summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatthias Dieter Wallnöfer <mwallnoefer@yahoo.de>2009-10-03 10:52:53 +0200
committerMatthias Dieter Wallnöfer <mwallnoefer@yahoo.de>2009-10-03 10:52:53 +0200
commit90828cc7022807a6036700d0edc8061c408ef8a7 (patch)
treee433c5d7e16aaab7164784970d2cbd7e34b75e23
parentdeb268f7facd05a10607c5290138b5c0ec33ff49 (diff)
downloadsamba-90828cc7022807a6036700d0edc8061c408ef8a7.tar.gz
samba-90828cc7022807a6036700d0edc8061c408ef8a7.tar.bz2
samba-90828cc7022807a6036700d0edc8061c408ef8a7.zip
s4:dsdb Don't allow creation of systemOnly objectclasses
(except as part of the provision, which specifies the 'relax' control) Andrew Bartlett
-rw-r--r--source4/dsdb/samdb/ldb_modules/objectclass.c6
-rw-r--r--source4/dsdb/samdb/ldb_modules/repl_meta_data.c8
2 files changed, 10 insertions, 4 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/objectclass.c b/source4/dsdb/samdb/ldb_modules/objectclass.c
index 6d22141a3b..b3d54612dd 100644
--- a/source4/dsdb/samdb/ldb_modules/objectclass.c
+++ b/source4/dsdb/samdb/ldb_modules/objectclass.c
@@ -561,6 +561,12 @@ static int objectclass_do_add(struct oc_context *ac)
return LDB_ERR_NAMING_VIOLATION;
}
+ if (current->objectclass->systemOnly && !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
+ ldb_asprintf_errstring(ldb, "objectClass %s is systemOnly, rejecting creation of %s",
+ current->objectclass->lDAPDisplayName, ldb_dn_get_linearized(msg->dn));
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
+
if (!ldb_msg_find_element(msg, "objectCategory")) {
value = talloc_strdup(msg, current->objectclass->defaultObjectCategory);
if (value == NULL) {
diff --git a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
index 489985a22f..74dd7e5bbb 100644
--- a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
+++ b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
@@ -476,10 +476,10 @@ static int replmd_add(struct ldb_module *module, struct ldb_request *req)
char *time_str;
int ret;
uint32_t i, ni=0;
- int allow_add_guid=0;
- int remove_current_guid=0;
+ bool allow_add_guid = false;
+ bool remove_current_guid = false;
- /* check if there's a show deleted control */
+ /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
control = ldb_request_get_control(req, LDB_CONTROL_RELAX_OID);
if (control) {
allow_add_guid = 1;
@@ -526,7 +526,7 @@ static int replmd_add(struct ldb_module *module, struct ldb_request *req)
}
/* we remove this attribute as it can be a string and will not be treated
correctly and then we will readd it latter on in the good format*/
- remove_current_guid = 1;
+ remove_current_guid = true;
}
} else {
/* a new GUID */