From 76b99bb379f2372903288c680e9b9abf85b02e09 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 11 Nov 2011 14:51:32 +0100 Subject: s4:dsdb/schema_data: make sure we only allow objects one level below the schema base The objectclass module should also check for this, but make sure we also reject it on things like provision. metze --- source4/dsdb/samdb/ldb_modules/schema_data.c | 34 +++++++++++++++++++++++++++- 1 file changed, 33 insertions(+), 1 deletion(-) diff --git a/source4/dsdb/samdb/ldb_modules/schema_data.c b/source4/dsdb/samdb/ldb_modules/schema_data.c index eeb7c46a08..a2f2267d43 100644 --- a/source4/dsdb/samdb/ldb_modules/schema_data.c +++ b/source4/dsdb/samdb/ldb_modules/schema_data.c @@ -139,8 +139,10 @@ static int schema_data_add(struct ldb_module *module, struct ldb_request *req) const struct ldb_val *governsID = NULL; const char *oid_attr = NULL; const char *oid = NULL; + struct ldb_dn *parent_dn = NULL; + int cmp; WERROR status; - bool rodc; + bool rodc = false; int ret; ldb = ldb_module_get_ctx(module); @@ -160,6 +162,12 @@ static int schema_data_add(struct ldb_module *module, struct ldb_request *req) return ldb_next_request(module, req); } + if (schema->base_dn == NULL) { + ldb_debug_set(ldb, LDB_DEBUG_FATAL, + "schema_data_add: base_dn NULL\n"); + return LDB_ERR_OPERATIONS_ERROR; + } + ret = samdb_rodc(ldb, &rodc); if (ret != LDB_SUCCESS) { DEBUG(4, (__location__ ": unable to tell if we are an RODC \n")); @@ -171,6 +179,30 @@ static int schema_data_add(struct ldb_module *module, struct ldb_request *req) return LDB_ERR_UNWILLING_TO_PERFORM; } + if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID)) { + /* + * the provision code needs to create + * the schema root object. + */ + cmp = ldb_dn_compare(req->op.add.message->dn, schema->base_dn); + if (cmp == 0) { + return ldb_next_request(module, req); + } + } + + parent_dn = ldb_dn_get_parent(req, req->op.add.message->dn); + if (!parent_dn) { + return ldb_oom(ldb); + } + + cmp = ldb_dn_compare(parent_dn, schema->base_dn); + if (cmp != 0) { + ldb_debug_set(ldb, LDB_DEBUG_ERROR, + "schema_data_add: no direct child :%s\n", + ldb_dn_get_linearized(req->op.add.message->dn)); + return LDB_ERR_UNWILLING_TO_PERFORM; + } + attributeID = ldb_msg_find_ldb_val(req->op.add.message, "attributeID"); governsID = ldb_msg_find_ldb_val(req->op.add.message, "governsID"); -- cgit