summaryrefslogtreecommitdiff
path: root/source4/dsdb
diff options
context:
space:
mode:
authorMatthias Dieter Wallnöfer <mdw@samba.org>2010-08-05 21:40:11 +0200
committerMatthias Dieter Wallnöfer <mdw@samba.org>2010-08-07 14:22:41 +0200
commit7d62128e2cce540043df84d51967e43bdca4c493 (patch)
treef45253533e05142aed87bd73064bbfae3d6332cd /source4/dsdb
parenta3c6d4c4d52c174d7fcac73fb315dc7e7c03fdd9 (diff)
downloadsamba-7d62128e2cce540043df84d51967e43bdca4c493.tar.gz
samba-7d62128e2cce540043df84d51967e43bdca4c493.tar.bz2
samba-7d62128e2cce540043df84d51967e43bdca4c493.zip
s4:objectclass LDB module - "add operation" - reject creation of LSA specific objects
(only using the RELAX flag allowed)
Diffstat (limited to 'source4/dsdb')
-rw-r--r--source4/dsdb/samdb/ldb_modules/objectclass.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/objectclass.c b/source4/dsdb/samdb/ldb_modules/objectclass.c
index 4feb8c3849..d280298174 100644
--- a/source4/dsdb/samdb/ldb_modules/objectclass.c
+++ b/source4/dsdb/samdb/ldb_modules/objectclass.c
@@ -571,6 +571,14 @@ static int objectclass_do_add(struct oc_context *ac)
return LDB_ERR_UNWILLING_TO_PERFORM;
}
+ if (((strcmp(objectclass->lDAPDisplayName, "secret") == 0) ||
+ (strcmp(objectclass->lDAPDisplayName, "trustedDomain") == 0)) &&
+ !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
+ ldb_asprintf_errstring(ldb, "objectClass %s is LSA-specific, rejecting creation of %s",
+ objectclass->lDAPDisplayName, ldb_dn_get_linearized(msg->dn));
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
+
if (ac->search_res && ac->search_res->message) {
struct ldb_message_element *oc_el
= ldb_msg_find_element(ac->search_res->message, "objectClass");