
1503 				    progname, curcmd->name);
1504 				return (1);
1505 			}
1506 
1507 			if ((ret = smbadm_init()) != 0)
1508 				return (ret);
1509 
1510 			ret = curcmd->func(argc - 1, &argv[1]);
1511 
1512 			smbadm_fini();
1513 			return (ret);
1514 		}
1515 	}
1516 
1517 	curcmd = NULL;
1518 	(void) fprintf(stderr, gettext("unknown subcommand (%s)\n"), argv[1]);
1519 	smbadm_usage(B_FALSE);
1520 	return (2);
1521 }
1522 
1523 static int
smbadm_init(void)1524 smbadm_init(void)
1525 {
1526 	int rc;
1527 
1528 	switch (curcmd->flags & SMBADM_CMDF_TYPEMASK) {
1529 	case SMBADM_CMDF_GROUP:
1530 		if ((rc = smb_lgrp_start()) != SMB_LGRP_SUCCESS) {
1531 			(void) fprintf(stderr,
1532 			    gettext("failed to initialize (%s)\n"),
1533 			    smb_lgrp_strerror(rc));
1534 			return (1);
1535 		}
1536 		break;
1537 
1538 	case SMBADM_CMDF_USER:
1539 		smb_pwd_init(B_FALSE);
1540 		break;
1541 
1542 	default:
1543 		break;
1544 	}
1545 
1546 	return (0);
1547 }
1548 
1549 static void
smbadm_fini(void)1550 smbadm_fini(void)
1551 {
1552 	switch (curcmd->flags & SMBADM_CMDF_TYPEMASK) {
1553 	case SMBADM_CMDF_GROUP:
1554 		smb_lgrp_stop();
1555 		break;
1556 
1557 	case SMBADM_CMDF_USER:
1558 		smb_pwd_fini();
1559 		break;
1560 
1561 	default:
1562 		break;
1563 	}
1564 }
1565 
1566 static boolean_t
smbadm_checkauth(const char * auth)1567 smbadm_checkauth(const char *auth)
1568 {
1569 	struct passwd *pw;
1570 
1571 	if ((pw = getpwuid(getuid())) == NULL)
1572 		return (B_FALSE);
1573 
1574 	if (chkauthattr(auth, pw->pw_name) == 0)
1575 		return (B_FALSE);
1576 
1577 	return (B_TRUE);
1578 }
1579 
1580 static boolean_t
smbadm_prop_validate(smbadm_prop_t * prop,boolean_t chkval)1581 smbadm_prop_validate(smbadm_prop_t *prop, boolean_t chkval)
1582 {
1583 	smbadm_prop_handle_t *pinfo;
1584 	int i;
1585 
1586 	for (i = 0; i < SMBADM_NPROP; i++) {
1587 		pinfo = &smbadm_ptable[i];
1588 		if (strcmp(pinfo->p_name, prop->p_name) == 0) {
1589 			if (pinfo->p_chkfn && chkval)
1590 				return (pinfo->p_chkfn(prop));
1591 
1592 			return (B_TRUE);
1593 		}
1594 	}
1595 
1596 	(void) fprintf(stderr, gettext("unrecognized property '%s'\n"),
1597 	    prop->p_name);
1598 
1599 	return (B_FALSE);
1600 }
1601 
1602 static int
smbadm_prop_parse(char * arg,smbadm_prop_t * prop)1603 smbadm_prop_parse(char *arg, smbadm_prop_t *prop)
1604 {
1605 	boolean_t parse_value;
1606 	char *equal;
1607 
1608 	if (arg == NULL)
1609 		return (2);
1610 
1611 	prop->p_name = prop->p_value = NULL;
1612 
1613 	if (strcmp(curcmd->name, "set") == 0)
1614 		parse_value = B_TRUE;
1615 	else
1616 		parse_value = B_FALSE;
1617 
1618 	prop->p_name = arg;
1619 
1620 	if (parse_value) {
1621 		equal = strchr(arg, '=');
1622 		if (equal == NULL)
1623 			return (2);
1624 
1625 		*equal++ = '\0';
1626 		prop->p_value = equal;
1627 	}
1628 
1629 	if (smbadm_prop_validate(prop, parse_value) == B_FALSE)
1630 		return (2);
1631 
1632 	return (0);
1633 }
1634 
1635 static smbadm_prop_handle_t *
smbadm_prop_gethandle(char * pname)1636 smbadm_prop_gethandle(char *pname)
1637 {
1638 	int i;
