diff options
| author | Andrew Bartlett <abartlet@samba.org> | 2015-01-06 16:43:37 +1300 |
|---|---|---|
| committer | Andrew Bartlett <abartlet@samba.org> | 2015-01-22 07:50:06 +0100 |
| commit | 49485ab9782b7abc32581f29c35d862bb9a7058c (patch) | |
| tree | c6442b2304d98bd9ea59242479584fbc6173a231 | |
| parent | ad98c0e1755e3fdc6efd8551590c1781b318a04f (diff) | |
| download | samba-49485ab9782b7abc32581f29c35d862bb9a7058c.tar.gz samba-49485ab9782b7abc32581f29c35d862bb9a7058c.tar.xz samba-49485ab9782b7abc32581f29c35d862bb9a7058c.zip | |
dsdb-samldb: Only allow known and settable userAccountControl bits to be set
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10993
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
| -rw-r--r-- | libds/common/flags.h | 17 | ||||
| -rw-r--r-- | source4/dsdb/samdb/ldb_modules/samldb.c | 13 |
2 files changed, 22 insertions, 8 deletions
diff --git a/libds/common/flags.h b/libds/common/flags.h index 96709af118..f821e1738a 100644 --- a/libds/common/flags.h +++ b/libds/common/flags.h @@ -67,13 +67,18 @@ UF_SERVER_TRUST_ACCOUNT \ ) +/* + * MS-SAMR 2.2.1.13 UF_FLAG Codes states that some bits are ignored by + * clients and servers. Other flags (like UF_LOCKOUT have special + * behaviours, but are not set in the traditional sense). + * + * See the samldb module for the use of this define. + */ + #define UF_SETTABLE_BITS (\ - UF_SCRIPT |\ UF_ACCOUNTDISABLE |\ UF_HOMEDIR_REQUIRED |\ - UF_LOCKOUT |\ UF_PASSWD_NOTREQD |\ - UF_PASSWD_CANT_CHANGE |\ UF_ACCOUNT_TYPE_MASK | \ UF_DONT_EXPIRE_PASSWD | \ UF_MNS_LOGON_ACCOUNT |\ @@ -82,7 +87,11 @@ UF_TRUSTED_FOR_DELEGATION |\ UF_NOT_DELEGATED |\ UF_USE_DES_KEY_ONLY |\ - UF_DONT_REQUIRE_PREAUTH \ + UF_DONT_REQUIRE_PREAUTH |\ + UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION |\ + UF_NO_AUTH_DATA_REQUIRED |\ + UF_PARTIAL_SECRETS_ACCOUNT |\ + UF_USE_AES_KEYS \ ) /* Group flags for "groupType" */ diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c index 8c93c6d58b..f89e6814af 100644 --- a/source4/dsdb/samdb/ldb_modules/samldb.c +++ b/source4/dsdb/samdb/ldb_modules/samldb.c @@ -1825,12 +1825,17 @@ static int samldb_user_account_control_change(struct samldb_ctx *ac) new_acb = samdb_result_acct_flags(tmp_msg, NULL); talloc_free(tmp_msg); /* - * UF_LOCKOUT and UF_PASSWORD_EXPIRED are only generated - * and not stored. We ignore them almost completely. + * UF_LOCKOUT, UF_PASSWD_CANT_CHANGE and UF_PASSWORD_EXPIRED + * are only generated and not stored. We ignore them almost + * completely, along with unknown bits and UF_SCRIPT. * - * The only exception is the resulting ACB_AUTOLOCK in clear_acb. + * The only exception is ACB_AUTOLOCK, which features in + * clear_acb when the bit is cleared in this modify operation. + * + * MS-SAMR 2.2.1.13 UF_FLAG Codes states that some bits are + * ignored by clients and servers */ - new_uac = raw_uac & ~(UF_LOCKOUT|UF_PASSWORD_EXPIRED); + new_uac = raw_uac & UF_SETTABLE_BITS; /* Fetch the old "userAccountControl" and "objectClass" */ ret = dsdb_module_search_dn(ac->module, ac, &res, ac->msg->dn, attrs, |