From: Andrew Bartlett <abartlet@samba.org>
Date: Wed, 27 Aug 2014 03:09:22 +0000 (+1200)
Subject: provision: explain why this is required
X-Git-Url: http://git.samba.org/?a=commitdiff_plain;h=f80780925fa1dfd15dc18b5b307d7ff4bd72a795;p=obnox%2Fsamba%2Fsamba-obnox.git

provision: explain why this is required

Change-Id: Iaf8b13010b52e03db2eefe1ad565d7ca768ffb48
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
---

diff --git a/python/samba/provision/sambadns.py b/python/samba/provision/sambadns.py
index 9dbea4ef2a5..29224c8cf69 100644
--- a/python/samba/provision/sambadns.py
+++ b/python/samba/provision/sambadns.py
@@ -801,6 +801,14 @@ def create_samdb_copy(samdb, logger, paths, names, domainsid, domainguid):
         logger.error(
             "Failed to setup database for BIND, AD based DNS cannot be used")
         raise
+
+    # This line is critical to the security of the whole scheme.
+    # We assume there is no secret data in the (to be left out of
+    # date and essentially read-only) config, schema and metadata partitions.
+    #
+    # Only the stub of the domain partition is created above.
+    #
+    # That way, things like the krbtgt key do not leak.
     del partfile[domaindn]
 
     # Link dns partitions and metadata