1639 
1640 	for (i = 0; i < SMBADM_NPROP; i++)
1641 		if (strcmp(pname, smbadm_ptable[i].p_name) == 0)
1642 			return (&smbadm_ptable[i]);
1643 
1644 	return (NULL);
1645 }
1646 
1647 static int
smbadm_setprop_desc(char * gname,smbadm_prop_t * prop)1648 smbadm_setprop_desc(char *gname, smbadm_prop_t *prop)
1649 {
1650 	int status;
1651 
1652 	status = smb_lgrp_setcmnt(gname, prop->p_value);
1653 	if (status != SMB_LGRP_SUCCESS) {
1654 		(void) fprintf(stderr,
1655 		    gettext("failed to modify the group description (%s)\n"),
1656 		    smb_lgrp_strerror(status));
1657 		return (1);
1658 	}
1659 
1660 	(void) printf(gettext("%s: description modified\n"), gname);
1661 	return (0);
1662 }
1663 
1664 static int
smbadm_getprop_desc(char * gname,smbadm_prop_t * prop)1665 smbadm_getprop_desc(char *gname, smbadm_prop_t *prop)
1666 {
1667 	char *cmnt = NULL;
1668 	int status;
1669 
1670 	status = smb_lgrp_getcmnt(gname, &cmnt);
1671 	if (status != SMB_LGRP_SUCCESS) {
1672 		(void) fprintf(stderr,
1673 		    gettext("failed to get the group description (%s)\n"),
1674 		    smb_lgrp_strerror(status));
1675 		return (1);
1676 	}
1677 
1678 	(void) printf(gettext("\t%s: %s\n"), prop->p_name, cmnt);
1679 	free(cmnt);
1680 	return (0);
1681 }
1682 
1683 static int
smbadm_group_setpriv(char * gname,uint8_t priv_id,smbadm_prop_t * prop)1684 smbadm_group_setpriv(char *gname, uint8_t priv_id, smbadm_prop_t *prop)
1685 {
1686 	boolean_t enable;
1687 	int status;
1688 	int ret;
1689 
1690 	if (strcasecmp(prop->p_value, "on") == 0) {
1691 		(void) printf(gettext("Enabling %s privilege "), prop->p_name);
1692 		enable = B_TRUE;
1693 	} else {
1694 		(void) printf(gettext("Disabling %s privilege "), prop->p_name);
1695 		enable = B_FALSE;
1696 	}
1697 
1698 	status = smb_lgrp_setpriv(gname, priv_id, enable);
1699 	if (status == SMB_LGRP_SUCCESS) {
1700 		(void) printf(gettext("succeeded\n"));
1701 		ret = 0;
1702 	} else {
1703 		(void) printf(gettext("failed: %s\n"),
1704 		    smb_lgrp_strerror(status));
1705 		ret = 1;
1706 	}
1707 
1708 	return (ret);
1709 }
1710 
1711 static int
smbadm_group_getpriv(char * gname,uint8_t priv_id,smbadm_prop_t * prop)1712 smbadm_group_getpriv(char *gname, uint8_t priv_id, smbadm_prop_t *prop)
1713 {
1714 	boolean_t enable;
1715 	int status;
1716 
1717 	status = smb_lgrp_getpriv(gname, priv_id, &enable);
1718 	if (status != SMB_LGRP_SUCCESS) {
1719 		(void) fprintf(stderr, gettext("failed to get %s (%s)\n"),
1720 		    prop->p_name, smb_lgrp_strerror(status));
1721 		return (1);
1722 	}
1723 
1724 	(void) printf(gettext("\t%s: %s\n"), prop->p_name,
1725 	    (enable) ? "On" : "Off");
1726 
1727 	return (0);
1728 }
1729 
1730 static int
smbadm_setprop_tkowner(char * gname,smbadm_prop_t * prop)1731 smbadm_setprop_tkowner(char *gname, smbadm_prop_t *prop)
1732 {
1733 	return (smbadm_group_setpriv(gname, SE_TAKE_OWNERSHIP_LUID, prop));
1734 }
1735 
1736 static int
smbadm_getprop_tkowner(char * gname,smbadm_prop_t * prop)1737 smbadm_getprop_tkowner(char *gname, smbadm_prop_t *prop)
1738 {
