1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2011 Nexenta Systems, Inc. All rights reserved. 24 * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved. 25 * Copyright (c) 2013 RackTop Systems. 26 */ 27 28 #include <stdlib.h> 29 #include <strings.h> 30 #include <unistd.h> 31 #include <syslog.h> 32 #include <thread.h> 33 #include <synch.h> 34 #include <grp.h> 35 #include <assert.h> 36 #include <libintl.h> 37 #include <smbsrv/libsmb.h> 38 #include <smb_sqlite.h> 39 #include <sys/types.h> 40 #include <sys/stat.h> 41 #include <sys/param.h> 42 #include <libcmdutils.h> 43 44 /* 45 * Local domain SID (aka machine SID) is not stored in the domain table 46 * therefore the index is 0 47 */ 48 #define SMB_LGRP_LOCAL_IDX 0 49 #define SMB_LGRP_BUILTIN_IDX 1 50 51 #define SMB_LGRP_DB_NAME "/var/smb/smbgroup.db" 52 #define SMB_LGRP_DB_TIMEOUT 3000 /* in millisecond */ 53 #define SMB_LGRP_DB_VERMAJOR 1 54 #define SMB_LGRP_DB_VERMINOR 0 55 #define SMB_LGRP_DB_MAGIC 0x4C475250 /* LGRP */ 56 57 #define SMB_LGRP_DB_ORD 1 /* open read-only */ 58 #define SMB_LGRP_DB_ORW 2 /* open read/write */ 59 60 #define SMB_LGRP_DB_ADDMEMBER 1 61 #define SMB_LGRP_DB_DELMEMBER 2 62 63 /* 64 * members column of the groups table is an array of 65 * member structure smb_lgmid_t defined below. 66 * 67 * privs column of the groups table is an array of bytes 68 * where each byte is the id of an enable privilege 69 */ 70 #define SMB_LGRP_DB_SQL \ 71 "CREATE TABLE db_info (" \ 72 " ver_major INTEGER," \ 73 " ver_minor INTEGER," \ 74 " magic INTEGER" \ 75 ");" \ 76 "" \ 77 "CREATE TABLE domains (" \ 78 " dom_idx INTEGER PRIMARY KEY," \ 79 " dom_sid TEXT UNIQUE," \ 80 " dom_cnt INTEGER" \ 81 ");" \ 82 "" \ 83 "CREATE UNIQUE INDEX domsid_idx ON domains (dom_sid);" \ 84 "" \ 85 "CREATE TABLE groups (" \ 86 " name TEXT PRIMARY KEY," \ 87 " sid_idx INTEGER," \ 88 " sid_rid INTEGER," \ 89 " sid_type INTEGER," \ 90 " sid_attrs INTEGER," \ 91 " comment TEXT," \ 92 " n_privs INTEGER," \ 93 " privs BLOB," \ 94 " n_members INTEGER," \ 95 " members BLOB" \ 96 ");" \ 97 "" \ 98 "CREATE INDEX grprid_idx ON groups (sid_rid);" 99 100 /* 101 * Number of groups table columns 102 */ 103 #define SMB_LGRP_GTBL_NCOL 10 104 105 #define SMB_LGRP_GTBL_NAME 0 106 #define SMB_LGRP_GTBL_SIDIDX 1 107 #define SMB_LGRP_GTBL_SIDRID 2 108 #define SMB_LGRP_GTBL_SIDTYP 3 109 #define SMB_LGRP_GTBL_SIDATR 4 110 #define SMB_LGRP_GTBL_CMNT 5 111 #define SMB_LGRP_GTBL_NPRIVS 6 112 #define SMB_LGRP_GTBL_PRIVS 7 113 #define SMB_LGRP_GTBL_NMEMBS 8 114 #define SMB_LGRP_GTBL_MEMBS 9 115 116 #define SMB_LGRP_INFO_NONE 0x00 117 #define SMB_LGRP_INFO_NAME 0x01 118 #define SMB_LGRP_INFO_CMNT 0x02 119 #define SMB_LGRP_INFO_SID 0x04 120 #define SMB_LGRP_INFO_PRIV 0x08 121 #define SMB_LGRP_INFO_MEMB 0x10 122 #define SMB_LGRP_INFO_ALL 0x1F 123 124 #define SMB_LGRP_PGRP_GRPTMP "/etc/gtmp" 125 #define SMB_LGRP_PGRP_GRPBUFSIZ 5120 126 #define SMB_LGRP_PGRP_GROUP "/etc/group" 127 #define SMB_LGRP_PGRP_MAXGLEN 9 /* max length of group name */ 128 #define SMB_LGRP_PGRP_DEFRID 1000 /* lowest cifs created gid */ 129 130 #define SMB_LGRP_PGRP_NOTUNIQUE 0 131 #define SMB_LGRP_PGRP_RESERVED 1 132 #define SMB_LGRP_PGRP_UNIQUE 2 133 #define SMB_LGRP_PGRP_TOOBIG 3 134 #define SMB_LGRP_PGRP_INVALID 4 135 136 #define NULL_MSGCHK(msg) ((msg) ? (msg) : "NULL") 137 138 /* Member ID */ 139 typedef struct smb_lgmid { 140 uint32_t m_idx; 141 uint32_t m_rid; 142 uint16_t m_type; 143 } smb_lgmid_t; 144 145 #define SMB_LGRP_MID_HEXSZ 32 146 147 /* Member list */ 148 typedef struct smb_lgmlist { 149 uint32_t m_cnt; 150 char *m_ids; 151 } smb_lgmlist_t; 152 153 /* Privilege ID */ 154 typedef uint8_t smb_lgpid_t; 155 156 /* Privilege list */ 157 typedef struct smb_lgplist { 158 uint32_t p_cnt; 159 smb_lgpid_t *p_ids; 160 } smb_lgplist_t; 161 162 static struct { 163 int errnum; 164 char *errmsg; 165 } errtab[] = { 166 { SMB_LGRP_SUCCESS, "success" }, 167 { SMB_LGRP_INVALID_ARG, "invalid argument" }, 168 { SMB_LGRP_INVALID_MEMBER, "invalid member type" }, 169 { SMB_LGRP_INVALID_NAME, "invalid name" }, 170 { SMB_LGRP_NOT_FOUND, "group not found" }, 171 { SMB_LGRP_EXISTS, "group exists" }, 172 { SMB_LGRP_NO_SID, "cannot obtain a SID" }, 173 { SMB_LGRP_NO_LOCAL_SID, "cannot get the machine SID" }, 174 { SMB_LGRP_SID_NOTLOCAL, "local account has non-local SID" }, 175 { SMB_LGRP_WKSID, 176 "operation not permitted on well-known account" }, 177 { SMB_LGRP_NO_MEMORY, "not enough memory" }, 178 { SMB_LGRP_DB_ERROR, "database operation error" }, 179 { SMB_LGRP_DBINIT_ERROR, "database initialization error" }, 180 { SMB_LGRP_INTERNAL_ERROR, "internal error" }, 181 { SMB_LGRP_MEMBER_IN_GROUP, "member already in group" }, 182 { SMB_LGRP_MEMBER_NOT_IN_GROUP, "not a member" }, 183 { SMB_LGRP_NO_SUCH_PRIV, "no such privilege" }, 184 { SMB_LGRP_NO_SUCH_DOMAIN, "no such domain SID" }, 185 { SMB_LGRP_PRIV_HELD, "privilege already held" }, 186 { SMB_LGRP_PRIV_NOT_HELD, "privilege not held" }, 187 { SMB_LGRP_BAD_DATA, "bad data" }, 188 { SMB_LGRP_NO_MORE, "no more groups" }, 189 { SMB_LGRP_DBOPEN_FAILED, "database open failed" }, 190 { SMB_LGRP_DBEXEC_FAILED, "database operation failed" }, 191 { SMB_LGRP_DBINIT_FAILED, "database initialization failed" }, 192 { SMB_LGRP_DOMLKP_FAILED, "domain SID lookup failed" }, 193 { SMB_LGRP_DOMINS_FAILED, "domain SID insert failed" }, 194 { SMB_LGRP_INSERT_FAILED, "group insert failed" }, 195 { SMB_LGRP_DELETE_FAILED, "group delete failed" }, 196 { SMB_LGRP_UPDATE_FAILED, "group update failed" }, 197 { SMB_LGRP_LOOKUP_FAILED, "group lookup failed" }, 198 { SMB_LGRP_OFFLINE, "local group service is offline" }, 199 { SMB_LGRP_POSIXCREATE_FAILED, "posix group create failed" } 200 }; 201 202 /* 203 * Serialization for the local group API. 204 */ 205 typedef struct { 206 mutex_t lg_mutex; 207 cond_t lg_cv; 208 boolean_t lg_online; 209 uint32_t lg_refcnt; 210 smb_sid_t *lg_machine_sid; 211 } smb_localgrp_t; 212 213 static smb_localgrp_t smb_localgrp; 214 215 static boolean_t smb_lgrp_enter(void); 216 static void smb_lgrp_exit(void); 217 static int smb_lgrp_db_init(void); 218 static sqlite *smb_lgrp_db_open(int); 219 static void smb_lgrp_db_close(sqlite *); 220 static int smb_lgrp_db_setinfo(sqlite *); 221 222 static boolean_t smb_lgrp_gtbl_exists(sqlite *, char *); 223 static int smb_lgrp_gtbl_lookup(sqlite *, int, smb_group_t *, int, ...); 224 static int smb_lgrp_gtbl_insert(sqlite *, smb_group_t *); 225 static int smb_lgrp_gtbl_update(sqlite *, char *, smb_group_t *, int); 226 static int smb_lgrp_gtbl_delete(sqlite *, char *); 227 static int smb_lgrp_gtbl_update_mlist(sqlite *, char *, smb_gsid_t *, int); 228 static int smb_lgrp_gtbl_update_plist(sqlite *, char *, uint8_t, boolean_t); 229 static int smb_lgrp_gtbl_count(sqlite *, int, int *); 230 231 static int smb_lgrp_dtbl_insert(sqlite *, char *, uint32_t *); 232 static int smb_lgrp_dtbl_getidx(sqlite *, smb_sid_t *, uint16_t, 233 uint32_t *, uint32_t *); 234 static int smb_lgrp_dtbl_getsid(sqlite *, uint32_t, smb_sid_t **); 235 236 static int smb_lgrp_mlist_add(smb_lgmlist_t *, smb_lgmid_t *, smb_lgmlist_t *); 237 static int smb_lgrp_mlist_del(smb_lgmlist_t *, smb_lgmid_t *, smb_lgmlist_t *); 238 239 static int smb_lgrp_plist_add(smb_lgplist_t *, smb_lgpid_t, smb_lgplist_t *); 240 static int smb_lgrp_plist_del(smb_lgplist_t *, smb_lgpid_t, smb_lgplist_t *); 241 242 static void smb_lgrp_encode_privset(smb_group_t *, smb_lgplist_t *); 243 244 static int smb_lgrp_decode(smb_group_t *, char **, int, sqlite *); 245 static int smb_lgrp_decode_privset(smb_group_t *, char *, char *); 246 static int smb_lgrp_decode_members(smb_group_t *, char *, char *, sqlite *); 247 248 static void smb_lgrp_set_default_privs(smb_group_t *); 249 static boolean_t smb_lgrp_normalize_name(char *); 250 static boolean_t smb_lgrp_chkmember(uint16_t); 251 static int smb_lgrp_getsid(int, uint32_t *, uint16_t, sqlite *, smb_sid_t **); 252 static int smb_lgrp_getgid(uint32_t rid, gid_t *gid); 253 static boolean_t smb_lgrp_exists(char *); 254 static int smb_lgrp_pgrp_add(char *); 255 256 /* 257 * smb_lgrp_add 258 * 259 * Create a local group with the given name and comment. 260 * This new group doesn't have any members and no enabled 261 * privileges. 