summaryrefslogtreecommitdiff
path: root/source4/dsdb/samdb/ldb_modules/descriptor.c
AgeCommit message (Collapse)AuthorFilesLines
2013-07-24dsdb-descriptor: Do not do a subtree search unless we have child entriesAndrew Bartlett1-1/+32
This avoids a subtree search here in most cases where an object is deleted. Andrew Bartlett Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-02-22dsdb-descriptor: Avoid segfault copying an SD without an owner or groupAndrew Bartlett1-4/+12
This is an unusual SD, but it does exist is some very old upgraded databases. Andrew Bartlett Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Fri Feb 22 11:06:17 CET 2013 on sn-devel-104
2013-02-22dsdb-descriptor: Spell out security descriptor flags as constantsAndrew Bartlett1-1/+1
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-27dsdb-descriptor: get_default_group() should always return the DAG sid (bug ↵Stefan Metzmacher1-5/+10
#9481) Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2012-12-11s4:dsdb/descriptor: pass object_list to create_security_descriptor()Stefan Metzmacher1-2/+13
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-12-07s4:dsdb/descriptor: fix replication of NC headsStefan Metzmacher1-2/+2
The sub NC heads maybe replicated with the parent partition, if we don't need to recalculate the nTSecurityDescriptor attribute in that case, the replication of the of the sub partition should handle that. This fixes error messages like this: descriptor_sd_propagation_recursive: DC=ForestDnsZones,DC=s40dom,DC=base not found under DC=s40dom,DC=base Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-12-02s4:dsdb/descriptor: NULL out user_descriptor elements depending on the sd_flagsStefan Metzmacher1-0/+44
A client can send a full security_descriptor while just passing sd_flags of SECINFO_DACL. We need to NULL out elements which will be ignored depending on the sd_flags and may set the old owner/group sids. Otherwise the calculation of the DACL/SACL can replace CREATOR_OWNER with the wrong sid. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-30s4:dsdb/descriptor: inherit nTSecurityDescriptor changes to children (bug #8621)Stefan Metzmacher1-3/+17
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-30s4:dsdb/descriptor: recalculate nTSecurityDescriptor after a rename (bug #8621)Stefan Metzmacher1-1/+18
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-30s4:dsdb/descriptor: implement DSDB_EXTENDED_SEC_DESC_PROPAGATION_OIDStefan Metzmacher1-8/+395
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-30s4:dsdb/descriptor: handle DSDB_CONTROL_SEC_DESC_PROPAGATION_OIDStefan Metzmacher1-5/+67
This can only be triggered by ourself, that's why we expect control->data == module. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-30s4:dsdb/descriptor: the old nTSecurityDescriptor is always expected there on ↵Stefan Metzmacher1-0/+3
modify Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-30s4:dsdb/descriptor: make explicit that we don't support MOD_DELETE on ↵Stefan Metzmacher1-0/+11
nTSecurityDescriptor Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-30s4:dsdb/descriptor: remove some nesting from descriptor_modifyStefan Metzmacher1-10/+10
If the nTSecurityDescriptor attribute is not specified, we have nothing to do. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-30s4:dsdb/descriptor: remove some unnecessary nestingStefan Metzmacher1-10/+8
sd == NULL is checked before. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-30s4:dsdb/descriptor: add some error checks to descriptor_{add,modify}Stefan Metzmacher1-0/+12
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-30s4:dsdb/descriptor: remove support for unused LDB_CONTROL_RECALCULATE_SD_OIDStefan Metzmacher1-26/+1
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-30s4:dsdb/descriptor: move special dn check to the start of ↵Stefan Metzmacher1-19/+21
descriptor_{add,modify,rename} Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-30s4:dsdb/descriptor: if the caller specifies no DACL/SACL the objects gets a ↵Stefan Metzmacher1-1/+28
default one Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-30s4:dsdb/descriptor: give SYSTEM the correct default owner (group) sidStefan Metzmacher1-0/+6
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-30s4:dsdb/descriptor: make it clear that the SD Flags are ignored on addStefan Metzmacher1-1/+7
See [MS-ADTS] 6.1.3.2 SD Flags Control: ... When performing an LDAP add operation, the client can supply an SD flags control with the operation; however, it will be ignored by the server. ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-30s4:dsdb/descriptor: make use of dsdb_request_sd_flags()Stefan Metzmacher1-47/+15
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-30s4:dsdb/descriptor: always use descriptor_search_callback if we return ↵Stefan Metzmacher1-1/+12
nTSecurityDescriptor If the nTSecurityDescriptor is explicitly specified without the SD Flags control we should go through descriptor_search_callback(). This is not strictly needed at the moment, but makes the code clearer and might avoid surprises in the future. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-30s4:dsdb/descriptor: do searches for nTSecurityDescriptor AS_SYSTEM and with ↵Stefan Metzmacher1-11/+12
SHOW_RECYCLED Note that SHOW_RECYCLED implies SHOW_DELETED. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-05-19s4-dsdb: allow modification of some deleted object if the show-deleted ↵Matthieu Patou1-4/+9
control is presented Autobuild-User: Matthieu Patou <mat@samba.org> Autobuild-Date: Sat May 19 20:28:01 CEST 2012 on sn-devel-104
2012-04-11s4:dsdb/samdb/ldb_modules/schema.c - move "get_last_structural_class()" into ↵Matthias Dieter Wallnöfer1-3/+4
"util.c" And remove this helper module - it does not have much sense keeping it. Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Wed Apr 11 06:31:51 CEST 2012 on sn-devel-104
2012-04-11s4:dsdb - introduce a only constant-time "get_last_structural_class()" callMatthias Dieter Wallnöfer1-4/+2
With the redesign of the previous patches this has become possible.
