s4:objectclass LDB module - "add operation" - reject creation of LSA specific objects

(only using the RELAX flag allowed)

diff --git a/source4/dsdb/samdb/ldb_modules/objectclass.c b/source4/dsdb/samdb/ldb_modules/objectclass.c
index 4feb8c384980e641ba1d154f8ac053aaef5a6368..d280298174b91b0db786441246e7c96b9f5eb70c 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/objectclass.c
+++ b/source4/dsdb/samdb/ldb_modules/objectclass.c
@@ -571,6 +571,14 @@ static int objectclass_do_add(struct oc_context *ac)
                        return LDB_ERR_UNWILLING_TO_PERFORM;
                }
 
+               if (((strcmp(objectclass->lDAPDisplayName, "secret") == 0) ||
+                    (strcmp(objectclass->lDAPDisplayName, "trustedDomain") == 0)) &&
+                    !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
+                       ldb_asprintf_errstring(ldb, "objectClass %s is LSA-specific, rejecting creation of %s",
+                                               objectclass->lDAPDisplayName, ldb_dn_get_linearized(msg->dn));
+                       return LDB_ERR_UNWILLING_TO_PERFORM;
+               }
+
                if (ac->search_res && ac->search_res->message) {
                        struct ldb_message_element *oc_el
                                = ldb_msg_find_element(ac->search_res->message, "objectClass");