262 * 263 * No well-known accounts can be added other than Administators, 264 * Backup Operators and Power Users. These built-in groups 265 * won't have any members when created but a set of default 266 * privileges will be enabled for them. 267 */ 268 int 269 smb_lgrp_add(char *gname, char *cmnt) 270 { 271 smb_wka_t *wka; 272 struct group *pxgrp; 273 smb_group_t grp; 274 smb_sid_t *sid = NULL; 275 sqlite *db; 276 int rc; 277 278 if (!smb_lgrp_normalize_name(gname)) 279 return (SMB_LGRP_INVALID_NAME); 280 281 if (cmnt && (strlen(cmnt) > SMB_LGRP_COMMENT_MAX)) 282 return (SMB_LGRP_INVALID_ARG); 283 284 bzero(&grp, sizeof (grp)); 285 grp.sg_name = smb_strlwr(gname); 286 grp.sg_cmnt = cmnt; 287 288 if (!smb_lgrp_enter()) 289 return (SMB_LGRP_OFFLINE); 290 291 wka = smb_wka_lookup_name(gname); 292 if (wka == NULL) { 293 if ((pxgrp = getgrnam(gname)) == NULL) { 294 if (smb_lgrp_pgrp_add(gname) != 0) { 295 smb_lgrp_exit(); 296 return (SMB_LGRP_POSIXCREATE_FAILED); 297 } 298 299 if ((pxgrp = getgrnam(gname)) == NULL) { 300 smb_lgrp_exit(); 301 return (SMB_LGRP_NOT_FOUND); 302 } 303 } 304 305 /* 306 * Make sure a local SID can be obtained 307 */ 308 if (smb_idmap_getsid(pxgrp->gr_gid, SMB_IDMAP_GROUP, &sid) 309 != IDMAP_SUCCESS) { 310 smb_lgrp_exit(); 311 return (SMB_LGRP_NO_SID); 312 } 313 314 if (!smb_sid_indomain(smb_localgrp.lg_machine_sid, sid)) { 315 free(sid); 316 smb_lgrp_exit(); 317 return (SMB_LGRP_SID_NOTLOCAL); 318 } 319 320 free(sid); 321 grp.sg_id.gs_type = SidTypeAlias; 322 grp.sg_domain = SMB_DOMAIN_LOCAL; 323 grp.sg_rid = pxgrp->gr_gid; 324 } else { 325 if ((wka->wka_flags & SMB_WKAFLG_LGRP_ENABLE) == 0) { 326 /* cannot add well-known accounts */ 327 smb_lgrp_exit(); 328 return (SMB_LGRP_WKSID); 329 } 330 331 grp.sg_id.gs_type = wka->wka_type; 332 if ((sid = smb_sid_fromstr(wka->wka_sid)) == NULL) { 333 smb_lgrp_exit(); 334 return (SMB_LGRP_NO_MEMORY); 335 } 336 337 (void) smb_sid_getrid(sid, &grp.sg_rid); 338 free(sid); 339 grp.sg_domain = SMB_DOMAIN_BUILTIN; 340 grp.sg_privs = smb_privset_new(); 341 smb_lgrp_set_default_privs(&grp); 342 } 343 344 if (smb_lgrp_exists(grp.sg_name)) { 345 smb_lgrp_exit(); 346 return (SMB_LGRP_EXISTS); 347 } 348 349 grp.sg_attr = SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | 350 SE_GROUP_ENABLED; 351 352 db = smb_lgrp_db_open(SMB_LGRP_DB_ORW); 353 rc = smb_lgrp_gtbl_insert(db, &grp); 354 smb_lgrp_db_close(db); 355 356 smb_privset_free(grp.sg_privs); 357 smb_lgrp_exit(); 358 return (rc); 359 } 360 361 /* 362 * smb_lgrp_rename 363 * 364 * Renames the given group 365 */ 366 int 367 smb_lgrp_rename(char *gname, char *new_gname) 368 { 369 smb_group_t grp; 370 sqlite *db; 371 int rc; 372 373 if (!smb_lgrp_normalize_name(gname)) 374 return (SMB_LGRP_INVALID_NAME); 375 376 if (!smb_lgrp_normalize_name(gname)) 377 return (SMB_LGRP_INVALID_NAME); 378 379 if (smb_strcasecmp(gname, new_gname, 0) == 0) 380 return (SMB_LGRP_SUCCESS); 381 382 /* Cannot rename well-known groups */ 383 if (smb_wka_lookup_name(gname) != NULL) 384 return (SMB_LGRP_WKSID); 385 386 /* Cannot rename to a well-known groups */ 387 if (smb_wka_lookup_name(new_gname) != NULL) 388 return (SMB_LGRP_WKSID); 389 390 grp.sg_name = new_gname; 391 392 if (!smb_lgrp_enter()) 393 return (SMB_LGRP_OFFLINE); 394 395 if (getgrnam(new_gname) == NULL) { 396 if (smb_lgrp_pgrp_add(new_gname) != 0) { 397 smb_lgrp_exit(); 398 return (SMB_LGRP_POSIXCREATE_FAILED); 399 } 400 401 if (getgrnam(new_gname) == NULL) { 402 smb_lgrp_exit(); 403 return (SMB_LGRP_NOT_FOUND); 404 } 405 } 406 407 db = smb_lgrp_db_open(SMB_LGRP_DB_ORW); 408 rc = smb_lgrp_gtbl_update(db, gname, &grp, SMB_LGRP_GTBL_NAME); 409 smb_lgrp_db_close(db); 410 411 smb_lgrp_exit(); 412 return (rc); 413 } 414 415 /* 416 * smb_lgrp_delete 417 * 418 * Deletes the specified local group. 419 */ 420 int 421 smb_lgrp_delete(char *gname) 422 { 423 sqlite *db; 424 int rc; 425 426 if (!smb_lgrp_normalize_name(gname)) 427 return (SMB_LGRP_INVALID_NAME); 428 429 /* Cannot remove a built-in group */ 430 if (smb_wka_lookup_name(gname) != NULL) 431 return (SMB_LGRP_WKSID); 432 433 434 if (!smb_lgrp_exists(gname)) 435 return (SMB_LGRP_NOT_FOUND); 436 437 if (!smb_lgrp_enter()) 438 return (SMB_LGRP_OFFLINE); 439 440 db = smb_lgrp_db_open(SMB_LGRP_DB_ORW); 441 rc = smb_lgrp_gtbl_delete(db, gname); 442 smb_lgrp_db_close(db); 443 444 smb_lgrp_exit(); 445 return (rc); 446 } 447 448 /* 449 * smb_lgrp_setcmnt 450 * 451 * Sets the description for the given group 452 */ 453 int 454 smb_lgrp_setcmnt(char *gname, char *cmnt) 455 { 456 smb_group_t grp; 457 sqlite *db; 458 int rc; 459 460 if (!smb_lgrp_normalize_name(gname)) 461 return (SMB_LGRP_INVALID_NAME); 462 463 if (cmnt && (strlen(cmnt) > SMB_LGRP_COMMENT_MAX)) 464 return (SMB_LGRP_INVALID_ARG); 465 466 grp.sg_cmnt = cmnt; 467 468 if (!smb_lgrp_enter()) 469 return (SMB_LGRP_OFFLINE); 470 471 db = smb_lgrp_db_open(SMB_LGRP_DB_ORW); 472 rc = smb_lgrp_gtbl_update(db, gname, &grp, SMB_LGRP_GTBL_CMNT); 473 smb_lgrp_db_close(db); 474 475 smb_lgrp_exit(); 476 return (rc); 477 } 478 479 /* 480 * smb_lgrp_getcmnt 481 * 482 * Obtain the description of the specified group 483 */ 484 int 485 smb_lgrp_getcmnt(char *gname, char **cmnt) 486 { 487 smb_group_t grp; 488 sqlite *db; 489 int rc; 490 491 if (!smb_lgrp_normalize_name(gname)) 492 return (SMB_LGRP_INVALID_NAME); 493 494 if (cmnt == NULL) 495 return (SMB_LGRP_INVALID_ARG); 496 497 if (!smb_lgrp_enter()) 498 return (SMB_LGRP_OFFLINE); 499 500 db = smb_lgrp_db_open(SMB_LGRP_DB_ORD); 501 rc = smb_lgrp_gtbl_lookup(db, SMB_LGRP_GTBL_NAME, &grp, 502 SMB_LGRP_INFO_CMNT, gname); 503 smb_lgrp_db_close(db); 504 smb_lgrp_exit(); 505 506 if (rc == SMB_LGRP_SUCCESS) { 507 *cmnt = grp.sg_cmnt; 508 grp.sg_cmnt = NULL; 509 smb_lgrp_free(&grp); 510 } 511 512 return (rc); 513 } 514 515 516 /* 517 * smb_lgrp_setpriv 518 * 519 * Enable/disable the specified privilge for the group 520 */ 521 int 522 smb_lgrp_setpriv(char *gname, uint8_t priv_lid, boolean_t enable) 523 { 524 sqlite *db; 525 int rc; 526 527 if (!smb_lgrp_normalize_name(gname)) 528 return (SMB_LGRP_INVALID_NAME); 529 530 if ((priv_lid < SE_MIN_LUID) || (priv_lid > SE_MAX_LUID)) 531 return (SMB_LGRP_NO_SUCH_PRIV); 532 533 if (!smb_lgrp_enter()) 534 return (SMB_LGRP_OFFLINE); 535 536 db = smb_lgrp_db_open(SMB_LGRP_DB_ORW); 537 rc = smb_lgrp_gtbl_update_plist(db, gname, priv_lid, enable); 538 smb_lgrp_db_close(db); 539 smb_lgrp_exit(); 540 541 if (enable) { 542 if (rc == SMB_LGRP_PRIV_HELD) 543 rc = SMB_LGRP_SUCCESS; 544 } else { 545 if (rc == SMB_LGRP_PRIV_NOT_HELD) 546 rc = SMB_LGRP_SUCCESS; 547 } 548 549 return (rc); 550 } 551 552 /* 553 * smb_lgrp_getpriv 554 * 555 * Obtain the status of the specified privilge for the group 556 */ 557 int 558 smb_lgrp_getpriv(char *gname, uint8_t priv_lid, boolean_t *enable) 559 { 560 sqlite *db; 561 smb_group_t grp; 562 int rc; 563 564 if (!smb_lgrp_normalize_name(gname)) 565 return (SMB_LGRP_INVALID_NAME); 566 567 if ((priv_lid < SE_MIN_LUID) || (priv_lid > SE_MAX_LUID)) 568 return (SMB_LGRP_NO_SUCH_PRIV); 569 570 if (!smb_lgrp_enter()) 571 return (SMB_LGRP_OFFLINE); 572 573 db = smb_lgrp_db_open(SMB_LGRP_DB_ORD); 574 rc = smb_lgrp_gtbl_lookup(db, SMB_LGRP_GTBL_NAME, &grp, 575 SMB_LGRP_INFO_PRIV, gname); 576 smb_lgrp_db_close(db); 577 smb_lgrp_exit(); 578 579 if (rc == SMB_LGRP_SUCCESS) { 580 *enable = (smb_privset_query(grp.sg_privs, priv_lid) == 1); 581 smb_lgrp_free(&grp); 582 } 583 584 return (rc); 585 } 586 587 /* 588 * smb_lgrp_add_member 589 * 590 * Add the given account to the specified group as its member. 591 */ 592 int 593 smb_lgrp_add_member(char *gname, smb_sid_t *msid, uint16_t sid_type) 594 { 595 sqlite *db; 596 smb_gsid_t mid; 597 int rc; 598 599 if (!smb_lgrp_normalize_name(gname)) 600 return (SMB_LGRP_INVALID_NAME); 601 602 if (!smb_sid_isvalid(msid)) 603 return (SMB_LGRP_INVALID_ARG); 604 605 if (!smb_lgrp_chkmember(sid_type)) 606 return (SMB_LGRP_INVALID_MEMBER); 607 608 mid.gs_sid = msid; 609 mid.gs_type = sid_type; 610 611 if (!smb_lgrp_enter()) 612 return (SMB_LGRP_OFFLINE); 613 614 db = smb_lgrp_db_open(SMB_LGRP_DB_ORW); 615 rc = smb_lgrp_gtbl_update_mlist(db, gname, &mid, SMB_LGRP_DB_ADDMEMBER); 616 smb_lgrp_db_close(db); 617 618 smb_lgrp_exit(); 619 return (rc); 620 } 621 622 /* 623 * smb_lgrp_del_member 624 * 625 * Delete the specified member from the given group. 626 */ 627 int 628 smb_lgrp_del_member(char *gname, smb_sid_t *msid, uint16_t sid_type) 629 { 630 sqlite *db; 631 smb_gsid_t mid; 632 int rc; 633 634 if (!smb_lgrp_normalize_name(gname)) 635 return (SMB_LGRP_INVALID_NAME); 636 637 if (!smb_sid_isvalid(msid)) 638 return (SMB_LGRP_INVALID_ARG); 639 640 mid.gs_sid = msid; 641 mid.gs_type = sid_type; 642 643 if (!smb_lgrp_enter()) 644 return (SMB_LGRP_OFFLINE); 645 646 db = smb_lgrp_db_open(SMB_LGRP_DB_ORW); 647 rc = smb_lgrp_gtbl_update_mlist(db, gname, &mid, SMB_LGRP_DB_DELMEMBER); 648 smb_lgrp_db_close(db); 649 650 smb_lgrp_exit(); 651 return (rc); 652 } 653 654 /* 655 * smb_lgrp_getbyname 656 * 657 * Retrieves the information of the group specified by 658 * the given name. 659 * 660 * Note that this function doesn't allocate the group 661 * structure itself only the fields, so the given grp 662 * pointer has to point to a group structure. 