Loading CMakeLists.txt +1 −0 Changes for CMakeLists.txt: 1 added line, 0 removed lines. Original line number Diff line number Diff line Loading @@ -60,6 +60,7 @@ add_library(adconnect_core STATIC src/join.cpp src/acceptor.cpp src/home.cpp src/migrate.cpp src/netlogon.cpp ) target_link_libraries(adconnect_core PUBLIC adconnect_proto confplus::confplus netplus::netplus Threads::Threads) Loading src/daemon.cpp +35 −4 Changes for src/daemon.cpp: 35 added lines, 4 removed lines. Original line number Diff line number Diff line Loading @@ -65,6 +65,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #include "gssapi.h" #include "home.h" #include "join.h" #include "migrate.h" #include "netlogon.h" #include "protocol.h" Loading Loading @@ -500,7 +501,10 @@ void usage() { " -l leave DOMAIN: its computer account deleted (an administrator's password)\n" " -n only read the configuration (no network), then exit\n" " -t connect and bind to a domain controller of each domain, then exit\n" " -q answer one request (\"PWNAM jan\", \"GROUPS jan\", ...) and exit\n"; " -q answer one request (\"PWNAM jan\", \"GROUPS jan\", ...) and exit\n" " adconnectd [-c config] -M DIR [-y]\n" " -M id_mapping guid -> uuid: tell which files under DIR are owned by GUID\n" " ids of accounts that now have UUID ids; -y changes them\n"; } } // namespace Loading @@ -509,11 +513,11 @@ int main(int argc, char **argv) { /* adconnect.so steps aside in here: our own user lookups must not ask us */ setenv("ADCONNECT_DAEMON", "1", 1); std::string configPath = ADCONNECT_CONFIG, query; bool check = false, parseOnly = false; std::string configPath = ADCONNECT_CONFIG, query, migrateRoot; bool check = false, parseOnly = false, migrateApply = false; std::string joinDomainName, joinAdmin, leaveDomainName, secretDir = "/etc/adconnect"; int opt; while ((opt = getopt(argc, argv, "c:ntq:j:l:u:s:h")) != -1) { while ((opt = getopt(argc, argv, "c:ntq:j:l:u:s:M:yh")) != -1) { switch (opt) { case 'c': configPath = optarg; break; case 'j': joinDomainName = optarg; break; Loading @@ -523,6 +527,8 @@ int main(int argc, char **argv) { case 'n': parseOnly = true; break; case 't': check = true; break; case 'q': query = optarg; break; case 'M': migrateRoot = optarg; break; case 'y': migrateApply = true; break; default: usage(); return opt == 'h' ? 0 : 2; } } Loading Loading @@ -609,6 +615,31 @@ int main(int argc, char **argv) { } return failed ? 1 : 0; } if (!migrateRoot.empty()) { /* only domains with id_mapping uuid have UUID ids for GUID owners */ auto account = [&s](bool group, const std::string &uuid) { for (auto &d : s.domains) { if (d->cfg.idMapping != IdMapping::Uuid) continue; std::lock_guard<std::mutex> l(d->lock); Response r; std::string error; if (!parseResponse(d->dir.handle(group ? Cmd::GrGid : Cmd::PwUid, uuid), r, &error)) throw std::runtime_error(d->cfg.domain + ": " + error); if (!r.users.empty() || !r.groups.empty()) return true; } return false; }; try { MigrateStats st = migrateGuidOwners(migrateRoot, account, migrateApply, std::cout); std::cout << "adconnectd: " << st.files << " files, " << st.changed << (migrateApply ? " changed, " : " to change, ") << st.unknown << " with GUIDs of no account, " << st.acls << " with ACLs to set again, " << st.failed << " failed" << std::endl; return st.failed ? 1 : 0; } catch (const std::exception &e) { std::cerr << "adconnectd: " << e.what() << std::endl; return 1; } } if (!query.empty()) { Cmd cmd; std::string arg, out, error; Loading src/migrate.cpp 0 → 100644 +152 −0 Changes for src/migrate.cpp: 152 added lines, 0 removed lines. Original line number Diff line number Diff line /******************************************************************************* Copyright (c) 2026, Jan Koester jan.koester@gmx.net All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of the <organization> nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. *******************************************************************************/ #include "migrate.h" #include <cerrno> #include <cstring> #include <map> #include <stdexcept> #include <string> #include <fcntl.h> #include <ftw.h> #include <sys/uid_r.h> #include <sys/xattr.h> #include "directory.h" namespace adconnect { namespace { /* nftw() has no context argument */ struct Walk { const UuidAccount *account; bool apply; std::ostream *log; MigrateStats stats; std::map<std::string, bool> known; /* "u <uuid>" / "g <uuid>" -> an account of ours */ std::string error; /* the directory failed: stop */ }; thread_local Walk *walk; /* the UUID id an account has for this GUID id, or none (UID_R_NONE); * throws if the directory can't say */ uid_r_t uuidFor(const uid_r_t &id, bool group) { uid_r_t none; memset(&none, 0, sizeof none); if (id.type != UID_R_GUID) return none; std::string text = uuidText(std::string((const char *)id.guid, 16)); if (text.empty()) return none; /* the bytes are no version 4 UUID: no fenrirds account */ std::string key = (group ? "g " : "u ") + text; auto it = walk->known.find(key); bool ours = it != walk->known.end() ? it->second : (walk->known[key] = (*walk->account)(group, text)); uid_r_t out = none; if (ours && uid_r_from_str(text.c_str(), &out) != 0) return none; return ours ? out : none; } bool hasAcl(const char *path) { char names[4096]; ssize_t n = llistxattr(path, names, sizeof names); for (ssize_t p = 0; p < n; p += (ssize_t)strlen(names + p) + 1) if (!strcmp(names + p, "system.posix_acl_access") || !strcmp(names + p, "system.posix_acl_default") || !strcmp(names + p, "security.NTACL")) return true; return n < 0 && errno == ERANGE; } int visit(const char *path, const struct stat *, int type, struct FTW *) { if (type == FTW_NS || type == FTW_DNR) { *walk->log << "cannot read " << path << "\n"; walk->stats.failed++; return 0; } walk->stats.files++; uid_r_t owner, group; if (fstatat_id_r(AT_FDCWD, path, &owner, &group, AT_SYMLINK_NOFOLLOW) != 0) { *walk->log << path << ": " << strerror(errno) << "\n"; walk->stats.failed++; return 0; } if (owner.type != UID_R_GUID && group.type != UID_R_GUID) return 0; uid_r_t newOwner, newGroup; try { newOwner = uuidFor(owner, false); newGroup = uuidFor(group, true); } catch (const std::exception &e) { walk->error = e.what(); return 1; /* no exception through nftw() */ } char a[UID_R_STR_LEN], b[UID_R_STR_LEN]; if ((owner.type == UID_R_GUID && newOwner.type == UID_R_NONE) || (group.type == UID_R_GUID && newGroup.type == UID_R_NONE)) { *walk->log << path << ": " << (owner.type == UID_R_GUID && newOwner.type == UID_R_NONE ? uid_r_to_str(&owner, a) : uid_r_to_str(&group, a)) << " is no account of a uuid domain: left as it is\n"; walk->stats.unknown++; } if (newOwner.type == UID_R_NONE && newGroup.type == UID_R_NONE) return 0; *walk->log << (walk->apply ? "" : "would change ") << path; if (newOwner.type != UID_R_NONE) *walk->log << " owner " << uid_r_to_str(&owner, a) << " -> " << uid_r_to_str(&newOwner, b); if (newGroup.type != UID_R_NONE) *walk->log << " group " << uid_r_to_str(&group, a) << " -> " << uid_r_to_str(&newGroup, b); *walk->log << "\n"; if (hasAcl(path)) { *walk->log << path << ": has ACLs -- their GUID entries stay, set them again\n"; walk->stats.acls++; } if (!walk->apply) { walk->stats.changed++; return 0; } /* UID_R_NONE: that one unchanged */ if (fchownat_r(AT_FDCWD, path, &newOwner, &newGroup, AT_SYMLINK_NOFOLLOW) != 0) { *walk->log << path << ": " << strerror(errno) << "\n"; walk->stats.failed++; return 0; } walk->stats.changed++; return 0; } } // namespace MigrateStats migrateGuidOwners(const std::string &root, const UuidAccount &account, bool apply, std::ostream &log) { Walk w{ &account, apply, &log, {}, {}, {} }; walk = &w; int rc = nftw(root.c_str(), visit, 64, FTW_PHYS | FTW_MOUNT); walk = nullptr; if (!w.error.empty()) throw std::runtime_error("the directory can't be asked, stopped: " + w.error); if (rc != 0) { log << root << ": " << strerror(errno) << "\n"; w.stats.failed++; } return w.stats; } } // namespace adconnect src/migrate.h 0 → 100644 +59 −0 Changes for src/migrate.h: 59 added lines, 0 removed lines. Original line number Diff line number Diff line /******************************************************************************* Copyright (c) 2026, Jan Koester jan.koester@gmx.net All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of the <organization> nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. *******************************************************************************/ /* id_mapping guid -> uuid (FenrirDirectoryServer): files owned by the GUID * ids accounts had under id_mapping guid get the accounts' UUID ids. * * Both mappings take the same 16 objectGUID bytes, so the account's UUID id * holds the bytes its GUID id held. A GUID owner is changed only if the * directory (a domain with id_mapping uuid) has a user -- or for the group, * a group -- with exactly that id: never by changing the kind alone, and * never for a GUID no account of ours has (another domain's, or a deleted * account's). ACL entries are reported, not changed: POSIX ACLs and ksmbd's * security.NTACL need to be set again (setfacl, or from Windows). */ #pragma once #include <functional> #include <ostream> #include <string> namespace adconnect { struct MigrateStats { unsigned long files = 0, changed = 0, unknown = 0, failed = 0, acls = 0; }; /* whether the user (group false) or group with this UUID id (text form) * is one of the directory's; throws when the directory can't be asked */ using UuidAccount = std::function<bool(bool group, const std::string &uuid)>; /* walks root (not into other filesystems, not following links); changes * owners only with apply, else just tells */ MigrateStats migrateGuidOwners(const std::string &root, const UuidAccount &account, bool apply, std::ostream &log); } // namespace adconnect Loading
CMakeLists.txt +1 −0 Changes for CMakeLists.txt: 1 added line, 0 removed lines. Original line number Diff line number Diff line Loading @@ -60,6 +60,7 @@ add_library(adconnect_core STATIC src/join.cpp src/acceptor.cpp src/home.cpp src/migrate.cpp src/netlogon.cpp ) target_link_libraries(adconnect_core PUBLIC adconnect_proto confplus::confplus netplus::netplus Threads::Threads) Loading
src/daemon.cpp +35 −4 Changes for src/daemon.cpp: 35 added lines, 4 removed lines. Original line number Diff line number Diff line Loading @@ -65,6 +65,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #include "gssapi.h" #include "home.h" #include "join.h" #include "migrate.h" #include "netlogon.h" #include "protocol.h" Loading Loading @@ -500,7 +501,10 @@ void usage() { " -l leave DOMAIN: its computer account deleted (an administrator's password)\n" " -n only read the configuration (no network), then exit\n" " -t connect and bind to a domain controller of each domain, then exit\n" " -q answer one request (\"PWNAM jan\", \"GROUPS jan\", ...) and exit\n"; " -q answer one request (\"PWNAM jan\", \"GROUPS jan\", ...) and exit\n" " adconnectd [-c config] -M DIR [-y]\n" " -M id_mapping guid -> uuid: tell which files under DIR are owned by GUID\n" " ids of accounts that now have UUID ids; -y changes them\n"; } } // namespace Loading @@ -509,11 +513,11 @@ int main(int argc, char **argv) { /* adconnect.so steps aside in here: our own user lookups must not ask us */ setenv("ADCONNECT_DAEMON", "1", 1); std::string configPath = ADCONNECT_CONFIG, query; bool check = false, parseOnly = false; std::string configPath = ADCONNECT_CONFIG, query, migrateRoot; bool check = false, parseOnly = false, migrateApply = false; std::string joinDomainName, joinAdmin, leaveDomainName, secretDir = "/etc/adconnect"; int opt; while ((opt = getopt(argc, argv, "c:ntq:j:l:u:s:h")) != -1) { while ((opt = getopt(argc, argv, "c:ntq:j:l:u:s:M:yh")) != -1) { switch (opt) { case 'c': configPath = optarg; break; case 'j': joinDomainName = optarg; break; Loading @@ -523,6 +527,8 @@ int main(int argc, char **argv) { case 'n': parseOnly = true; break; case 't': check = true; break; case 'q': query = optarg; break; case 'M': migrateRoot = optarg; break; case 'y': migrateApply = true; break; default: usage(); return opt == 'h' ? 