dsdb:schema_data: only allow originating renames on the schema master

Signed-off-by: Stefan Metzmacher <metze@samba.org>

diff --git a/source4/dsdb/samdb/ldb_modules/schema_data.c b/source4/dsdb/samdb/ldb_modules/schema_data.c
index 7adaac0984c0a0c8f089d96ff762644d598192e6..0f089faf151315c61b94ea27587ef27e7f92d147 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/schema_data.c
+++ b/source4/dsdb/samdb/ldb_modules/schema_data.c
@@ -383,6 +383,50 @@ static int schema_data_modify(struct ldb_module *module, struct ldb_request *req
        return ldb_next_request(module, req);
 }
 
+static int schema_data_rename(struct ldb_module *module, struct ldb_request *req)
+{
+       struct schema_data_private_data *mc = NULL;
+       struct ldb_dn *parent_dn = NULL;
+       int cmp;
+       int ret;
+
+       /* special objects should always go through */
+       if (ldb_dn_is_special(req->op.del.dn)) {
+               return ldb_next_request(module, req);
+       }
+
+       /* replicated update should always go through */
+       if (ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
+               return ldb_next_request(module, req);
+       }
+
+       ret = schema_data_check_master(module, req, "rename", &mc, NULL);
+       if (ret != LDB_SUCCESS) {
+               return ret;
+       }
+
+       parent_dn = ldb_dn_get_parent(req, req->op.rename.newdn);
+       if (parent_dn == NULL) {
+               return ldb_module_oom(module);
+       }
+
+       cmp = ldb_dn_compare(parent_dn, mc->schema_dn);
+       if (cmp != 0) {
+               return dsdb_module_werror(module,
+                       LDB_ERR_UNWILLING_TO_PERFORM,
+                       WERR_DS_NO_OBJECT_MOVE_IN_SCHEMA_NC,
+                       "Move not allowed in schema nc");
+       }
+
+       /*
+        * We may need further contraints here.
+        *
+        * Note some are already handled in samldb.c
+        */
+
+       return ldb_next_request(module, req);
+}
+
 static int schema_data_del(struct ldb_module *module, struct ldb_request *req)
 {
        struct ldb_context *ldb = ldb_module_get_ctx(module);
@@ -694,12 +738,12 @@ static int schema_data_search(struct ldb_module *module, struct ldb_request *req
        return ldb_next_request(module, down_req);
 }
 
-
 static const struct ldb_module_ops ldb_schema_data_module_ops = {
        .name           = "schema_data",
        .init_context   = schema_data_init,
        .add            = schema_data_add,
        .modify         = schema_data_modify,
+       .rename         = schema_data_rename,
        .del            = schema_data_del,
        .search         = schema_data_search
 };