663 * Caller must free the allocated memories for the fields 664 * by calling smb_lgrp_free(). 665 */ 666 int 667 smb_lgrp_getbyname(char *gname, smb_group_t *grp) 668 { 669 sqlite *db; 670 int rc; 671 672 if (!smb_lgrp_normalize_name(gname)) 673 return (SMB_LGRP_INVALID_NAME); 674 675 if (!smb_lgrp_enter()) 676 return (SMB_LGRP_OFFLINE); 677 678 db = smb_lgrp_db_open(SMB_LGRP_DB_ORD); 679 rc = smb_lgrp_gtbl_lookup(db, SMB_LGRP_GTBL_NAME, grp, 680 SMB_LGRP_INFO_ALL, gname); 681 smb_lgrp_db_close(db); 682 683 smb_lgrp_exit(); 684 return (rc); 685 } 686 687 /* 688 * smb_lgrp_getbyrid 689 * 690 * Retrieves the information of the group specified by 691 * the given RID and domain type. 692 * 693 * Note that this function doesn't allocate the group 694 * structure itself only the fields, so the given grp 695 * pointer has to point to a group structure. 696 * Caller must free the allocated memories for the fields 697 * by calling smb_lgrp_free(). 698 * 699 * If grp is NULL no information would be returned. The 700 * return value of SMB_LGRP_SUCCESS will indicate that a 701 * group with the given information exists. 702 */ 703 int 704 smb_lgrp_getbyrid(uint32_t rid, smb_domain_type_t domtype, smb_group_t *grp) 705 { 706 smb_group_t tmpgrp; 707 sqlite *db; 708 int infolvl = SMB_LGRP_INFO_ALL; 709 int rc; 710 711 if (!smb_lgrp_enter()) 712 return (SMB_LGRP_OFFLINE); 713 714 if (grp == NULL) { 715 grp = &tmpgrp; 716 infolvl = SMB_LGRP_INFO_NONE; 717 } 718 719 db = smb_lgrp_db_open(SMB_LGRP_DB_ORD); 720 rc = smb_lgrp_gtbl_lookup(db, SMB_LGRP_GTBL_SIDRID, grp, infolvl, 721 rid, domtype); 722 smb_lgrp_db_close(db); 723 724 smb_lgrp_exit(); 725 return (rc); 726 } 727 728 /* 729 * smb_lgrp_numbydomain 730 * 731 * Returns the number of groups in the given domain in the 732 * arg 'count' 733 */ 734 int 735 smb_lgrp_numbydomain(smb_domain_type_t dom_type, int *count) 736 { 737 sqlite *db; 738 int dom_idx; 739 int rc; 740 741 switch (dom_type) { 742 case SMB_DOMAIN_LOCAL: 743 dom_idx = SMB_LGRP_LOCAL_IDX; 744 break; 745 case SMB_DOMAIN_BUILTIN: 746 dom_idx = SMB_LGRP_BUILTIN_IDX; 747 break; 748 default: 749 *count = 0; 750 return (SMB_LGRP_INVALID_ARG); 751 } 752 753 if (!smb_lgrp_enter()) 754 return (SMB_LGRP_OFFLINE); 755 756 db = smb_lgrp_db_open(SMB_LGRP_DB_ORD); 757 rc = smb_lgrp_gtbl_count(db, dom_idx, count); 758 smb_lgrp_db_close(db); 759 760 smb_lgrp_exit(); 761 return (rc); 762 } 763 764 /* 765 * smb_lgrp_free 766 * 767 * Frees the allocated memory for the fields of the given 768 * group structure. Note that this function doesn't free 769 * the group itself. 770 */ 771 void 772 smb_lgrp_free(smb_group_t *grp) 773 { 774 int i; 775 776 if (grp == NULL) 777 return; 778 779 free(grp->sg_name); 780 free(grp->sg_cmnt); 781 smb_sid_free(grp->sg_id.gs_sid); 782 smb_privset_free(grp->sg_privs); 783 784 for (i = 0; i < grp->sg_nmembers; i++) 785 smb_sid_free(grp->sg_members[i].gs_sid); 786 free(grp->sg_members); 787 } 788 789 /* 790 * smb_lgrp_iteropen 791 * 792 * Initializes the given group iterator by opening 793 * the group database and creating a virtual machine 794 * for iteration. 795 */ 796 int 797 smb_lgrp_iteropen(smb_giter_t *iter) 798 { 799 char *sql; 800 char *errmsg = NULL; 801 int rc = SMB_LGRP_SUCCESS; 802 803 assert(iter); 804 805 if (!smb_lgrp_enter()) 806 return (SMB_LGRP_OFFLINE); 807 808 bzero(iter, sizeof (smb_giter_t)); 809 810 sql = sqlite_mprintf("SELECT * FROM groups"); 811 if (sql == NULL) { 812 smb_lgrp_exit(); 813 return (SMB_LGRP_NO_MEMORY); 814 } 815 816 iter->sgi_db = smb_lgrp_db_open(SMB_LGRP_DB_ORD); 817 if (iter->sgi_db == NULL) { 818 sqlite_freemem(sql); 819 smb_lgrp_exit(); 820 return (SMB_LGRP_DBOPEN_FAILED); 821 } 822 823 rc = sqlite_compile(iter->sgi_db, sql, NULL, &iter->sgi_vm, &errmsg); 824 sqlite_freemem(sql); 825 826 if (rc != SQLITE_OK) { 827 syslog(LOG_DEBUG, "failed to create a VM (%s)", 828 NULL_MSGCHK(errmsg)); 829 rc = SMB_LGRP_DB_ERROR; 830 } 831 832 smb_lgrp_exit(); 833 return (rc); 834 } 835 836 /* 837 * smb_lgrp_iterclose 838 * 839 * Closes the given group iterator. 840 */ 841 void 842 smb_lgrp_iterclose(smb_giter_t *iter) 843 { 844 char *errmsg = NULL; 845 int rc; 846 847 assert(iter); 848 849 if (!smb_lgrp_enter()) 850 return; 851 852 rc = sqlite_finalize(iter->sgi_vm, &errmsg); 853 if (rc != SQLITE_OK) { 854 syslog(LOG_DEBUG, "failed to destroy a VM (%s)", 855 NULL_MSGCHK(errmsg)); 856 } 857 858 smb_lgrp_db_close(iter->sgi_db); 859 smb_lgrp_exit(); 860 } 861 862 /* 863 * Returns B_TRUE if there has been an error during 864 * iteration. 865 */ 866 boolean_t 867 smb_lgrp_itererror(smb_giter_t *iter) 868 { 869 return (iter->sgi_nerr != 0); 870 } 871 872 /* 873 * smb_lgrp_iterate 874 * 875 * Iterate through group database 876 * Group information is returned in provided group structure. 877 * 878 * Note that this function doesn't allocate the group 879 * structure itself only the fields, so the given grp 880 * pointer has to point to a group structure. 881 * Caller must free the allocated memories for the fields 882 * by calling smb_lgrp_free(). 883 */ 884 int 885 smb_lgrp_iterate(smb_giter_t *iter, smb_group_t *grp) 886 { 887 const char **values; 888 int ncol; 889 int rc; 890 int i; 891 892 if (iter->sgi_vm == NULL || iter->sgi_db == NULL) 893 return (SMB_LGRP_INVALID_ARG); 894 895 if (!smb_lgrp_enter()) 896 return (SMB_LGRP_OFFLINE); 897 898 for (;;) { 899 bzero(grp, sizeof (smb_group_t)); 900 rc = sqlite_step(iter->sgi_vm, &ncol, &values, NULL); 901 if (rc == SQLITE_DONE) { 902 smb_lgrp_exit(); 903 return (SMB_LGRP_NO_MORE); 904 } 905 906 if (rc != SQLITE_ROW) { 907 smb_lgrp_exit(); 908 return (SMB_LGRP_DBEXEC_FAILED); 909 } 910 911 if (ncol != SMB_LGRP_GTBL_NCOL) { 912 smb_lgrp_exit(); 913 return (SMB_LGRP_DB_ERROR); 914 } 915 916 for (i = 0; i < ncol; i++) { 917 if (values[i] == NULL) { 918 smb_lgrp_exit(); 919 return (SMB_LGRP_DB_ERROR); 920 } 921 } 922 923 rc = smb_lgrp_decode(grp, (char **)values, SMB_LGRP_INFO_ALL, 924 iter->sgi_db); 925 if (rc == SMB_LGRP_SUCCESS) 926 break; 927 928 iter->sgi_nerr++; 929 syslog(LOG_ERR, "smb_lgrp_iterate: %s", smb_lgrp_strerror(rc)); 930 } 931 932 smb_lgrp_exit(); 933 return (rc); 934 935 } 936 937 /* 938 * smb_lgrp_is_member 939 * 940 * Check to see if the specified account is a member of 941 * the given group. 942 */ 943 boolean_t 944 smb_lgrp_is_member(smb_group_t *grp, smb_sid_t *sid) 945 { 946 int i; 947 948 if (grp == NULL || grp->sg_members == NULL || sid == NULL) 949 return (B_FALSE); 950 951 for (i = 0; i < grp->sg_nmembers; i++) { 952 if (smb_sid_cmp(grp->sg_members[i].gs_sid, sid)) 953 return (B_TRUE); 954 } 955 956 return (B_FALSE); 957 } 958 959 /* 960 * smb_lgrp_strerror 961 * 962 * Returns a text for the given group error code. 963 */ 964 char * 965 smb_lgrp_strerror(int errnum) 966 { 967 int i; 968 int nerr = (sizeof (errtab) / sizeof (errtab[0])); 969 970 for (i = 0; i < nerr; ++i) { 971 if (errnum == errtab[i].errnum) 972 return (errtab[i].errmsg); 973 } 974 975 return ("unknown local group error"); 976 } 977 978 /* 979 * smb_lgrp_err_to_ntstatus 980 * 981 * This routine maps Local group operation errors to NT Status error codes. 