diff options
| author | Matthias Dieter Wallnöfer <mdw@samba.org> | 2010-11-25 09:33:47 +0100 |
|---|---|---|
| committer | Matthias Dieter Wallnöfer <mdw@samba.org> | 2010-11-25 13:05:56 +0100 |
| commit | ae61408e2f198ada294a826e375f0f4a1e7da3d6 (patch) | |
| tree | 967703ee0348db38c1ac7b22aed0481330697b10 /source4/dsdb/samdb/ldb_modules | |
| parent | fc1da86d403c654fc96a6b1410147fe93dee0a39 (diff) | |
| download | samba-ae61408e2f198ada294a826e375f0f4a1e7da3d6.tar.gz samba-ae61408e2f198ada294a826e375f0f4a1e7da3d6.tar.bz2 samba-ae61408e2f198ada294a826e375f0f4a1e7da3d6.zip | |
s4:lsa RPC server / objectclass LDB module - fix the creation of trusted domain objects
Tridge pointed out that it is to dangerous to allow them to be created
with SYSTEM permissions. The solution using the "untrusted" flag should
be much more viable.
Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Thu Nov 25 13:05:56 CET 2010 on sn-devel-104
Diffstat (limited to 'source4/dsdb/samdb/ldb_modules')
| -rw-r--r-- | source4/dsdb/samdb/ldb_modules/objectclass.c | 8 |
1 files changed, 1 insertions, 7 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/objectclass.c b/source4/dsdb/samdb/ldb_modules/objectclass.c index d69c3f4d05..21f316400a 100644 --- a/source4/dsdb/samdb/ldb_modules/objectclass.c +++ b/source4/dsdb/samdb/ldb_modules/objectclass.c @@ -467,8 +467,6 @@ static int objectclass_do_add(struct oc_context *ac) struct ldb_request *add_req; struct ldb_message_element *objectclass_element, *el; struct ldb_message *msg; - struct ldb_control *as_system = ldb_request_get_control(ac->req, - LDB_CONTROL_AS_SYSTEM_OID); TALLOC_CTX *mem_ctx; struct class_list *sorted, *current; const char *rdn_name = NULL; @@ -480,10 +478,6 @@ static int objectclass_do_add(struct oc_context *ac) bool found; int ret; - if (as_system != NULL) { - as_system->critical = 0; - } - msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message); if (msg == NULL) { return ldb_module_oom(ac->module); @@ -581,7 +575,7 @@ static int objectclass_do_add(struct oc_context *ac) /* LSA-specific objectclasses per default not allowed */ if (((strcmp(value, "secret") == 0) || (strcmp(value, "trustedDomain") == 0)) && - !(dsdb_module_am_system(ac->module) || as_system)) { + ldb_req_is_untrusted(ac->req)) { ldb_asprintf_errstring(ldb, "objectclass: object class '%s' is LSA-specific, rejecting creation of '%s'!", value, |