r12915: protect against changing the SCM security descriptor

(This used to be commit 5842da99681c15437c11e9925dec24c8c0e3708a)

diff --git a/source3/rpc_server/srv_svcctl_nt.c b/source3/rpc_server/srv_svcctl_nt.c
index 4db8f7ed3f722058548545952ab595aa07610163..049bdf6075674e4186f0d4156029484b0c641ba9 100644 (file)
--- a/source3/rpc_server/srv_svcctl_nt.c
+++ b/source3/rpc_server/srv_svcctl_nt.c
@@ -828,6 +828,11 @@ WERROR _svcctl_set_service_sec( pipes_struct *p, SVCCTL_Q_SET_SERVICE_SEC *q_u,
        if ( !info || !(info->type & (SVC_HANDLE_IS_SERVICE|SVC_HANDLE_IS_SCM))  )
                return WERR_BADFID;
 
+       /* can't set the security de4scriptor on the ServiceControlManager */
+
+       if ( info->type == SVC_HANDLE_IS_SCM )
+               return WERR_ACCESS_DENIED;      
+
        /* check the access on the open handle */
        
        switch ( q_u->security_flags ) {