982 */ 983 uint32_t 984 smb_lgrp_err_to_ntstatus(uint32_t lgrp_err) 985 { 986 int i; 987 static struct err_map { 988 uint32_t lgrp_err; 989 uint32_t nt_status; 990 } err_map[] = { 991 { SMB_LGRP_SUCCESS, NT_STATUS_SUCCESS }, 992 { SMB_LGRP_INVALID_ARG, NT_STATUS_INVALID_PARAMETER }, 993 { SMB_LGRP_INVALID_MEMBER, NT_STATUS_INVALID_MEMBER }, 994 { SMB_LGRP_INVALID_NAME, NT_STATUS_INVALID_PARAMETER }, 995 { SMB_LGRP_NOT_FOUND, NT_STATUS_NO_SUCH_ALIAS }, 996 { SMB_LGRP_EXISTS, NT_STATUS_ALIAS_EXISTS }, 997 { SMB_LGRP_NO_SID, NT_STATUS_INVALID_SID }, 998 { SMB_LGRP_NO_LOCAL_SID, NT_STATUS_INVALID_SID }, 999 { SMB_LGRP_SID_NOTLOCAL, NT_STATUS_INVALID_SID }, 1000 { SMB_LGRP_WKSID, NT_STATUS_INVALID_SID }, 1001 { SMB_LGRP_NO_MEMORY, NT_STATUS_NO_MEMORY }, 1002 { SMB_LGRP_DB_ERROR, NT_STATUS_INTERNAL_DB_ERROR }, 1003 { SMB_LGRP_DBINIT_ERROR, NT_STATUS_INTERNAL_DB_ERROR }, 1004 { SMB_LGRP_INTERNAL_ERROR, NT_STATUS_INTERNAL_ERROR }, 1005 { SMB_LGRP_MEMBER_IN_GROUP, NT_STATUS_MEMBER_IN_ALIAS }, 1006 { SMB_LGRP_MEMBER_NOT_IN_GROUP, NT_STATUS_MEMBER_NOT_IN_ALIAS }, 1007 { SMB_LGRP_NO_SUCH_PRIV, NT_STATUS_NO_SUCH_PRIVILEGE }, 1008 { SMB_LGRP_NO_SUCH_DOMAIN, NT_STATUS_NO_SUCH_DOMAIN }, 1009 { SMB_LGRP_PRIV_HELD, NT_STATUS_SUCCESS }, 1010 { SMB_LGRP_PRIV_NOT_HELD, NT_STATUS_PRIVILEGE_NOT_HELD }, 1011 { SMB_LGRP_BAD_DATA, NT_STATUS_DATA_ERROR }, 1012 { SMB_LGRP_NO_MORE, NT_STATUS_NO_MORE_ENTRIES }, 1013 { SMB_LGRP_DBOPEN_FAILED, NT_STATUS_INTERNAL_DB_ERROR }, 1014 { SMB_LGRP_DBEXEC_FAILED, NT_STATUS_INTERNAL_DB_ERROR }, 1015 { SMB_LGRP_DBINIT_FAILED, NT_STATUS_INTERNAL_DB_ERROR }, 1016 { SMB_LGRP_DOMLKP_FAILED, NT_STATUS_INTERNAL_DB_ERROR }, 1017 { SMB_LGRP_DOMINS_FAILED, NT_STATUS_INTERNAL_DB_ERROR }, 1018 { SMB_LGRP_INSERT_FAILED, NT_STATUS_INTERNAL_DB_ERROR }, 1019 { SMB_LGRP_DELETE_FAILED, NT_STATUS_INTERNAL_DB_ERROR }, 1020 { SMB_LGRP_UPDATE_FAILED, NT_STATUS_INTERNAL_DB_ERROR }, 1021 { SMB_LGRP_LOOKUP_FAILED, NT_STATUS_INTERNAL_DB_ERROR }, 1022 { SMB_LGRP_NOT_SUPPORTED, NT_STATUS_NOT_SUPPORTED }, 1023 { SMB_LGRP_OFFLINE, NT_STATUS_INTERNAL_ERROR }, 1024 { SMB_LGRP_POSIXCREATE_FAILED, NT_STATUS_UNSUCCESSFUL } 1025 }; 1026 1027 for (i = 0; i < sizeof (err_map)/sizeof (err_map[0]); ++i) { 1028 if (err_map[i].lgrp_err == lgrp_err) 1029 return (err_map[i].nt_status); 1030 } 1031 1032 return (NT_STATUS_INTERNAL_ERROR); 1033 } 1034 1035 /* 1036 * smb_lgrp_chkmember 1037 * 1038 * Determines valid account types for being member of 1039 * a local group. We really have no business trying to 1040 * keep track of the "type" of SIDs in a group, so just 1041 * validate that the SID type is a known enum value. 1042 */ 1043 static boolean_t 1044 smb_lgrp_chkmember(uint16_t sid_type) 1045 { 1046 switch (sid_type) { 1047 case SidTypeNull: 1048 case SidTypeUser: 1049 case SidTypeGroup: 1050 case SidTypeAlias: 1051 case SidTypeWellKnownGroup: 1052 case SidTypeDeletedAccount: 1053 case SidTypeInvalid: 1054 case SidTypeUnknown: 1055 return (B_TRUE); 1056 } 1057 return (B_FALSE); 1058 } 1059 1060 /* 1061 * smb_lgrp_start 1062 * 1063 * Initializes the library private global variables. 1064 * Create the database, if it doesn't exist, and add 1065 * the predefined builtin groups. 1066 */ 1067 int 1068 smb_lgrp_start(void) 1069 { 1070 static char *builtin[] = { 1071 "Administrators", 1072 "Backup Operators", 1073 "Power Users" 1074 }; 1075 smb_wka_t *wka; 1076 char *localsid; 1077 int i, rc; 1078 int ngrp = sizeof (builtin) / sizeof (builtin[0]); 1079 1080 (void) mutex_lock(&smb_localgrp.lg_mutex); 1081 1082 if ((localsid = smb_config_get_localsid()) == NULL) { 1083 (void) mutex_unlock(&smb_localgrp.lg_mutex); 1084 return (SMB_LGRP_NO_LOCAL_SID); 1085 } 1086 1087 smb_localgrp.lg_machine_sid = smb_sid_fromstr(localsid); 1088 free(localsid); 1089 1090 if (!smb_sid_isvalid(smb_localgrp.lg_machine_sid)) { 1091 free(smb_localgrp.lg_machine_sid); 1092 smb_localgrp.lg_machine_sid = NULL; 1093 (void) mutex_unlock(&smb_localgrp.lg_mutex); 1094 return (SMB_LGRP_NO_LOCAL_SID); 1095 } 1096 1097 rc = smb_lgrp_db_init(); 1098 if (rc != SMB_LGRP_SUCCESS) { 1099 free(smb_localgrp.lg_machine_sid); 1100 smb_localgrp.lg_machine_sid = NULL; 1101 (void) mutex_unlock(&smb_localgrp.lg_mutex); 1102 return (rc); 1103 } 1104 1105 smb_localgrp.lg_online = B_TRUE; 1106 (void) mutex_unlock(&smb_localgrp.lg_mutex); 1107 1108 for (i = 0; i < ngrp; i++) { 1109 char *tname; 1110 1111 if ((wka = smb_wka_lookup_name(builtin[i])) == NULL) 1112 continue; 1113 1114 if ((tname = strdup(wka->wka_name)) == NULL) 1115 return (SMB_LGRP_NO_MEMORY); 1116 if (!smb_lgrp_exists(tname)) { 1117 rc = smb_lgrp_add(tname, wka->wka_desc); 1118 if (rc != SMB_LGRP_SUCCESS) { 1119 syslog(LOG_DEBUG, "failed to add %s", 1120 tname); 1121 } 1122 } 1123 free(tname); 1124 } 1125 1126 return (SMB_LGRP_SUCCESS); 1127 } 1128 1129 /* 1130 * smb_lgrp_stop 1131 * 1132 * Unintialize the library global private variables. 1133 */ 1134 void 1135 smb_lgrp_stop(void) 1136 { 1137 (void) mutex_lock(&smb_localgrp.lg_mutex); 1138 if (!smb_localgrp.lg_online) 1139 return; 1140 1141 smb_localgrp.lg_online = B_FALSE; 1142 1143 while (smb_localgrp.lg_refcnt > 0) 1144 (void) cond_wait(&smb_localgrp.lg_cv, &smb_localgrp.lg_mutex); 1145 1146 free(smb_localgrp.lg_machine_sid); 1147 smb_localgrp.lg_machine_sid = NULL; 1148 (void) mutex_unlock(&smb_localgrp.lg_mutex); 1149 } 1150 1151 static boolean_t 1152 smb_lgrp_enter(void) 1153 { 1154 boolean_t status; 1155 1156 (void) mutex_lock(&smb_localgrp.lg_mutex); 1157 1158 status = smb_localgrp.lg_online; 1159 1160 if (smb_localgrp.lg_online) 1161 ++smb_localgrp.lg_refcnt; 1162 1163 (void) mutex_unlock(&smb_localgrp.lg_mutex); 1164 return (status); 1165 } 1166 1167 static void 1168 smb_lgrp_exit(void) 1169 { 1170 (void) mutex_lock(&smb_localgrp.lg_mutex); 1171 assert(smb_localgrp.lg_refcnt > 0); 1172 1173 if ((--smb_localgrp.lg_refcnt) == 0) 1174 (void) cond_signal(&smb_localgrp.lg_cv); 1175 1176 (void) mutex_unlock(&smb_localgrp.lg_mutex); 1177 } 1178 1179 /* 1180 * smb_lgrp_db_open 1181 * 1182 * Opens group database with the given mode. 1183 */ 1184 static sqlite * 1185 smb_lgrp_db_open(int mode) 1186 { 1187 sqlite *db; 1188 char *errmsg = NULL; 1189 1190 db = sqlite_open(SMB_LGRP_DB_NAME, mode, &errmsg); 1191 if (db == NULL) { 1192 syslog(LOG_ERR, "failed to open group database (%s)", 1193 NULL_MSGCHK(errmsg)); 1194 sqlite_freemem(errmsg); 1195 } 1196 1197 return (db); 1198 } 1199 1200 /* 1201 * smb_lgrp_db_close 1202 * 1203 * Closes the given database handle 1204 */ 1205 static void 1206 smb_lgrp_db_close(sqlite *db) 1207 { 1208 if (db) { 1209 sqlite_close(db); 1210 } 1211 } 1212 1213 /* 1214 * smb_lgrp_db_init 1215 * 1216 * Creates the group database based on the defined SQL statement. 1217 * It also initializes db_info and domain tables. 1218 */ 1219 static int 1220 smb_lgrp_db_init(void) 1221 { 1222 int dbrc = SQLITE_OK; 1223 int rc = SMB_LGRP_SUCCESS; 1224 sqlite *db = NULL; 1225 char *errmsg = NULL; 1226 1227 db = sqlite_open(SMB_LGRP_DB_NAME, 0600, &errmsg); 1228 if (db == NULL) { 1229 syslog(LOG_ERR, "failed to create group database (%s)", 1230 NULL_MSGCHK(errmsg)); 1231 sqlite_freemem(errmsg); 1232 return (SMB_LGRP_DBOPEN_FAILED); 1233 } 1234 1235 sqlite_busy_timeout(db, SMB_LGRP_DB_TIMEOUT); 1236 dbrc = sqlite_exec(db, "BEGIN TRANSACTION;", NULL, NULL, &errmsg); 1237 if (dbrc != SQLITE_OK) { 1238 syslog(LOG_DEBUG, "failed to begin database transaction (%s)", 1239 NULL_MSGCHK(errmsg)); 1240 sqlite_freemem(errmsg); 1241 sqlite_close(db); 1242 return (SMB_LGRP_DBEXEC_FAILED); 1243 } 1244 1245 switch (sqlite_exec(db, SMB_LGRP_DB_SQL, NULL, NULL, &errmsg)) { 1246 case SQLITE_ERROR: 1247 /* 1248 * This is the normal situation: CREATE probably failed because 1249 * tables already exist. It may indicate an error in SQL as well 1250 * but we cannot tell. 1251 */ 1252 sqlite_freemem(errmsg); 1253 dbrc = sqlite_exec(db, "ROLLBACK TRANSACTION", NULL, NULL, 1254 &errmsg); 1255 rc = SMB_LGRP_SUCCESS; 1256 break; 1257 1258 case SQLITE_OK: 1259 dbrc = sqlite_exec(db, "COMMIT TRANSACTION", NULL, NULL, 1260 &errmsg); 1261 if (dbrc != SQLITE_OK) 1262 break; 1263 rc = smb_lgrp_dtbl_insert(db, NT_BUILTIN_DOMAIN_SIDSTR, 1264 NULL); 1265 if (rc == SMB_LGRP_SUCCESS) 1266 rc = smb_lgrp_db_setinfo(db); 1267 if (rc != SMB_LGRP_SUCCESS) { 1268 (void) sqlite_close(db); 1269 (void) unlink(SMB_LGRP_DB_NAME); 1270 return (rc); 1271 } 1272 break; 1273 1274 default: 1275 syslog(LOG_ERR, 1276 "failed to initialize group database (%s)", errmsg); 1277 sqlite_freemem(errmsg); 1278 dbrc = sqlite_exec(db, "ROLLBACK TRANSACTION", NULL, NULL, 1279 &errmsg); 1280 rc = SMB_LGRP_DBINIT_FAILED; 1281 break; 1282 } 1283 1284 if (dbrc != SQLITE_OK) { 1285 /* this is bad - database may be left in a locked state */ 1286 syslog(LOG_DEBUG, "failed to close a transaction (%s)", 1287 NULL_MSGCHK(errmsg)); 1288 sqlite_freemem(errmsg); 1289 } 1290 1291 (void) sqlite_close(db); 1292 return (rc); 1293 } 1294 1295 /* 1296 * smb_lgrp_gtbl_lookup 1297 * 1298 * This is a flexible lookup function for the group database. 1299 * The key type can be specified by the 'key' arg and the actual key 1300 * values can be passed after the 'infolvl' arg. 'infolvl' arg specifies 1301 * what information items for the specified group is needed. 1302 * 1303 * Note that the function assumes the given key is unique and only 1304 * specifies one or 0 group. The keys that are supported now are 1305 * the group name and the group SID 1306 * 1307 * Note that this function doesn't allocate the group 1308 * structure itself only the fields, so the given grp 1309 * pointer has to point to a group structure. 1310 * Caller must free the allocated memories for the fields 1311 * by calling smb_lgrp_free(). 1312 */ 1313 static int 1314 smb_lgrp_gtbl_lookup(sqlite *db, int key, smb_group_t *grp, int infolvl, ...) 