0 : 2; } } Loading Loading @@ -609,6 +615,31 @@ int main(int argc, char **argv) { } return failed ? 1 : 0; } if (!migrateRoot.empty()) { /* only domains with id_mapping uuid have UUID ids for GUID owners */ auto account = [&s](bool group, const std::string &uuid) { for (auto &d : s.domains) { if (d->cfg.idMapping != IdMapping::Uuid) continue; std::lock_guard<std::mutex> l(d->lock); Response r; std::string error; if (!parseResponse(d->dir.handle(group ? Cmd::GrGid : Cmd::PwUid, uuid), r, &error)) throw std::runtime_error(d->cfg.domain + ": " + error); if (!r.users.empty() || !r.groups.empty()) return true; } return false; }; try { MigrateStats st = migrateGuidOwners(migrateRoot, account, migrateApply, std::cout); std::cout << "adconnectd: " << st.files << " files, " << st.changed << (migrateApply ? " changed, " : " to change, ") << st.unknown << " with GUIDs of no account, " << st.acls << " with ACLs to set again, " << st.failed << " failed" << std::endl; return st.failed ? 1 : 0; } catch (const std::exception &e) { std::cerr << "adconnectd: " << e.what() << std::endl; return 1; } } if (!query.empty()) { Cmd cmd; std::string arg, out, error; Loading
src/migrate.cpp 0 → 100644 +152 −0 Changes for src/migrate.cpp: 152 added lines, 0 removed lines. Original line number Diff line number Diff line /******************************************************************************* Copyright (c) 2026, Jan Koester jan.koester@gmx.net All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of the <organization> nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. *******************************************************************************/ #include "migrate.h" #include <cerrno> #include <cstring> #include <map> #include <stdexcept> #include <string> #include <fcntl.h> #include <ftw.h> #include <sys/uid_r.h> #include <sys/xattr.h> #include "directory.h" namespace adconnect { namespace { /* nftw() has no context argument */ struct Walk { const UuidAccount *account; bool apply; std::ostream *log; MigrateStats stats; std::map<std::string, bool> known; /* "u <uuid>" / "g <uuid>" -> an account of ours */ std::string error; /* the directory failed: stop */ }; thread_local Walk *walk; /* the UUID id an account has for this GUID id, or none (UID_R_NONE); * throws if the directory can't say */ uid_r_t uuidFor(const uid_r_t &id, bool group) { uid_r_t none; memset(&none, 0, sizeof none); if (id.type != UID_R_GUID) return none; std::string text = uuidText(std::string((const char *)id.guid, 16)); if (text.empty()) return none; /* the bytes are no version 4 UUID: no fenrirds account */ std::string key = (group ? "g " : "u ") + text; auto it = walk->known.find(key); bool ours = it != walk->known.end() ? it->second : (walk->known[key] = (*walk->account)(group, text)); uid_r_t out = none; if (ours && uid_r_from_str(text.c_str(), &out) != 0) return none; return ours ? out : none; } bool hasAcl(const char *path) { char names[4096]; ssize_t n = llistxattr(path, names, sizeof names); for (ssize_t p = 0; p < n; p += (ssize_t)strlen(names + p) + 1) if (!strcmp(names + p, "system.posix_acl_access") || !strcmp(names + p, "system.posix_acl_default") || !strcmp(names + p, "security.NTACL")) return true; return n < 0 && errno == ERANGE; } int visit(const char *path, const struct stat *, int type, struct FTW *) { if (type == FTW_NS || type == FTW_DNR) { *walk->log << "cannot read " << path << "\n"; walk->stats.failed++; return 0; } walk->stats.files++; uid_r_t owner, group; if (fstatat_id_r(AT_FDCWD, path, &owner, &group, AT_SYMLINK_NOFOLLOW) != 