1739 	return (smbadm_group_getpriv(gname, SE_TAKE_OWNERSHIP_LUID, prop));
1740 }
1741 
1742 static int
smbadm_setprop_backup(char * gname,smbadm_prop_t * prop)1743 smbadm_setprop_backup(char *gname, smbadm_prop_t *prop)
1744 {
1745 	return (smbadm_group_setpriv(gname, SE_BACKUP_LUID, prop));
1746 }
1747 
1748 static int
smbadm_getprop_backup(char * gname,smbadm_prop_t * prop)1749 smbadm_getprop_backup(char *gname, smbadm_prop_t *prop)
1750 {
1751 	return (smbadm_group_getpriv(gname, SE_BACKUP_LUID, prop));
1752 }
1753 
1754 static int
smbadm_setprop_restore(char * gname,smbadm_prop_t * prop)1755 smbadm_setprop_restore(char *gname, smbadm_prop_t *prop)
1756 {
1757 	return (smbadm_group_setpriv(gname, SE_RESTORE_LUID, prop));
1758 }
1759 
1760 static int
smbadm_getprop_restore(char * gname,smbadm_prop_t * prop)1761 smbadm_getprop_restore(char *gname, smbadm_prop_t *prop)
1762 {
1763 	return (smbadm_group_getpriv(gname, SE_RESTORE_LUID, prop));
1764 }
1765 
1766 static boolean_t
smbadm_chkprop_priv(smbadm_prop_t * prop)1767 smbadm_chkprop_priv(smbadm_prop_t *prop)
1768 {
1769 	if (prop->p_value == NULL || *prop->p_value == '\0') {
1770 		(void) fprintf(stderr,
1771 		    gettext("missing value for '%s'\n"), prop->p_name);
1772 		return (B_FALSE);
1773 	}
1774 
1775 	if (strcasecmp(prop->p_value, "on") == 0)
1776 		return (B_TRUE);
1777 
1778 	if (strcasecmp(prop->p_value, "off") == 0)
1779 		return (B_TRUE);
1780 
1781 	(void) fprintf(stderr,
1782 	    gettext("%s: unrecognized value for '%s' property\n"),
1783 	    prop->p_value, prop->p_name);
1784 
1785 	return (B_FALSE);
1786 }
1787 
1788 static const char *
smbadm_pwd_strerror(int error)1789 smbadm_pwd_strerror(int error)
1790 {
1791 	switch (error) {
1792 	case SMB_PWE_SUCCESS:
1793 		return (gettext("Success."));
1794 
1795 	case SMB_PWE_USER_UNKNOWN:
1796 		return (gettext("User does not exist."));
1797 
1798 	case SMB_PWE_USER_DISABLE:
1799 		return (gettext("User is disabled."));
1800 
1801 	case SMB_PWE_CLOSE_FAILED:
1802 	case SMB_PWE_OPEN_FAILED:
1803 	case SMB_PWE_WRITE_FAILED:
1804 	case SMB_PWE_UPDATE_FAILED:
1805 		return (gettext("Unexpected failure. "
1806 		    "SMB password database unchanged."));
1807 
1808 	case SMB_PWE_STAT_FAILED:
1809 		return (gettext("stat of SMB password file failed."));
1810 
1811 	case SMB_PWE_BUSY:
1812 		return (gettext("SMB password database busy. "
1813 		    "Try again later."));
1814 
1815 	case SMB_PWE_DENIED:
1816 		return (gettext("Operation not permitted."));
1817 
1818 	case SMB_PWE_SYSTEM_ERROR:
1819 		return (gettext("System error."));
1820 
1821 	default:
1822 		break;
1823 	}
1824 
1825 	return (gettext("Unknown error code."));
1826 }
1827 
1828 /*
1829  * Enable libumem debugging by default on DEBUG builds.
1830  */
1831 #ifdef DEBUG
1832 const char *
_umem_debug_init(void)1833 _umem_debug_init(void)
1834 {
1835 	return ("default,verbose"); /* $UMEM_DEBUG setting */
1836 }
1837 
1838 const char *
_umem_logging_init(void)1839 _umem_logging_init(void)
1840 {
1841 	return ("fail,contents"); /* $UMEM_LOGGING setting */
1842 }
1843 #endif
1844