1315 { 1316 char *errmsg = NULL; 1317 char *sql; 1318 char **result; 1319 int nrow, ncol; 1320 int rc, dom_idx; 1321 smb_group_t grpkey; 1322 va_list ap; 1323 1324 if (db == NULL) 1325 return (SMB_LGRP_DBOPEN_FAILED); 1326 1327 bzero(grp, sizeof (smb_group_t)); 1328 va_start(ap, infolvl); 1329 1330 switch (key) { 1331 case SMB_LGRP_GTBL_NAME: 1332 grpkey.sg_name = va_arg(ap, char *); 1333 sql = sqlite_mprintf("SELECT * FROM groups WHERE name = '%s'", 1334 grpkey.sg_name); 1335 break; 1336 1337 case SMB_LGRP_GTBL_SIDRID: 1338 grpkey.sg_rid = va_arg(ap, uint32_t); 1339 grpkey.sg_domain = va_arg(ap, smb_domain_type_t); 1340 if (grpkey.sg_domain == SMB_DOMAIN_LOCAL) { 1341 dom_idx = SMB_LGRP_LOCAL_IDX; 1342 /* need to map the given rid to a gid */ 1343 rc = smb_lgrp_getgid(grpkey.sg_rid, 1344 (gid_t *)&grpkey.sg_rid); 1345 if (rc != SMB_LGRP_SUCCESS) { 1346 va_end(ap); 1347 return (rc); 1348 } 1349 } else { 1350 dom_idx = SMB_LGRP_BUILTIN_IDX; 1351 } 1352 1353 sql = sqlite_mprintf("SELECT * FROM groups " 1354 "WHERE (sid_idx = %d) AND (sid_rid = %u)", 1355 dom_idx, grpkey.sg_rid); 1356 break; 1357 1358 default: 1359 va_end(ap); 1360 return (SMB_LGRP_INVALID_ARG); 1361 } 1362 1363 va_end(ap); 1364 if (sql == NULL) 1365 return (SMB_LGRP_NO_MEMORY); 1366 1367 rc = sqlite_get_table(db, sql, &result, &nrow, &ncol, &errmsg); 1368 sqlite_freemem(sql); 1369 1370 if (rc != SQLITE_OK) { 1371 syslog(LOG_DEBUG, "failed to lookup (%s)", NULL_MSGCHK(errmsg)); 1372 sqlite_freemem(errmsg); 1373 return (SMB_LGRP_LOOKUP_FAILED); 1374 } 1375 1376 if (nrow == 0) { 1377 /* group not found */ 1378 sqlite_free_table(result); 1379 return (SMB_LGRP_NOT_FOUND); 1380 } 1381 1382 if (nrow != 1 || ncol != SMB_LGRP_GTBL_NCOL) { 1383 sqlite_free_table(result); 1384 return (SMB_LGRP_DB_ERROR); 1385 } 1386 1387 rc = smb_lgrp_decode(grp, &result[SMB_LGRP_GTBL_NCOL], infolvl, db); 1388 sqlite_free_table(result); 1389 return (rc); 1390 } 1391 1392 /* 1393 * smb_lgrp_gtbl_exists 1394 * 1395 * Checks to see if the given group exists or not. 1396 */ 1397 static boolean_t 1398 smb_lgrp_gtbl_exists(sqlite *db, char *gname) 1399 { 1400 char *errmsg = NULL; 1401 char *sql; 1402 char **result; 1403 int nrow, ncol; 1404 int rc; 1405 1406 if (db == NULL) 1407 return (NULL); 1408 1409 sql = sqlite_mprintf("SELECT name FROM groups WHERE name = '%s'", 1410 gname); 1411 rc = sqlite_get_table(db, sql, &result, &nrow, &ncol, &errmsg); 1412 sqlite_freemem(sql); 1413 1414 if (rc != SQLITE_OK) { 1415 syslog(LOG_DEBUG, "failed to lookup %s (%s)", 1416 gname, NULL_MSGCHK(errmsg)); 1417 sqlite_freemem(errmsg); 1418 return (B_FALSE); 1419 } 1420 1421 sqlite_free_table(result); 1422 return (nrow != 0); 1423 } 1424 1425 /* 1426 * smb_lgrp_gtbl_count 1427 * 1428 * Counts the number of groups in the domain specified by 1429 * 'dom_idx' 1430 */ 1431 static int 1432 smb_lgrp_gtbl_count(sqlite *db, int dom_idx, int *count) 1433 { 1434 char *errmsg = NULL; 1435 char *sql; 1436 char **result; 1437 int nrow, ncol; 1438 int rc; 1439 1440 *count = 0; 1441 if (db == NULL) 1442 return (SMB_LGRP_DBOPEN_FAILED); 1443 1444 sql = sqlite_mprintf("SELECT sid_idx FROM groups WHERE sid_idx = %d", 1445 dom_idx); 1446 rc = sqlite_get_table(db, sql, &result, &nrow, &ncol, &errmsg); 1447 sqlite_freemem(sql); 1448 1449 if (rc != SQLITE_OK) { 1450 syslog(LOG_DEBUG, "failed to count (%s)", NULL_MSGCHK(errmsg)); 1451 sqlite_freemem(errmsg); 1452 return (SMB_LGRP_LOOKUP_FAILED); 1453 } 1454 1455 sqlite_free_table(result); 1456 if (ncol > 1) 1457 return (SMB_LGRP_DB_ERROR); 1458 1459 *count = nrow; 1460 return (SMB_LGRP_SUCCESS); 1461 } 1462 1463 /* 1464 * smb_lgrp_gtbl_insert 1465 * 1466 * Insert a record for the given group in the group database. 1467 * 1468 * NOTE: this function assumes that this group has no members 1469 * at this time. 1470 */ 1471 static int 1472 smb_lgrp_gtbl_insert(sqlite *db, smb_group_t *grp) 1473 { 1474 smb_lgpid_t privs[SE_MAX_LUID + 1]; 1475 smb_lgplist_t plist; 1476 char *errmsg = NULL; 1477 char *sql; 1478 int dom_idx; 1479 int rc; 1480 1481 if (db == NULL) 1482 return (SMB_LGRP_DBOPEN_FAILED); 1483 1484 dom_idx = (grp->sg_domain == SMB_DOMAIN_LOCAL) 1485 ? SMB_LGRP_LOCAL_IDX : SMB_LGRP_BUILTIN_IDX; 1486 1487 plist.p_cnt = SE_MAX_LUID; 1488 plist.p_ids = privs; 1489 smb_lgrp_encode_privset(grp, &plist); 1490 1491 sql = sqlite_mprintf("INSERT INTO groups " 1492 "(name, sid_idx, sid_rid, sid_type, sid_attrs, comment, " 1493 "n_privs, privs, n_members, members) " 1494 "VALUES('%s', %u, %u, %u, %u, '%q', %u, '%q', %u, '%q')", 1495 grp->sg_name, dom_idx, grp->sg_rid, grp->sg_id.gs_type, 1496 grp->sg_attr, (grp->sg_cmnt) ? grp->sg_cmnt : "", 1497 plist.p_cnt, (char *)plist.p_ids, 0, ""); 1498 1499 if (sql == NULL) 1500 return (SMB_LGRP_NO_MEMORY); 1501 1502 rc = sqlite_exec(db, sql, NULL, NULL, &errmsg); 1503 sqlite_freemem(sql); 1504 1505 if (rc != SQLITE_OK) { 1506 syslog(LOG_DEBUG, "failed to insert %s (%s)", 1507 grp->sg_name, NULL_MSGCHK(errmsg)); 1508 sqlite_freemem(errmsg); 1509 rc = SMB_LGRP_INSERT_FAILED; 1510 } else { 1511 rc = SMB_LGRP_SUCCESS; 1512 } 1513 1514 return (rc); 1515 } 1516 1517 /* 1518 * smb_lgrp_gtbl_delete 1519 * 1520 * Removes the specified group from the database 1521 */ 1522 static int 1523 smb_lgrp_gtbl_delete(sqlite *db, char *gname) 1524 { 1525 char *errmsg = NULL; 1526 char *sql; 1527 int rc; 1528 1529 if (db == NULL) 1530 return (SMB_LGRP_DBOPEN_FAILED); 1531 1532 sql = sqlite_mprintf("DELETE FROM groups WHERE name = '%s'", gname); 1533 if (sql == NULL) 1534 return (SMB_LGRP_NO_MEMORY); 1535 1536 rc = sqlite_exec(db, sql, NULL, NULL, &errmsg); 1537 sqlite_freemem(sql); 1538 1539 if (rc != SQLITE_OK) { 1540 syslog(LOG_DEBUG, "failed to delete %s (%s)", 1541 gname, NULL_MSGCHK(errmsg)); 1542 sqlite_freemem(errmsg); 1543 rc = SMB_LGRP_DELETE_FAILED; 1544 } else { 1545 rc = SMB_LGRP_SUCCESS; 1546 } 1547 1548 return (rc); 1549 } 1550 1551 /* 1552 * smb_lgrp_gtbl_update 1553 * 1554 * Updates the specified group information, the supported items 1555 * are group name and comment 1556 */ 1557 static int 1558 smb_lgrp_gtbl_update(sqlite *db, char *gname, smb_group_t *grp, int col_id) 1559 { 1560 char *errmsg = NULL; 1561 char *sql; 1562 int rc; 1563 1564 if (db == NULL) 1565 return (SMB_LGRP_DBOPEN_FAILED); 1566 1567 /* UPDATE doesn't fail if gname doesn't exist */ 1568 if (!smb_lgrp_gtbl_exists(db, gname)) 1569 return (SMB_LGRP_NOT_FOUND); 1570 1571 switch (col_id) { 1572 case SMB_LGRP_GTBL_NAME: 1573 if (smb_lgrp_gtbl_exists(db, grp->sg_name)) 1574 return (SMB_LGRP_EXISTS); 1575 sql = sqlite_mprintf("UPDATE groups SET name = '%s' " 1576 "WHERE name = '%s'", grp->sg_name, gname); 1577 break; 1578 1579 case SMB_LGRP_GTBL_CMNT: 1580 sql = sqlite_mprintf("UPDATE groups SET comment = '%q' " 1581 "WHERE name = '%s'", grp->sg_cmnt, gname); 1582 break; 1583 1584 default: 1585 return (SMB_LGRP_INVALID_ARG); 1586 } 1587 1588 if (sql == NULL) 1589 return (SMB_LGRP_NO_MEMORY); 1590 1591 rc = sqlite_exec(db, sql, NULL, NULL, &errmsg); 1592 sqlite_freemem(sql); 1593 1594 if (rc != SQLITE_OK) { 1595 syslog(LOG_DEBUG, "failed to update %s (%s)", 1596 gname, NULL_MSGCHK(errmsg)); 1597 sqlite_freemem(errmsg); 1598 rc = SMB_LGRP_UPDATE_FAILED; 1599 } else { 1600 rc = SMB_LGRP_SUCCESS; 1601 } 1602 1603 return (rc); 1604 } 1605 1606 /* 1607 * smb_lgrp_gtbl_update_mlist 1608 * 1609 * Adds/removes the specified member from the member list of the 1610 * given group 1611 */ 1612 static int 1613 smb_lgrp_gtbl_update_mlist(sqlite *db, char *gname, smb_gsid_t *member, 1614 int flags) 1615 { 1616 smb_lgmlist_t new_members; 1617 smb_lgmlist_t members; 1618 smb_lgmid_t mid; 1619 char *errmsg = NULL; 1620 char *sql; 1621 char **result; 1622 int nrow, ncol; 1623 int rc; 1624 1625 if (db == NULL) 1626 return (SMB_LGRP_DBOPEN_FAILED); 1627 1628 sql = sqlite_mprintf("SELECT n_members, members FROM groups " 1629 "WHERE name = '%s'", gname); 1630 1631 if (sql == NULL) 1632 return (SMB_LGRP_NO_MEMORY); 1633 1634 rc = sqlite_get_table(db, sql, &result, &nrow, &ncol, &errmsg); 1635 sqlite_freemem(sql); 1636 1637 if (rc != SQLITE_OK) { 1638 syslog(LOG_DEBUG, "failed to lookup %s (%s)", 1639 gname, NULL_MSGCHK(errmsg)); 1640 sqlite_freemem(errmsg); 1641 return (SMB_LGRP_LOOKUP_FAILED); 1642 } 1643 1644 if (nrow == 0) { 1645 /* group not found */ 1646 sqlite_free_table(result); 1647 return (SMB_LGRP_NOT_FOUND); 1648 } 1649 1650 if (nrow != 1 || ncol != 2) { 1651 sqlite_free_table(result); 1652 return (SMB_LGRP_DB_ERROR); 1653 } 1654 1655 bzero(&mid, sizeof (mid)); 1656 mid.m_type = member->gs_type; 1657 rc = smb_lgrp_dtbl_getidx(db, member->gs_sid, mid.m_type, 1658 &mid.m_idx, &mid.m_rid); 1659 if (rc != SMB_LGRP_SUCCESS) { 1660 sqlite_free_table(result); 1661 return (rc); 1662 } 1663 1664 members.m_cnt = atoi(result[2]); 1665 members.m_ids = result[3]; 1666 1667 switch (flags) { 1668 case SMB_LGRP_DB_ADDMEMBER: 1669 rc = smb_lgrp_mlist_add(&members, &mid, &new_members); 1670 break; 1671 case SMB_LGRP_DB_DELMEMBER: 1672 rc = smb_lgrp_mlist_del(&members, &mid, &new_members); 1673 break; 1674 default: 1675 rc = SMB_LGRP_INVALID_ARG; 1676 } 1677 1678 sqlite_free_table(result); 1679 if (rc != SMB_LGRP_SUCCESS) 1680 return (rc); 1681 1682 sql = sqlite_mprintf("UPDATE groups SET n_members = %u, members = '%s'" 1683 " WHERE name = '%s'", new_members.m_cnt, new_members.m_ids, gname); 1684 1685 free(new_members.m_ids); 1686 1687 if (sql == NULL) 1688 return (SMB_LGRP_NO_MEMORY); 1689 1690 rc = sqlite_exec(db, sql, NULL, NULL, &errmsg); 1691 sqlite_freemem(sql); 1692 1693 if (rc != SQLITE_OK) { 1694 syslog(LOG_DEBUG, "failed to update %s (%s)", gname, 1695 NULL_MSGCHK(errmsg)); 1696 sqlite_freemem(errmsg); 1697 rc = SMB_LGRP_UPDATE_FAILED; 1698 } else { 1699 rc = SMB_LGRP_SUCCESS; 1700 } 1701 1702 return (rc); 1703 } 1704 1705 /* 1706 * smb_lgrp_gtbl_update_plist 1707 * 1708 * Adds/removes the specified privilege from the privilege list of the 1709 * given group 1710 */ 1711 static int 1712 smb_lgrp_gtbl_update_plist(sqlite *db, char *gname, uint8_t priv_id, 1713 boolean_t enable) 1714 { 1715 char *sql; 1716 char *errmsg = NULL; 1717 char **result; 1718 int nrow, ncol; 1719 int rc; 1720 smb_lgplist_t privs; 1721 smb_lgplist_t new_privs; 1722 1723 if (db == NULL) 1724 return (SMB_LGRP_DBOPEN_FAILED); 1725 1726 sql = sqlite_mprintf("SELECT n_privs, privs FROM groups " 1727 "WHERE name = '%s'", gname); 1728 1729 if (sql == NULL) 1730 return (SMB_LGRP_NO_MEMORY); 1731 1732 rc = sqlite_get_table(db, sql, &result, &nrow, &ncol, &errmsg); 1733 sqlite_freemem(sql); 1734 1735 if (rc != SQLITE_OK) { 1736 syslog(LOG_DEBUG, "failed to lookup %s (%s)", 1737 gname, NULL_MSGCHK(errmsg)); 1738 sqlite_freemem(errmsg); 1739 return (SMB_LGRP_LOOKUP_FAILED); 1740 } 1741 1742 if (nrow == 0) { 1743 /* group not found */ 1744 sqlite_free_table(result); 1745 return (SMB_LGRP_NOT_FOUND); 1746 } 1747 1748 if (nrow != 1 || ncol != 2) { 1749 sqlite_free_table(result); 1750 return (SMB_LGRP_DB_ERROR); 1751 } 1752 1753 privs.p_cnt = atoi(result[2]); 1754 privs.p_ids = (smb_lgpid_t *)result[3]; 1755 1756 if (enable) 1757 rc = smb_lgrp_plist_add(&privs, priv_id, &new_privs); 1758 else 1759 rc = smb_lgrp_plist_del(&privs, priv_id, &new_privs); 1760 1761 sqlite_free_table(result); 1762 if (rc != SMB_LGRP_SUCCESS) 1763 return (rc); 1764 1765 sql = sqlite_mprintf("UPDATE groups SET n_privs = %u, privs = '%q'" 1766 " WHERE name = '%s'", new_privs.p_cnt, (char *)new_privs.p_ids, 1767 gname); 1768 1769 free(new_privs.p_ids); 1770 1771 if (sql == NULL) 1772 return (SMB_LGRP_NO_MEMORY); 1773 1774 rc = sqlite_exec(db, sql, NULL, NULL, &errmsg); 1775 sqlite_freemem(sql); 1776 1777 if (rc != SQLITE_OK) { 1778 syslog(LOG_DEBUG, "failed to update %s (%s)", 1779 gname, NULL_MSGCHK(errmsg)); 1780 sqlite_freemem(errmsg); 1781 rc = SMB_LGRP_UPDATE_FAILED; 1782 } else { 1783 rc = SMB_LGRP_SUCCESS; 1784 } 1785 1786 return (rc); 1787 } 1788 1789 /* 1790 * smb_lgrp_dtbl_insert 1791 * 1792 * Inserts the specified domain SID in the dmain table. 1793 * Upon successful insert the index will be returned in 1794 * 'dom_idx' arg. 1795 */ 1796 static int 1797 smb_lgrp_dtbl_insert(sqlite *db, char *dom_sid, uint32_t *dom_idx) 1798 { 1799 char *errmsg = NULL; 1800 char *sql; 1801 int rc; 1802 1803 sql = sqlite_mprintf("INSERT INTO domains (dom_sid, dom_cnt)" 1804 " VALUES('%s', 1);", dom_sid); 1805 if (sql == NULL) 1806 return (SMB_LGRP_NO_MEMORY); 1807 1808 rc = sqlite_exec(db, sql, NULL, NULL, &errmsg); 1809 sqlite_freemem(sql); 1810 1811 if (rc != SQLITE_OK) { 1812 syslog(LOG_DEBUG, "failed to insert domain SID (%s)", 1813 NULL_MSGCHK(errmsg)); 1814 sqlite_freemem(errmsg); 1815 return (SMB_LGRP_DOMINS_FAILED); 1816 } 1817 1818 if (dom_idx) 1819 *dom_idx = sqlite_last_insert_rowid(db); 1820 return (SMB_LGRP_SUCCESS); 1821 } 1822 1823 /* 1824 * smb_lgrp_dtbl_getidx 1825 * 1826 * Searches the domain table for the domain SID of the 1827 * given member SID. If it finds the domain SID it'll 1828 * return the index and the RID, otherwise it'll insert 1829 * it in the domain table as a new SID. 1830 */ 1831 static int 1832 smb_lgrp_dtbl_getidx(sqlite *db, smb_sid_t *sid, uint16_t sid_type, 1833 uint32_t *dom_idx, uint32_t *rid) 1834 { 1835 char sidstr[SMB_SID_STRSZ]; 1836 smb_sid_t *dom_sid; 1837 char **result; 1838 int nrow, ncol; 1839 char *errmsg = NULL; 1840 char *sql; 1841 int rc; 1842 1843 if (smb_sid_indomain(smb_localgrp.lg_machine_sid, sid)) { 1844 /* This is a local SID */ 1845 int id_type = (sid_type == SidTypeUser) 1846 ? SMB_IDMAP_USER : SMB_IDMAP_GROUP; 1847 *dom_idx = SMB_LGRP_LOCAL_IDX; 1848 if (smb_idmap_getid(sid, rid, &id_type) != IDMAP_SUCCESS) 1849 return (SMB_LGRP_INTERNAL_ERROR); 1850 1851 return (SMB_LGRP_SUCCESS); 1852 } 1853 1854 if ((dom_sid = smb_sid_split(sid, rid)) == NULL) 1855 return (SMB_LGRP_NO_MEMORY); 1856 1857 smb_sid_tostr(dom_sid, sidstr); 1858 free(dom_sid); 1859 1860 sql = sqlite_mprintf("SELECT dom_idx FROM domains WHERE dom_sid = '%s'", 1861 sidstr); 1862 if (sql == NULL) 1863 return (SMB_LGRP_NO_MEMORY); 1864 1865 rc = sqlite_get_table(db, sql, &result, &nrow, &ncol, &errmsg); 1866 sqlite_freemem(sql); 1867 1868 if (rc != SQLITE_OK) { 1869 syslog(LOG_DEBUG, "failed to lookup domain SID (%s)", 1870 NULL_MSGCHK(errmsg)); 1871 sqlite_freemem(errmsg); 1872 return (SMB_LGRP_DOMLKP_FAILED); 1873 } 1874 1875 switch (nrow) { 1876 case 0: 1877 /* new domain SID; insert it into the domains table */ 1878 sqlite_free_table(result); 1879 return (smb_lgrp_dtbl_insert(db, sidstr, dom_idx)); 1880 1881 case 1: 1882 *dom_idx = atoi(result[1]); 1883 sqlite_free_table(result); 1884 return (SMB_LGRP_SUCCESS); 1885 } 1886 1887 sqlite_free_table(result); 1888 return (SMB_LGRP_DB_ERROR); 1889 } 1890 1891 /* 1892 * smb_lgrp_dtbl_getsid 1893 * 1894 * Searchs the domain table for the given domain index. 1895 * Converts the found domain SID to binary format and 1896 * returns it in the 'sid' arg. 1897 * 1898 * Caller must free the returned SID by calling free(). 1899 */ 1900 static int 1901 smb_lgrp_dtbl_getsid(sqlite *db, uint32_t dom_idx, smb_sid_t **sid) 1902 { 1903 char **result; 1904 int nrow, ncol; 1905 char *errmsg = NULL; 1906 char *sql; 1907 int rc; 1908 1909 sql = sqlite_mprintf("SELECT dom_sid FROM domains WHERE dom_idx = %u", 1910 dom_idx); 1911 if (sql == NULL) 1912 return (SMB_LGRP_NO_MEMORY); 1913 1914 rc = sqlite_get_table(db, sql, &result, &nrow, &ncol, &errmsg); 1915 sqlite_freemem(sql); 1916 1917 if (rc != SQLITE_OK) { 1918 syslog(LOG_DEBUG, "failed to lookup domain index (%s)", 1919 NULL_MSGCHK(errmsg)); 1920 sqlite_freemem(errmsg); 1921 return (SMB_LGRP_DOMLKP_FAILED); 1922 } 1923 1924 switch (nrow) { 1925 case 0: 1926 rc = SMB_LGRP_NO_SUCH_DOMAIN; 1927 break; 1928 1929 case 1: 1930 *sid = smb_sid_fromstr(result[1]); 1931 rc = (*sid == NULL) 1932 ? SMB_LGRP_INTERNAL_ERROR : SMB_LGRP_SUCCESS; 1933 break; 1934 1935 default: 1936 rc = SMB_LGRP_DB_ERROR; 1937 break; 1938 } 1939 1940 sqlite_free_table(result); 1941 return (rc); 1942 } 1943 1944 /* 1945 * smb_lgrp_db_setinfo 1946 * 1947 * Initializes the db_info table upon database creation. 1948 */ 1949 static int 1950 smb_lgrp_db_setinfo(sqlite *db) 1951 { 1952 char *errmsg = NULL; 1953 char *sql; 1954 int rc; 1955 1956 sql = sqlite_mprintf("INSERT INTO db_info (ver_major, ver_minor," 1957 " magic) VALUES (%d, %d, %u)", SMB_LGRP_DB_VERMAJOR, 1958 SMB_LGRP_DB_VERMINOR, SMB_LGRP_DB_MAGIC); 1959 1960 if (sql == NULL) 1961 return (SMB_LGRP_NO_MEMORY); 1962 1963 rc = sqlite_exec(db, sql, NULL, NULL, &errmsg); 1964 sqlite_freemem(sql); 1965 if (rc != SQLITE_OK) { 1966 syslog(LOG_DEBUG, "failed to insert database information (%s)", 1967 NULL_MSGCHK(errmsg)); 1968 sqlite_freemem(errmsg); 1969 rc = SMB_LGRP_DBINIT_ERROR; 1970 } else { 1971 rc = SMB_LGRP_SUCCESS; 1972 } 1973 1974 return (rc); 1975 } 1976 1977 /* 1978 * smb_lgrp_mlist_add 1979 * 1980 * Adds the given member (newm) to the input member list (in_members) 1981 * if it's not already there. The result list will be returned in 1982 * out_members. The caller must free the allocated memory for 1983 * out_members by calling free(). 1984 * 1985 * in_members and out_members are hex strings. 