0) { *walk->log << path << ": " << strerror(errno) << "\n"; walk->stats.failed++; return 0; } if (owner.type != UID_R_GUID && group.type != UID_R_GUID) return 0; uid_r_t newOwner, newGroup; try { newOwner = uuidFor(owner, false); newGroup = uuidFor(group, true); } catch (const std::exception &e) { walk->error = e.what(); return 1; /* no exception through nftw() */ } char a[UID_R_STR_LEN], b[UID_R_STR_LEN]; if ((owner.type == UID_R_GUID && newOwner.type == UID_R_NONE) || (group.type == UID_R_GUID && newGroup.type == UID_R_NONE)) { *walk->log << path << ": " << (owner.type == UID_R_GUID && newOwner.type == UID_R_NONE ? uid_r_to_str(&owner, a) : uid_r_to_str(&group, a)) << " is no account of a uuid domain: left as it is\n"; walk->stats.unknown++; } if (newOwner.type == UID_R_NONE && newGroup.type == UID_R_NONE) return 0; *walk->log << (walk->apply ? "" : "would change ") << path; if (newOwner.type != UID_R_NONE) *walk->log << " owner " << uid_r_to_str(&owner, a) << " -> " << uid_r_to_str(&newOwner, b); if (newGroup.type != UID_R_NONE) *walk->log << " group " << uid_r_to_str(&group, a) << " -> " << uid_r_to_str(&newGroup, b); *walk->log << "\n"; if (hasAcl(path)) { *walk->log << path << ": has ACLs -- their GUID entries stay, set them again\n"; walk->stats.acls++; } if (!walk->apply) { walk->stats.changed++; return 0; } /* UID_R_NONE: that one unchanged */ if (fchownat_r(AT_FDCWD, path, &newOwner, &newGroup, AT_SYMLINK_NOFOLLOW) != 0) { *walk->log << path << ": " << strerror(errno) << "\n"; walk->stats.failed++; return 0; } walk->stats.changed++; return 0; } } // namespace MigrateStats migrateGuidOwners(const std::string &root, const UuidAccount &account, bool apply, std::ostream &log) { Walk w{ &account, apply, &log, {}, {}, {} }; walk = &w; int rc = nftw(root.c_str(), visit, 64, FTW_PHYS | FTW_MOUNT); walk = nullptr; if (!w.error.empty()) throw std::runtime_error("the directory can't be asked, stopped: " + w.error); if (rc != 0) { log << root << ": " << strerror(errno) << "\n"; w.stats.failed++; } return w.stats; } } // namespace adconnect
src/migrate.h 0 → 100644 +59 −0 Changes for src/migrate.h: 59 added lines, 0 removed lines. Original line number Diff line number Diff line /******************************************************************************* Copyright (c) 2026, Jan Koester jan.koester@gmx.net All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of the <organization> nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. *******************************************************************************/ /* id_mapping guid -> uuid (FenrirDirectoryServer): files owned by the GUID * ids accounts had under id_mapping guid get the accounts' UUID ids. * * Both mappings take the same 16 objectGUID bytes, so the account's UUID id * holds the bytes its GUID id held. A GUID owner is changed only if the * directory (a domain with id_mapping uuid) has a user -- or for the group, * a group -- with exactly that id: never by changing the kind alone, and * never for a GUID no account of ours has (another domain's, or a deleted * account's). ACL entries are reported, not changed: POSIX ACLs and ksmbd's * security.NTACL need to be set again (setfacl, or from Windows). */ #pragma once #include <functional> #include <ostream> #include <string> namespace adconnect { struct MigrateStats { unsigned long files = 0, changed = 0, unknown = 0, failed = 0, acls = 0; }; /* whether the user (group false) or group with this UUID id (text form) * is one of the directory's; throws when the directory can't be asked */ using UuidAccount = std::function<bool(bool group, const std::string &uuid)>; /* walks root (not into other filesystems, not following links); changes * owners only with apply, else just tells */ MigrateStats migrateGuidOwners(const std::string &root, const UuidAccount &account, bool apply, std::ostream &log); } // namespace adconnect
