Bug 9256 - getncchanges with exop for repl_obj_with_secrets should always be allowed for RWDC
getncchanges with exop for repl_obj_with_secrets should always be allowed for...
Status: RESOLVED FIXED
Product: Samba 4.0
Classification: Unclassified
Component: AD: LDB/DSDB/SAMDB
4.0.0rc2
All All
: P5 normal
: ---
Assigned To: Karolin Seeger
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-10-08 06:25 UTC by Matthieu Patou
Modified: 2012-10-15 09:55 UTC (History)
0 users

See Also:


Attachments
Proposed patch to fix part 1 (3.67 KB, patch)
2012-10-13 07:22 UTC, Matthieu Patou
abartlet: review+
Details
Proposed patch to fix part 2 (1.53 KB, patch)
2012-10-13 07:24 UTC, Matthieu Patou
abartlet: review+
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Matthieu Patou 2012-10-08 06:25:27 UTC
Current code apply same restrictions and check for RO and RW DC, it also imply that this call is just made by RODC.
Comment 1 Matthieu Patou 2012-10-13 07:22:05 UTC
Created attachment 8056 [details]
Proposed patch to fix part 1

In order to fix this issue I separated the problem in two parts, the first one remove the link in the debug and in the comments between exop_repl_object_with_secrets and rodc as rwdc can call this RPC as well (even though in practice it's unlikely to happen).
In order to differentiate rw from ro we check the presence of the get_all_changes right.
Comment 2 Matthieu Patou 2012-10-13 07:24:19 UTC
Created attachment 8057 [details]
Proposed patch to fix part 2

In this patch we actually bypass allow/deny tests for rwdc
Comment 3 Michael Adam 2012-10-14 19:14:09 UTC
Andrew,
when you ACK-ed a patch by a team member, the next
step in our release procedure is to assign the bug
to Karolin, which is the sign fo her to pick
the patch to the release branch.

Cheers - Michael

PS: Assigning to Karolin.
Comment 4 Karolin Seeger 2012-10-15 09:55:13 UTC
Pushed to autobuild-v4-0-test.
Closing out bug report.

Thanks!