summaryrefslogtreecommitdiff
path: root/source4/dsdb
diff options
context:
space:
mode:
authorMatthias Dieter Wallnöfer <mdw@samba.org>2010-09-29 18:18:55 +0200
committerMatthias Dieter Wallnöfer <mdw@sn-devel-104.sn.samba.org>2010-10-03 16:50:06 +0000
commitca08cde15029b6d8efdc562daf35d49f4fdbd4de (patch)
treee01dc7a2ebf591f62e51fe07146ca5878c6c0439 /source4/dsdb
parent4e8206eb4c74de05aa0657fc36ad1569b96a8900 (diff)
downloadsamba-ca08cde15029b6d8efdc562daf35d49f4fdbd4de.tar.gz
samba-ca08cde15029b6d8efdc562daf35d49f4fdbd4de.tar.bz2
samba-ca08cde15029b6d8efdc562daf35d49f4fdbd4de.zip
s4:objectclass LDB module - introduce allowed system flags restriction
Let us do the distinction by real use and provision by the RELAX flag Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'source4/dsdb')
-rw-r--r--source4/dsdb/samdb/ldb_modules/objectclass.c17
1 files changed, 11 insertions, 6 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/objectclass.c b/source4/dsdb/samdb/ldb_modules/objectclass.c
index 82c4144f22..fa956269f4 100644
--- a/source4/dsdb/samdb/ldb_modules/objectclass.c
+++ b/source4/dsdb/samdb/ldb_modules/objectclass.c
@@ -696,13 +696,18 @@ static int objectclass_do_add(struct oc_context *ac)
ldb_msg_remove_attr(msg, "systemFlags");
- /* Only these flags may be set by a client, but we can't tell
- * between a client and our provision at this point
- * systemFlags &= ( SYSTEM_FLAG_CONFIG_ALLOW_RENAME | SYSTEM_FLAG_CONFIG_ALLOW_MOVE | SYSTEM_FLAG_CONFIG_LIMITED_MOVE);
- */
+ /* Only the following flags may be set by a client */
+ if (ldb_request_get_control(ac->req,
+ LDB_CONTROL_RELAX_OID) == NULL) {
+ systemFlags &= ( SYSTEM_FLAG_CONFIG_ALLOW_RENAME
+ | SYSTEM_FLAG_CONFIG_ALLOW_MOVE
+ | SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE
+ | SYSTEM_FLAG_ATTR_IS_RDN );
+ }
- /* This flag is only allowed on attributeSchema objects */
- if (ldb_attr_cmp(objectclass->lDAPDisplayName, "attributeSchema") == 0) {
+ /* But the last one ("ATTR_IS_RDN") is only allowed on
+ * "attributeSchema" objects. So truncate if it does not fit. */
+ if (ldb_attr_cmp(objectclass->lDAPDisplayName, "attributeSchema") != 0) {
systemFlags &= ~SYSTEM_FLAG_ATTR_IS_RDN;
}