Bug 9256 - getncchanges with exop for repl_obj_with_secrets should always be allowed for RWDC
Summary: getncchanges with exop for repl_obj_with_secrets should always be allowed for...
Status: RESOLVED FIXED
Alias: None
Product: Samba 4.0
Classification: Unclassified
Component: AD: LDB/DSDB/SAMDB (show other bugs)
Version: 4.0.0rc2
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Karolin Seeger
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-10-08 06:25 UTC by Matthieu Patou
Modified: 2012-10-15 09:55 UTC (History)
0 users

See Also:

Attachments
Proposed patch to fix part 1 (3.67 KB, patch)
2012-10-13 07:22 UTC, Matthieu Patou 		abartlet: review+
Details
Proposed patch to fix part 2 (1.53 KB, patch)
2012-10-13 07:24 UTC, Matthieu Patou 		abartlet: review+
Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Matthieu Patou 2012-10-08 06:25:27 UTC 
Current code apply same restrictions and check for RO and RW DC, it also imply that this call is just made by RODC.
Comment 1 Matthieu Patou 2012-10-13 07:22:05 UTC 
Created attachment 8056 [details]
Proposed patch to fix part 1

In order to fix this issue I separated the problem in two parts, the first one remove the link in the debug and in the comments between exop_repl_object_with_secrets and rodc as rwdc can call this RPC as well (even though in practice it's unlikely to happen).
In order to differentiate rw from ro we check the presence of the get_all_changes right.
Comment 2 Matthieu Patou 2012-10-13 07:24:19 UTC 
Created attachment 8057 [details]
Proposed patch to fix part 2

In this patch we actually bypass allow/deny tests for rwdc
Comment 3 Michael Adam 2012-10-14 19:14:09 UTC 
Andrew,
when you ACK-ed a patch by a team member, the next
step in our release procedure is to assign the bug
to Karolin, which is the sign fo her to pick
the patch to the release branch.

Cheers - Michael

PS: Assigning to Karolin.
Comment 4 Karolin Seeger 2012-10-15 09:55:13 UTC 
Pushed to autobuild-v4-0-test.
Closing out bug report.

Thanks!