2012-03-26s4-dsdb: use constant-time search for descriptor -> get_last_structural_class()Andrew Bartlett1-2/+2
The objectClass list is sorted at this point, as we are called below the objectclass module here, or are working from a search result. Andrew Bartlett Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Mon Mar 26 05:38:13 CEST 2012 on sn-devel-104
2012-03-26s4:dsdb - enhance "get_last_structural_class()" for optimisationsMatthias Dieter Wallnöfer1-2/+4
If the objectclass entry has been sorted before we are able to determine the (last) structural or 88 object class in constant time. Reviewed-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2011-11-16s4-dsdb: rework the NC detection for the descriptor calculationMatthieu Patou1-12/+31
This checks if instanceType attribute is available, and if INSTANCE_TYPE_IS_NC_HEAD bit is set. If the bit is set, then the DN is NC root and security descriptor is not inherited from parent SD. Signed-off-by: Amitay Isaacs <amitay@gmail.com>
2011-09-23build: avoid util.h as a public header name due to conflict with MacOSAndrew Bartlett1-1/+1
2011-03-19source4/dsdb/samdb: Fix prototypes for all functions.Jelmer Vernooij1-1/+1
2011-02-22s4-descriptor: Fixed a typo in a comment and clarified it a bit.Nadezhda Ivanova1-2/+2
Autobuild-User: Nadezhda Ivanova <nivanova@samba.org> Autobuild-Date: Tue Feb 22 12:39:23 CET 2011 on sn-devel-104
2011-02-22s4-descriptor: Fixed some missing curly braces.Nadezhda Ivanova1-10/+13
2011-02-21s4-descriptor: Fixed some compiler warnings.Nadezhda Ivanova1-2/+2
Autobuild-User: Nadezhda Ivanova <nivanova@samba.org> Autobuild-Date: Mon Feb 21 18:02:21 CET 2011 on sn-devel-104
2011-02-21s4-descriptor: Removed unnecessary descriptor_change function and unused ↵Nadezhda Ivanova1-387/+0
callbacks.
2011-02-21s4-descriptor: Replaced the async descriptor_change with synchronous ↵Nadezhda Ivanova1-1/+149
descriptor_modify. The purpose is to make descriptor module synchronous. This will simplify reading and debugging, and also will make the implementation of SD hierarchy recalculation on modify much easier.
2011-02-21s4-descriptor: Replaced the synchronous descriptor_change with the ↵Nadezhda Ivanova1-1/+108
synchronous descriptor_add. The purpose is to make descriptor module synchronous. This will simplify reading and debugging, and also will make the implementation of SD hierarchy recalculation on modify much easier.
2011-01-17s4-dsdb: pass parent request to dsdb_module_*() functions Andrew Tridgell1-2/+2
this preserves the request hierarchy for dsdb_module_*() calls inside dsdb ldb modules Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-12-18Revert "s4-dsdb Don't talloc_free() ares on failure, as LDB might free it later"Andrew Bartlett1-0/+1
This reverts commit 25163380239abbad28f1656c42e6fab1b92473d9 because further analyis showed the real problem was introduced in 0941099a (which changed the caller behaviour, but only for indexed searches). Andrew Bartlett Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Sat Dec 18 02:19:59 CET 2010 on sn-devel-104
2010-12-16s4-dsdb Don't talloc_free() ares on failure, as LDB might free it laterAndrew Bartlett1-1/+0
We need to make LDB consistent here (indexed vs unindexed behaviour differs here!), but for the moment this is the easiest way out of a segfault. Andrew Bartlett Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Thu Dec 16 06:42:56 CET 2010 on sn-devel-104
2010-12-02s4-dsdb/descriptor: comment typoKamen Mazdrashki1-1/+1
2010-11-16s4:descriptor LDB module - also "get_default_ag" should make use of ↵Matthias Dieter Wallnöfer1-12/+12
"dsdb_find_nc_root"
2010-11-16s4:descriptor LDB module - handle the NCs in a more generic way by using ↵Matthias Dieter Wallnöfer1-10/+22
"dsdb_find_nc_root"
2010-11-16s4:descriptor LDB module - make more clear that special control entries ↵Matthias Dieter Wallnöfer1-0/+7
never should be handled by modules
2010-11-07s4:descriptor LDB module - make the "nTSecurityDescriptor" attribute fully ↵Matthias Dieter Wallnöfer1-47/+61
behave as in AD - fix crash when provided "nTSecurityDescriptor" attribute is empty - print out the correct error codes if it's provided multi-valued - simplify the "recalculate_sd" control handling
2010-11-07s4:descriptor LDB module - save a pointer to the request message on the ↵Matthias Dieter Wallnöfer1-33/+33
temporary "ac" context This prevents two calls of "ldb_msg_copy_shallow".
2010-11-07s4:descriptor LDB module - by "dsdb_next_callback" we don't need anymore the ↵Matthias Dieter Wallnöfer1-33/+2
default operation callback implementations Only customised ones still need to remain.
2010-11-07s4:descriptor LDB module - remove a bit pointless memory contextMatthias Dieter Wallnöfer1-9/+1
For only one operation we do not need an additional "mem_ctx". "ac" should be enough (see for example the samldb LDB module).
2010-11-07s4:descriptor LDB module - remove a "ldb_msg_sanity_check" callMatthias Dieter Wallnöfer1-7/+0
This check (the structural objectclass) is performed in the objectclass LDB module.
generated by cgit (git 2.34.1) at 2024-06-11 00:31:02 +0000