From a0813b2a9fe8004e4552a952e3587150f832993e Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Thu, 22 Feb 2018 22:51:46 +0100 Subject: [PATCH] dsdb:samldb: require as_system or provision control to create foreignSecurityPrincipal objects Windows rejects creating foreignSecurityPrincipal objects directly. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13300 Signed-off-by: Stefan Metzmacher Reviewed-by: Andreas Schneider --- selftest/knownfail.d/duplicate_objectSIDs | 1 - source4/dsdb/samdb/ldb_modules/samldb.c | 46 +++++++++++++++++++++-- 2 files changed, 42 insertions(+), 5 deletions(-) delete mode 100644 selftest/knownfail.d/duplicate_objectSIDs diff --git a/selftest/knownfail.d/duplicate_objectSIDs b/selftest/knownfail.d/duplicate_objectSIDs deleted file mode 100644 index 6e6ddbe7f28..00000000000 --- a/selftest/knownfail.d/duplicate_objectSIDs +++ /dev/null @@ -1 +0,0 @@ -^samba.tests.dsdb.*samba.tests.dsdb.DsdbTests.test_duplicate_objectSIDs_allowed_on_foreign_security_principals diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c index 3e429e1476a..108235a91b4 100644 --- a/source4/dsdb/samdb/ldb_modules/samldb.c +++ b/source4/dsdb/samdb/ldb_modules/samldb.c @@ -1249,14 +1249,52 @@ static int samldb_fill_object(struct samldb_ctx *ac) static int samldb_fill_foreignSecurityPrincipal_object(struct samldb_ctx *ac) { - struct ldb_context *ldb; - const struct ldb_val *rdn_value; - struct dom_sid *sid; + struct ldb_context *ldb = NULL; + const struct ldb_val *rdn_value = NULL; + struct ldb_message_element *sid_el = NULL; + struct dom_sid *sid = NULL; + struct ldb_control *as_system = NULL; + struct ldb_control *provision = NULL; + bool allowed = false; int ret; ldb = ldb_module_get_ctx(ac->module); - sid = samdb_result_dom_sid(ac->msg, ac->msg, "objectSid"); + as_system = ldb_request_get_control(ac->req, LDB_CONTROL_AS_SYSTEM_OID); + if (as_system != NULL) { + allowed = true; + } + + provision = ldb_request_get_control(ac->req, LDB_CONTROL_PROVISION_OID); + if (provision != NULL) { + allowed = true; + } + + sid_el = ldb_msg_find_element(ac->msg, "objectSid"); + + if (!allowed && sid_el == NULL) { + return dsdb_module_werror(ac->module, + LDB_ERR_OBJECT_CLASS_VIOLATION, + WERR_DS_MISSING_REQUIRED_ATT, + "objectSid missing on foreignSecurityPrincipal"); + } + + if (!allowed) { + return dsdb_module_werror(ac->module, + LDB_ERR_UNWILLING_TO_PERFORM, + WERR_DS_ILLEGAL_MOD_OPERATION, + "foreignSecurityPrincipal object not allowed"); + } + + if (sid_el != NULL) { + sid = samdb_result_dom_sid(ac->msg, ac->msg, "objectSid"); + if (sid == NULL) { + ldb_set_errstring(ldb, + "samldb: invalid objectSid!"); + return LDB_ERR_CONSTRAINT_VIOLATION; + } + } + if (sid == NULL) { rdn_value = ldb_dn_get_rdn_val(ac->msg->dn); if (rdn_value == NULL) { -- 2.34.1