diff options
| author | Andrew Tridgell <tridge@samba.org> | 2011-07-11 15:32:12 +1000 |
|---|---|---|
| committer | Andrew Tridgell <tridge@samba.org> | 2011-07-13 12:51:04 +0200 |
| commit | 0214b7f20cfcecd3d51aa12ae4e31cc4e095d73b (patch) | |
| tree | 9a27cbf710ba115bd0bbb6a6abb26ec966bd9f17 /source4/dsdb/samdb/ldb_modules/samldb.c | |
| parent | e858ec6e92c0232bbf82dc117c03b71e9a413be3 (diff) | |
| download | samba-0214b7f20cfcecd3d51aa12ae4e31cc4e095d73b.tar.gz samba-0214b7f20cfcecd3d51aa12ae4e31cc4e095d73b.tar.bz2 samba-0214b7f20cfcecd3d51aa12ae4e31cc4e095d73b.zip | |
s4-dsdb: moved checking of duplicate member entries to repl_meta_data.c
the samldb checks failed to account for the possibility of a member
being removed and added in the same modify operation. This happens
(for example) when dbcheck is fixing a SID in a DN.
The repl_meta_data.c code already has this check, it just wasn't
giving the right specialised error code for the 'member' attribute
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
Pair-Programmed-With: Amitay Isaacs <amitay@gmail.com>
Diffstat (limited to 'source4/dsdb/samdb/ldb_modules/samldb.c')
| -rw-r--r-- | source4/dsdb/samdb/ldb_modules/samldb.c | 35 |
1 files changed, 3 insertions, 32 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c index a61920f2af..0fe13e53cf 100644 --- a/source4/dsdb/samdb/ldb_modules/samldb.c +++ b/source4/dsdb/samdb/ldb_modules/samldb.c @@ -1568,7 +1568,6 @@ static int samldb_member_check(struct samldb_ctx *ac) struct ldb_result *res; struct dom_sid *group_sid; unsigned int i, j; - int cnt; int ret; /* Fetch information from the existing object */ @@ -1596,7 +1595,6 @@ static int samldb_member_check(struct samldb_ctx *ac) el = &ac->msg->elements[i]; for (j = 0; j < el->num_values; j++) { - struct ldb_message_element *mo; struct ldb_result *group_res; const char *group_attrs[] = { "primaryGroupID" , NULL }; uint32_t prim_group_rid; @@ -1607,36 +1605,6 @@ static int samldb_member_check(struct samldb_ctx *ac) return ldb_operr(ldb); } - /* The "member" attribute can be modified with the - * following restrictions (beside a valid DN): - * - * - "add" operations can only be performed when the - * member still doesn't exist - if not then return - * ERR_ENTRY_ALREADY_EXISTS (not - * ERR_ATTRIBUTE_OR_VALUE_EXISTS!) - * - "delete" operations can only be performed when the - * member does exist - if not then return - * ERR_UNWILLING_TO_PERFORM (not - * ERR_NO_SUCH_ATTRIBUTE!) - * - primary group check - */ - mo = samdb_find_attribute(ldb, res->msgs[0], "member", - ldb_dn_get_linearized(member_dn)); - if (mo == NULL) { - cnt = 0; - } else { - cnt = 1; - } - - if ((cnt > 0) && (LDB_FLAG_MOD_TYPE(el->flags) - == LDB_FLAG_MOD_ADD)) { - return LDB_ERR_ENTRY_ALREADY_EXISTS; - } - if ((cnt == 0) && LDB_FLAG_MOD_TYPE(el->flags) - == LDB_FLAG_MOD_DELETE) { - return LDB_ERR_UNWILLING_TO_PERFORM; - } - /* Denies to add "member"s to groups which are primary * ones for them - in this case return * ERR_ENTRY_ALREADY_EXISTS. */ @@ -1665,6 +1633,9 @@ static int samldb_member_check(struct samldb_ctx *ac) } if (dom_sid_equal(group_sid, sid)) { + ldb_asprintf_errstring(ldb, + "samldb: member %s already set via primaryGroupID %u", + ldb_dn_get_linearized(member_dn), prim_group_rid); return LDB_ERR_ENTRY_ALREADY_EXISTS; } } |