From 7d62128e2cce540043df84d51967e43bdca4c493 Mon Sep 17 00:00:00 2001 From: Matthias Dieter Wallnöfer Date: Thu, 5 Aug 2010 21:40:11 +0200 Subject: s4:objectclass LDB module - "add operation" - reject creation of LSA specific objects (only using the RELAX flag allowed) --- source4/dsdb/samdb/ldb_modules/objectclass.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/source4/dsdb/samdb/ldb_modules/objectclass.c b/source4/dsdb/samdb/ldb_modules/objectclass.c index 4feb8c3849..d280298174 100644 --- a/source4/dsdb/samdb/ldb_modules/objectclass.c +++ b/source4/dsdb/samdb/ldb_modules/objectclass.c @@ -571,6 +571,14 @@ static int objectclass_do_add(struct oc_context *ac) return LDB_ERR_UNWILLING_TO_PERFORM; } + if (((strcmp(objectclass->lDAPDisplayName, "secret") == 0) || + (strcmp(objectclass->lDAPDisplayName, "trustedDomain") == 0)) && + !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) { + ldb_asprintf_errstring(ldb, "objectClass %s is LSA-specific, rejecting creation of %s", + objectclass->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)); + return LDB_ERR_UNWILLING_TO_PERFORM; + } + if (ac->search_res && ac->search_res->message) { struct ldb_message_element *oc_el = ldb_msg_find_element(ac->search_res->message, "objectClass"); -- cgit