1986 */ 1987 static int 1988 smb_lgrp_mlist_add(smb_lgmlist_t *in_members, smb_lgmid_t *newm, 1989 smb_lgmlist_t *out_members) 1990 { 1991 char mid_hex[SMB_LGRP_MID_HEXSZ]; 1992 char *in_list; 1993 char *out_list; 1994 int in_size; 1995 int out_size; 1996 int mid_hexsz; 1997 int i; 1998 1999 out_members->m_cnt = 0; 2000 out_members->m_ids = NULL; 2001 2002 bzero(mid_hex, sizeof (mid_hex)); 2003 mid_hexsz = bintohex((const char *)newm, sizeof (smb_lgmid_t), 2004 mid_hex, sizeof (mid_hex)); 2005 2006 /* 2007 * Check to see if this is already a group member 2008 */ 2009 in_list = in_members->m_ids; 2010 for (i = 0; i < in_members->m_cnt; i++) { 2011 if (strncmp(in_list, mid_hex, mid_hexsz) == 0) 2012 return (SMB_LGRP_MEMBER_IN_GROUP); 2013 in_list += mid_hexsz; 2014 } 2015 2016 in_size = (in_members->m_ids) ? strlen(in_members->m_ids) : 0; 2017 out_size = in_size + sizeof (mid_hex) + 1; 2018 out_list = malloc(out_size); 2019 if (out_list == NULL) 2020 return (SMB_LGRP_NO_MEMORY); 2021 2022 bzero(out_list, out_size); 2023 if (in_members->m_ids) 2024 (void) strlcpy(out_list, in_members->m_ids, out_size); 2025 (void) strcat(out_list, mid_hex); 2026 2027 out_members->m_cnt = in_members->m_cnt + 1; 2028 out_members->m_ids = out_list; 2029 2030 return (SMB_LGRP_SUCCESS); 2031 } 2032 2033 /* 2034 * smb_lgrp_mlist_del 2035 * 2036 * Removes the given member (msid) from the input member list 2037 * (in_members) if it's already there. The result list will b 2038 * returned in out_members. The caller must free the allocated 2039 * memory for out_members by calling free(). 2040 * 2041 * in_members and out_members are hex strings. 2042 */ 2043 static int 2044 smb_lgrp_mlist_del(smb_lgmlist_t *in_members, smb_lgmid_t *mid, 2045 smb_lgmlist_t *out_members) 2046 { 2047 char mid_hex[SMB_LGRP_MID_HEXSZ]; 2048 char *in_list; 2049 char *out_list; 2050 int in_size; 2051 int out_size; 2052 int mid_hexsz; 2053 int out_cnt; 2054 int i; 2055 2056 out_members->m_cnt = 0; 2057 out_members->m_ids = NULL; 2058 2059 if ((in_members == NULL) || (in_members->m_cnt == 0)) 2060 return (SMB_LGRP_MEMBER_NOT_IN_GROUP); 2061 2062 in_size = strlen(in_members->m_ids); 2063 out_size = in_size + sizeof (mid_hex) + 1; 2064 out_list = malloc(out_size); 2065 if (out_list == NULL) 2066 return (SMB_LGRP_NO_MEMORY); 2067 2068 *out_list = '\0'; 2069 2070 bzero(mid_hex, sizeof (mid_hex)); 2071 mid_hexsz = bintohex((const char *)mid, sizeof (smb_lgmid_t), 2072 mid_hex, sizeof (mid_hex)); 2073 2074 in_list = in_members->m_ids; 2075 for (i = 0, out_cnt = 0; i < in_members->m_cnt; i++) { 2076 if (strncmp(in_list, mid_hex, mid_hexsz)) { 2077 (void) strncat(out_list, in_list, mid_hexsz); 2078 out_cnt++; 2079 } 2080 in_list += mid_hexsz; 2081 } 2082 2083 if (out_cnt == in_members->m_cnt) { 2084 free(out_list); 2085 return (SMB_LGRP_MEMBER_NOT_IN_GROUP); 2086 } 2087 2088 out_members->m_cnt = out_cnt; 2089 out_members->m_ids = out_list; 2090 return (SMB_LGRP_SUCCESS); 2091 } 2092 2093 /* 2094 * smb_lgrp_plist_add 2095 * 2096 * Adds the given privilege to the input list (in_privs) 2097 * if it's not already there. The result list is returned 2098 * in out_privs. The caller must free the allocated memory 2099 * for out_privs by calling free(). 2100 */ 2101 static int 2102 smb_lgrp_plist_add(smb_lgplist_t *in_privs, smb_lgpid_t priv_id, 2103 smb_lgplist_t *out_privs) 2104 { 2105 int i, size; 2106 smb_lgpid_t *pbuf; 2107 2108 out_privs->p_cnt = 0; 2109 out_privs->p_ids = NULL; 2110 2111 for (i = 0; i < in_privs->p_cnt; i++) { 2112 if (in_privs->p_ids[i] == priv_id) 2113 return (SMB_LGRP_PRIV_HELD); 2114 } 2115 2116 size = (in_privs->p_cnt + 1) * sizeof (smb_lgpid_t) + 1; 2117 pbuf = malloc(size); 2118 if (pbuf == NULL) 2119 return (SMB_LGRP_NO_MEMORY); 2120 2121 bzero(pbuf, size); 2122 bcopy(in_privs->p_ids, pbuf, in_privs->p_cnt * sizeof (smb_lgpid_t)); 2123 pbuf[in_privs->p_cnt] = priv_id; 2124 2125 out_privs->p_cnt = in_privs->p_cnt + 1; 2126 out_privs->p_ids = pbuf; 2127 2128 return (SMB_LGRP_SUCCESS); 2129 } 2130 2131 /* 2132 * smb_lgrp_plist_del 2133 * 2134 * Removes the given privilege from the input list (in_privs) 2135 * if it's already there. The result list is returned 2136 * in out_privs. The caller must free the allocated memory 2137 * for out_privs by calling free(). 2138 */ 2139 static int 2140 smb_lgrp_plist_del(smb_lgplist_t *in_privs, smb_lgpid_t priv_id, 2141 smb_lgplist_t *out_privs) 2142 { 2143 int i, size; 2144 2145 out_privs->p_cnt = 0; 2146 out_privs->p_ids = NULL; 2147 2148 if ((in_privs == NULL) || (in_privs->p_cnt == 0)) 2149 return (SMB_LGRP_PRIV_NOT_HELD); 2150 2151 size = (in_privs->p_cnt - 1) * sizeof (smb_lgpid_t) + 1; 2152 out_privs->p_ids = malloc(size); 2153 if (out_privs->p_ids == NULL) 2154 return (SMB_LGRP_NO_MEMORY); 2155 2156 bzero(out_privs->p_ids, size); 2157 2158 for (i = 0; i < in_privs->p_cnt; i++) { 2159 if (in_privs->p_ids[i] != priv_id) 2160 out_privs->p_ids[out_privs->p_cnt++] = 2161 in_privs->p_ids[i]; 2162 } 2163 2164 if (out_privs->p_cnt == in_privs->p_cnt) { 2165 free(out_privs->p_ids); 2166 out_privs->p_cnt = 0; 2167 out_privs->p_ids = NULL; 2168 return (SMB_LGRP_PRIV_NOT_HELD); 2169 } 2170 2171 return (SMB_LGRP_SUCCESS); 2172 } 2173 2174 /* 2175 * smb_lgrp_encode_privset 2176 * 2177 * Encodes given privilege set into a buffer to be stored in the group 2178 * database. Each entry of the encoded buffer contains the privilege ID 2179 * of an enable privilege. The returned buffer is null-terminated. 2180 */ 2181 static void 2182 smb_lgrp_encode_privset(smb_group_t *grp, smb_lgplist_t *plist) 2183 { 2184 smb_privset_t *privs; 2185 uint32_t pcnt = plist->p_cnt; 2186 int i; 2187 2188 bzero(plist->p_ids, sizeof (smb_lgpid_t) * plist->p_cnt); 2189 plist->p_cnt = 0; 2190 2191 privs = grp->sg_privs; 2192 if ((privs == NULL) || (privs->priv_cnt == 0)) 2193 return; 2194 2195 if (pcnt < privs->priv_cnt) { 2196 assert(0); 2197 } 2198 2199 for (i = 0; i < privs->priv_cnt; i++) { 2200 if (privs->priv[i].attrs == SE_PRIVILEGE_ENABLED) { 2201 plist->p_ids[plist->p_cnt++] = 2202 (uint8_t)privs->priv[i].luid.lo_part; 2203 } 2204 } 2205 } 2206 2207 /* 2208 * smb_lgrp_decode_privset 2209 * 2210 * Decodes the privilege information read from group table 2211 * (nprivs, privs) into a binray format specified by the 2212 * privilege field of smb_group_t 2213 */ 2214 static int 2215 smb_lgrp_decode_privset(smb_group_t *grp, char *nprivs, char *privs) 2216 { 2217 smb_lgplist_t plist; 2218 int i; 2219 2220 plist.p_cnt = atoi(nprivs); 2221 if (strlen(privs) != plist.p_cnt) 2222 return (SMB_LGRP_BAD_DATA); 2223 2224 plist.p_ids = (smb_lgpid_t *)privs; 2225 grp->sg_privs = smb_privset_new(); 2226 if (grp->sg_privs == NULL) 2227 return (SMB_LGRP_NO_MEMORY); 2228 2229 for (i = 0; i < plist.p_cnt; i++) 2230 smb_privset_enable(grp->sg_privs, plist.p_ids[i]); 2231 2232 return (SMB_LGRP_SUCCESS); 2233 } 2234 2235 /* 2236 * smb_lgrp_decode_members 2237 * 2238 * Decodes the members information read from group table 2239 * (nmembers, members) into a binary format specified by the 2240 * member fields of smb_group_t 2241 */ 2242 static int 2243 smb_lgrp_decode_members(smb_group_t *grp, char *nmembers, char *members, 2244 sqlite *db) 2245 { 2246 smb_lgmid_t *m_id; 2247 smb_lgmid_t *m_ids; 2248 smb_gsid_t *m_sid; 2249 smb_gsid_t *m_sids; 2250 int m_num; 2251 int mids_size; 2252 int i, rc; 2253 2254 grp->sg_nmembers = 0; 2255 grp->sg_members = NULL; 2256 2257 m_num = atoi(nmembers); 2258 mids_size = m_num * sizeof (smb_lgmid_t); 2259 if ((m_ids = malloc(mids_size)) == NULL) 2260 return (SMB_LGRP_NO_MEMORY); 2261 2262 m_sids = calloc(m_num, sizeof (smb_gsid_t)); 2263 if (m_sids == NULL) { 2264 free(m_ids); 2265 return (SMB_LGRP_NO_MEMORY); 2266 } 2267 2268 (void) hextobin(members, strlen(members), (char *)m_ids, mids_size); 2269 2270 m_id = m_ids; 2271 m_sid = m_sids; 2272 for (i = 0; i < m_num; i++, m_id++, m_sid++) { 2273 rc = smb_lgrp_getsid(m_id->m_idx, &m_id->m_rid, m_id->m_type, 2274 db, &m_sid->gs_sid); 2275 2276 if (rc != SMB_LGRP_SUCCESS) { 2277 free(m_ids); 2278 for (m_sid = m_sids; m_sid->gs_sid != NULL; m_sid++) 2279 smb_sid_free(m_sid->gs_sid); 2280 free(m_sids); 2281 return (rc); 2282 } 2283 2284 m_sid->gs_type = m_id->m_type; 2285 } 2286 2287 free(m_ids); 2288 2289 grp->sg_nmembers = m_num; 2290 grp->sg_members = m_sids; 2291 return (SMB_LGRP_SUCCESS); 2292 } 2293 2294 /* 2295 * smb_lgrp_decode 2296 * 2297 * Fills out the fields of the given group (grp) based in the 2298 * string information read from the group table. infolvl determines 2299 * which fields are requested and need to be decoded. 2300 * 2301 * Allocated memories must be freed by calling smb_lgrp_free() 2302 * upon successful return. 