diff options
| author | Andrew Bartlett <abartlet@samba.org> | 2015-01-06 16:43:37 +1300 |
|---|---|---|
| committer | Andrew Bartlett <abartlet@samba.org> | 2015-01-22 07:50:06 +0100 |
| commit | 49485ab9782b7abc32581f29c35d862bb9a7058c (patch) | |
| tree | c6442b2304d98bd9ea59242479584fbc6173a231 /libds | |
| parent | ad98c0e1755e3fdc6efd8551590c1781b318a04f (diff) | |
| download | samba-49485ab9782b7abc32581f29c35d862bb9a7058c.tar.gz | |
dsdb-samldb: Only allow known and settable userAccountControl bits to be set
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10993
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Diffstat (limited to 'libds')
| -rw-r--r-- | libds/common/flags.h | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/libds/common/flags.h b/libds/common/flags.h index 96709af118e..f821e1738a1 100644 --- a/libds/common/flags.h +++ b/libds/common/flags.h @@ -67,13 +67,18 @@ UF_SERVER_TRUST_ACCOUNT \ ) +/* + * MS-SAMR 2.2.1.13 UF_FLAG Codes states that some bits are ignored by + * clients and servers. Other flags (like UF_LOCKOUT have special + * behaviours, but are not set in the traditional sense). + * + * See the samldb module for the use of this define. + */ + #define UF_SETTABLE_BITS (\ - UF_SCRIPT |\ UF_ACCOUNTDISABLE |\ UF_HOMEDIR_REQUIRED |\ - UF_LOCKOUT |\ UF_PASSWD_NOTREQD |\ - UF_PASSWD_CANT_CHANGE |\ UF_ACCOUNT_TYPE_MASK | \ UF_DONT_EXPIRE_PASSWD | \ UF_MNS_LOGON_ACCOUNT |\ @@ -82,7 +87,11 @@ UF_TRUSTED_FOR_DELEGATION |\ UF_NOT_DELEGATED |\ UF_USE_DES_KEY_ONLY |\ - UF_DONT_REQUIRE_PREAUTH \ + UF_DONT_REQUIRE_PREAUTH |\ + UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION |\ + UF_NO_AUTH_DATA_REQUIRED |\ + UF_PARTIAL_SECRETS_ACCOUNT |\ + UF_USE_AES_KEYS \ ) /* Group flags for "groupType" */ |