sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-12 21:58:10 +03:00
Code

s4:dsdb/acl: don't protect confidential attributes when "acl:search = yes" is set

Browse Source 
In that case the acl_read module does the protection.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
This commit is contained in:
Stefan Metzmacher 2012-11-21 12:12:41 +01:00 committed by Michael Adam
parent 3d57f17db9
commit 95b480fd98
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
source4/dsdb/samdb/ldb_modules/acl.c
View File

@ -49,6 +49,7 @@ struct extended_access_check_attribute {
};
struct acl_private {
bool acl_search;
const char **password_attrs;
void *cached_schema_ptr;
uint64_t cached_schema_metadata_usn;
@ -99,6 +100,8 @@ static int acl_module_init(struct ldb_module *module)
return ldb_oom(ldb);
}
data->acl_search = lpcfg_parm_bool(ldb_get_opaque(ldb, "loadparm"),
NULL, "acl", "search", false);
ldb_module_set_private(module, data);
mem_ctx = talloc_new(module);
@ -1393,6 +1396,14 @@ static int acl_search_update_confidential_attrs(struct acl_context *ac,
struct dsdb_attribute *a;
uint32_t n = 0;
if (data->acl_search) {
/*
* If acl:search is activated, the acl_read module
* protects confidential attributes.
*/
return LDB_SUCCESS;
}
if ((ac->schema == data->cached_schema_ptr) &&
(ac->schema->loaded_usn == data->cached_schema_loaded_usn) &&
(ac->schema->metadata_usn == data->cached_schema_metadata_usn))