From: Andrew Bartlett Date: Wed, 11 Apr 2018 10:49:31 +0000 (+1200) Subject: dsdb: Check for userPassword support after loading the databases X-Git-Tag: ldb-1.4.0~642 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5c7973e9ba5671aa78525b335038b5ca8bf54aa3;p=thirdparty%2Fsamba.git dsdb: Check for userPassword support after loading the databases The net result of this is only that userPassword values (which were world readable when set) would still be visible after userPassword started setting the main DB password. In AD, those values become hidden once the dSHeuristics bit is set, but Samba lost that when fixing a performance issue with f26a2845bd42e580ddeaf0eecc9b46b823a0c6bc BUG: https://bugzilla.samba.org/show_bug.cgi?id=13378 Signed-off-by: Andrew Bartlett Reviewed-by: Douglas Bagnall --- diff --git a/selftest/knownfail.d/dsheuristics_userPassword b/selftest/knownfail.d/dsheuristics_userPassword new file mode 100644 index 00000000000..6981255d9e9 --- /dev/null +++ b/selftest/knownfail.d/dsheuristics_userPassword @@ -0,0 +1 @@ +^samba4.ldap.passwords.python\(.*\).__main__.PasswordTests.test_modify_dsheuristics_userPassword diff --git a/source4/dsdb/samdb/ldb_modules/acl.c b/source4/dsdb/samdb/ldb_modules/acl.c index d750362c47f..8b1dcbeed51 100644 --- a/source4/dsdb/samdb/ldb_modules/acl.c +++ b/source4/dsdb/samdb/ldb_modules/acl.c @@ -108,8 +108,6 @@ static int acl_module_init(struct ldb_module *module) NULL, "acl", "search", true); ldb_module_set_private(module, data); - data->userPassword_support = dsdb_user_password_support(module, module, NULL); - mem_ctx = talloc_new(module); if (!mem_ctx) { return ldb_oom(ldb); @@ -180,7 +178,21 @@ static int acl_module_init(struct ldb_module *module) done: talloc_free(mem_ctx); - return ldb_next_init(module); + ret = ldb_next_init(module); + + if (ret != LDB_SUCCESS) { + return ret; + } + + /* + * Check this after the modules have be initalised so we + * can actually read the backend DB. + */ + data->userPassword_support + = dsdb_user_password_support(module, + module, + NULL); + return ret; } static int acl_allowedAttributes(struct ldb_module *module,