From 7ca6b3ee6d6fbb602ad4e43326c67784efbe0a17 Mon Sep 17 00:00:00 2001 From: Matthias Dieter Wallnöfer Date: Sun, 31 Oct 2010 22:31:53 +0100 Subject: s4:samldb LDB module - deny "objectSid" modifications The same as with Windows --- source4/dsdb/samdb/ldb_modules/samldb.c | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'source4/dsdb/samdb') diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c index 2b3129cd99..89fa6b23e1 100644 --- a/source4/dsdb/samdb/ldb_modules/samldb.c +++ b/source4/dsdb/samdb/ldb_modules/samldb.c @@ -1768,6 +1768,13 @@ static int samldb_modify(struct ldb_module *module, struct ldb_request *req) ldb = ldb_module_get_ctx(module); + /* make sure that "objectSid" is not specified */ + el = ldb_msg_find_element(req->op.mod.message, "objectSid"); + if (el != NULL) { + ldb_set_errstring(ldb, + "samldb: objectSid must not be specified!"); + return LDB_ERR_UNWILLING_TO_PERFORM; + } /* make sure that "sAMAccountType" is not specified */ el = ldb_msg_find_element(req->op.mod.message, "sAMAccountType"); if (el != NULL) { -- cgit