From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Date: Fri, 22 Sep 2023 04:29:51 +0000 (+1200)
Subject: libcli/security: condtional ACE recursive composites are not supported
X-Git-Tag: tevent-0.16.0~398
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3b6c1f1a9c47d8d76a7cd946468c1c42e4fb097a;p=thirdparty%2Fsamba.git

libcli/security: condtional ACE recursive composites are not supported

We can't add them via SDDL on Windows, and they aren't useful for
claims.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Sep 27 00:41:26 UTC 2023 on atb-devel-224
---

diff --git a/libcli/security/conditional_ace.c b/libcli/security/conditional_ace.c
index 7e4590a1666..b970e2fe0b4 100644
--- a/libcli/security/conditional_ace.c
+++ b/libcli/security/conditional_ace.c
@@ -364,11 +364,9 @@ static ssize_t pull_composite(TALLOC_CTX *mem_ctx,
 			break;
 
 		case CONDITIONAL_ACE_TOKEN_COMPOSITE:
-			consumed = pull_composite(mem_ctx,
-						  el_data,
-						  available,
-						  &el->data.composite);
-			break;
+			DBG_ERR("recursive composite tokens in conditional "
+				"ACEs are not currently supported\n");
+			goto error;
 		default:
 			goto error;
 		}