2303 */ 2304 static int 2305 smb_lgrp_decode(smb_group_t *grp, char **values, int infolvl, sqlite *db) 2306 { 2307 uint32_t sid_idx; 2308 int rc; 2309 2310 if (infolvl == SMB_LGRP_INFO_NONE) 2311 return (SMB_LGRP_SUCCESS); 2312 2313 if (infolvl & SMB_LGRP_INFO_NAME) { 2314 grp->sg_name = strdup(values[SMB_LGRP_GTBL_NAME]); 2315 if (grp->sg_name == NULL) 2316 return (SMB_LGRP_NO_MEMORY); 2317 } 2318 2319 if (infolvl & SMB_LGRP_INFO_CMNT) { 2320 grp->sg_cmnt = strdup(values[SMB_LGRP_GTBL_CMNT]); 2321 if (grp->sg_cmnt == NULL) { 2322 smb_lgrp_free(grp); 2323 return (SMB_LGRP_NO_MEMORY); 2324 } 2325 } 2326 2327 2328 if (infolvl & SMB_LGRP_INFO_SID) { 2329 sid_idx = atoi(values[SMB_LGRP_GTBL_SIDIDX]); 2330 grp->sg_rid = atoi(values[SMB_LGRP_GTBL_SIDRID]); 2331 grp->sg_attr = atoi(values[SMB_LGRP_GTBL_SIDATR]); 2332 grp->sg_id.gs_type = atoi(values[SMB_LGRP_GTBL_SIDTYP]); 2333 rc = smb_lgrp_getsid(sid_idx, &grp->sg_rid, grp->sg_id.gs_type, 2334 db, &grp->sg_id.gs_sid); 2335 if (rc != SMB_LGRP_SUCCESS) { 2336 smb_lgrp_free(grp); 2337 return (rc); 2338 } 2339 grp->sg_domain = (sid_idx == SMB_LGRP_LOCAL_IDX) 2340 ? SMB_DOMAIN_LOCAL : SMB_DOMAIN_BUILTIN; 2341 } 2342 2343 if (infolvl & SMB_LGRP_INFO_PRIV) { 2344 rc = smb_lgrp_decode_privset(grp, values[SMB_LGRP_GTBL_NPRIVS], 2345 values[SMB_LGRP_GTBL_PRIVS]); 2346 2347 if (rc != SMB_LGRP_SUCCESS) { 2348 smb_lgrp_free(grp); 2349 return (rc); 2350 } 2351 } 2352 2353 if (infolvl & SMB_LGRP_INFO_MEMB) { 2354 rc = smb_lgrp_decode_members(grp, values[SMB_LGRP_GTBL_NMEMBS], 2355 values[SMB_LGRP_GTBL_MEMBS], db); 2356 if (rc != SMB_LGRP_SUCCESS) { 2357 smb_lgrp_free(grp); 2358 return (rc); 2359 } 2360 } 2361 2362 return (SMB_LGRP_SUCCESS); 2363 } 2364 2365 /* 2366 * smb_lgrp_normalize_name 2367 * 2368 * Trim whitespace, validate the group name and convert it to lowercase. 2369 */ 2370 static boolean_t 2371 smb_lgrp_normalize_name(char *name) 2372 { 2373 (void) trim_whitespace(name); 2374 2375 if (smb_name_validate_account(name) != ERROR_SUCCESS) 2376 return (B_FALSE); 2377 2378 (void) smb_strlwr(name); 2379 return (B_TRUE); 2380 } 2381 2382 /* 2383 * smb_lgrp_set_default_privs 2384 * 2385 * set default privileges for Administrators and Backup Operators 2386 */ 2387 static void 2388 smb_lgrp_set_default_privs(smb_group_t *grp) 2389 { 2390 if (smb_strcasecmp(grp->sg_name, "Administrators", 0) == 0) { 2391 smb_privset_enable(grp->sg_privs, SE_TAKE_OWNERSHIP_LUID); 2392 return; 2393 } 2394 2395 if (smb_strcasecmp(grp->sg_name, "Backup Operators", 0) == 0) { 2396 smb_privset_enable(grp->sg_privs, SE_BACKUP_LUID); 2397 smb_privset_enable(grp->sg_privs, SE_RESTORE_LUID); 2398 return; 2399 } 2400 } 2401 2402 /* 2403 * smb_lgrp_getsid 2404 * 2405 * Returns a SID based on the provided information 2406 * If dom_idx is 0, it means 'rid' contains a UID/GID and the 2407 * returned SID will be a local SID. If dom_idx is not 0 then 2408 * the domain SID will be fetched from the domain table. 2409 */ 2410 static int 2411 smb_lgrp_getsid(int dom_idx, uint32_t *rid, uint16_t sid_type, 2412 sqlite *db, smb_sid_t **sid) 2413 { 2414 smb_sid_t *dom_sid = NULL; 2415 smb_sid_t *res_sid = NULL; 2416 idmap_stat stat; 2417 int id_type; 2418 int rc; 2419 2420 *sid = NULL; 2421 if (dom_idx == SMB_LGRP_LOCAL_IDX) { 2422 id_type = (sid_type == SidTypeUser) 2423 ? SMB_IDMAP_USER : SMB_IDMAP_GROUP; 2424 stat = smb_idmap_getsid(*rid, id_type, &res_sid); 2425 if (stat != IDMAP_SUCCESS) { 2426 syslog(LOG_ERR, "smb_lgrp_getsid: " 2427 "failed to get a SID for %s id=%u (%d)", 2428 (id_type == SMB_IDMAP_USER) ? "user" : "group", 2429 *rid, stat); 2430 return (SMB_LGRP_NO_SID); 2431 } 2432 2433 /* 2434 * Make sure the returned SID is local 2435 */ 2436 if (!smb_sid_indomain(smb_localgrp.lg_machine_sid, res_sid)) { 2437 syslog(LOG_ERR, "smb_lgrp_getsid: " 2438 "local %s (%u) is mapped to a non-local SID", 2439 (id_type == SMB_IDMAP_USER) ? "user" : "group", 2440 *rid); 2441 smb_sid_free(res_sid); 2442 return (SMB_LGRP_SID_NOTLOCAL); 2443 } 2444 2445 (void) smb_sid_getrid(res_sid, rid); 2446 *sid = res_sid; 2447 return (SMB_LGRP_SUCCESS); 2448 } 2449 2450 rc = smb_lgrp_dtbl_getsid(db, dom_idx, &dom_sid); 2451 if (rc != SMB_LGRP_SUCCESS) { 2452 syslog(LOG_ERR, "smb_lgrp_getsid: %s", smb_lgrp_strerror(rc)); 2453 return (SMB_LGRP_DB_ERROR); 2454 } 2455 2456 res_sid = smb_sid_splice(dom_sid, *rid); 2457 smb_sid_free(dom_sid); 2458 if (res_sid == NULL) { 2459 syslog(LOG_ERR, "smb_lgrp_getsid: %s", smb_lgrp_strerror(rc)); 2460 return (SMB_LGRP_NO_MEMORY); 2461 } 2462 2463 *sid = res_sid; 2464 return (SMB_LGRP_SUCCESS); 2465 } 2466 2467 /* 2468 * smb_lgrp_getgid 2469 * 2470 * Converts given local RID to a local gid since for user 2471 * defined local groups, gid is stored in the table. 2472 */ 2473 static int 2474 smb_lgrp_getgid(uint32_t rid, gid_t *gid) 2475 { 2476 smb_sid_t *sid; 2477 int idtype; 2478 int rc; 2479 2480 if ((sid = smb_sid_splice(smb_localgrp.lg_machine_sid, rid)) == NULL) 2481 return (SMB_LGRP_NO_MEMORY); 2482 2483 idtype = SMB_IDMAP_GROUP; 2484 rc = smb_idmap_getid(sid, gid, &idtype); 2485 smb_sid_free(sid); 2486 2487 return ((rc == IDMAP_SUCCESS) ? SMB_LGRP_SUCCESS : SMB_LGRP_NOT_FOUND); 2488 } 2489 2490 /* 2491 * smb_lgrp_exists 2492 * 2493 * Returns B_TRUE if the local group with the given name exists. 2494 * Otherwise, returns B_FALSE. 2495 */ 2496 static boolean_t 2497 smb_lgrp_exists(char *gname) 2498 { 2499 sqlite *db; 2500 boolean_t rc; 2501 2502 if (!smb_lgrp_normalize_name(gname)) 2503 return (B_FALSE); 2504 2505 db = smb_lgrp_db_open(SMB_LGRP_DB_ORD); 2506 if (db == NULL) 2507 return (B_FALSE); 2508 2509 rc = smb_lgrp_gtbl_exists(db, gname); 2510 smb_lgrp_db_close(db); 2511 2512 return (rc); 2513 } 2514 2515 /* 2516 * smb_lgrp_pgrp_valid_gname 2517 * 2518 * Validate posix group name string. 2519 */ 2520 static int 2521 smb_lgrp_pgrp_valid_gname(char *group) 2522 { 2523 char *ptr = group; 2524 char c; 2525 int len = 0; 2526 int badchar = 0; 2527 2528 if (!group || !*group) 2529 return (SMB_LGRP_PGRP_INVALID); 2530 2531 for (c = *ptr; c != NULL; ptr++, c = *ptr) { 2532 len++; 2533 if (!isprint(c) || (c == ':') || (c == '\n')) 2534 return (SMB_LGRP_PGRP_INVALID); 2535 2536 if (!(islower(c) || isdigit(c))) 2537 badchar++; 2538 } 2539 2540 if ((len > SMB_LGRP_PGRP_MAXGLEN - 1) || (badchar != 0)) 2541 return (SMB_LGRP_PGRP_INVALID); 2542 2543 if (getgrnam(group) != NULL) 2544 return (SMB_LGRP_PGRP_NOTUNIQUE); 2545 2546 return (SMB_LGRP_PGRP_UNIQUE); 2547 } 2548 2549 /* 2550 * smb_lgrp_pgrp_add 2551 * 2552 * Create a posix group with the given name. 2553 * This group will be added to the /etc/group file. 2554 */ 2555 static int 2556 smb_lgrp_pgrp_add(char *group) 2557 { 2558 FILE *etcgrp; 2559 FILE *etctmp; 2560 int o_mask; 2561 int newdone = 0; 2562 struct stat sb; 2563 char buf[SMB_LGRP_PGRP_GRPBUFSIZ]; 2564 gid_t gid; 2565 int rc = 0; 2566 2567 rc = smb_lgrp_pgrp_valid_gname(group); 2568 if ((rc == SMB_LGRP_PGRP_INVALID) || (rc == SMB_LGRP_PGRP_NOTUNIQUE)) 2569 return (-1); 2570 2571 if ((findnextgid(SMB_LGRP_PGRP_DEFRID, MAXUID, &gid)) != 0) 2572 return (-1); 2573 2574 if ((etcgrp = fopen(SMB_LGRP_PGRP_GROUP, "r")) == NULL) 2575 return (-1); 2576 2577 if (fstat(fileno(etcgrp), &sb) < 0) 2578 sb.st_mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH; 2579 2580 o_mask = umask(077); 2581 etctmp = fopen(SMB_LGRP_PGRP_GRPTMP, "w+"); 2582 (void) umask(o_mask); 2583 2584 if (etctmp == NULL) { 2585 (void) fclose(etcgrp); 2586 return (-1); 2587 } 2588 2589 if (lockf(fileno(etctmp), F_LOCK, 0) != 0) { 2590 (void) fclose(etcgrp); 2591 (void) fclose(etctmp); 2592 (void) unlink(SMB_LGRP_PGRP_GRPTMP); 2593 return (-1); 2594 } 2595 2596 if (fchmod(fileno(etctmp), sb.st_mode) != 0 || 2597 fchown(fileno(etctmp), sb.st_uid, sb.st_gid) != 0) { 2598 (void) lockf(fileno(etctmp), F_ULOCK, 0); 2599 (void) fclose(etcgrp); 2600 (void) fclose(etctmp); 2601 (void) unlink(SMB_LGRP_PGRP_GRPTMP); 2602 return (-1); 2603 } 2604 2605 while (fgets(buf, SMB_LGRP_PGRP_GRPBUFSIZ, etcgrp) != NULL) { 2606 /* Check for NameService reference */ 2607 if (!newdone && (buf[0] == '+' || buf[0] == '-')) { 2608 (void) fprintf(etctmp, "%s::%u:\n", group, gid); 2609 newdone = 1; 2610 } 2611 2612 (void) fputs(buf, etctmp); 2613 } 2614 (void) fclose(etcgrp); 2615 2616 if (!newdone) 2617 (void) fprintf(etctmp, "%s::%u:\n", group, gid); 2618 2619 if (rename(SMB_LGRP_PGRP_GRPTMP, SMB_LGRP_PGRP_GROUP) < 0) { 2620 (void) lockf(fileno(etctmp), F_ULOCK, 0); 2621 (void) fclose(etctmp); 2622 (void) unlink(SMB_LGRP_PGRP_GRPTMP); 2623 return (-1); 2624 } 2625 2626 (void) lockf(fileno(etctmp), F_ULOCK, 0); 2627 (void) fclose(etctmp); 2628 return (0); 2629 } 2630