From 4638bd11b59de1d771a34d328e3c287549cde54c Mon Sep 17 00:00:00 2001 From: Matthias Dieter Wallnöfer Date: Mon, 11 Oct 2010 18:41:05 +0200 Subject: s4:objectclass LDB module - deny the creation of "isCriticalSystemObject" entries They're only allowed to be created with the RELAX control specified. --- source4/dsdb/samdb/ldb_modules/objectclass.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/source4/dsdb/samdb/ldb_modules/objectclass.c b/source4/dsdb/samdb/ldb_modules/objectclass.c index 940290bace..86708eb820 100644 --- a/source4/dsdb/samdb/ldb_modules/objectclass.c +++ b/source4/dsdb/samdb/ldb_modules/objectclass.c @@ -734,6 +734,15 @@ static int objectclass_do_add(struct oc_context *ac) return ret; } } + + /* make sure that "isCriticalSystemObject" is not specified! */ + el = ldb_msg_find_element(msg, "isCriticalSystemObject"); + if ((el != NULL) && + !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) { + ldb_set_errstring(ldb, + "objectclass: 'isCriticalSystemObject' must not be specified!"); + return LDB_ERR_UNWILLING_TO_PERFORM; + } } ret = ldb_msg_sanity_check(ldb, msg); -- cgit