|
 |
9991ea |
From 504e8701fd7870b18febe9b544244d5d2744bb16 Mon Sep 17 00:00:00 2001
|
|
|
9991ea |
From: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
9991ea |
Date: Wed, 26 Feb 2014 17:43:34 +0200
|
|
|
9991ea |
Subject: [PATCH 53/53] ipaserver/dcerpc: catch the case of insuffient
|
|
|
9991ea |
permissions when establishing trust
|
|
|
9991ea |
|
|
|
9991ea |
We attempt to delete the trust that might exist already. If there are not enough
|
|
|
9991ea |
privileges to do so, we wouldn't be able to create trust at the next step and it will fail.
|
|
|
9991ea |
However, failure to create trust will be due to the name collision as we already had
|
|
|
9991ea |
the trust with the same name before. Thus, raise access denied exception here
|
|
|
9991ea |
to properly indicate wrong access level instead of returning NT_STATUS_OBJECT_NAME_COLLISION.
|
|
|
9991ea |
|
|
|
9991ea |
https://fedorahosted.org/freeipa/ticket/4202
|
|
|
9991ea |
|
|
|
9991ea |
Reviewed-By: Martin Kosek <mkosek@redhat.com>
|
|
|
9991ea |
---
|
|
|
9991ea |
ipaserver/dcerpc.py | 7 +++++--
|
|
|
9991ea |
1 file changed, 5 insertions(+), 2 deletions(-)
|
|
|
9991ea |
|
|
|
9991ea |
diff --git a/ipaserver/dcerpc.py b/ipaserver/dcerpc.py
|
|
|
9991ea |
index d809c416baac072a2489fbd3c167f08665b7a24e..5972e622292a033d4fc979cbf5401fa02151f35c 100644
|
|
|
9991ea |
--- a/ipaserver/dcerpc.py
|
|
|
9991ea |
+++ b/ipaserver/dcerpc.py
|
|
|
9991ea |
@@ -892,8 +892,11 @@ def establish_trust(self, another_domain, trustdom_secret):
|
|
|
9991ea |
dname.string = another_domain.info['dns_domain']
|
|
|
9991ea |
res = self._pipe.QueryTrustedDomainInfoByName(self._policy_handle, dname, lsa.LSA_TRUSTED_DOMAIN_INFO_FULL_INFO)
|
|
|
9991ea |
self._pipe.DeleteTrustedDomain(self._policy_handle, res.info_ex.sid)
|
|
|
9991ea |
- except RuntimeError, e:
|
|
|
9991ea |
- pass
|
|
|
9991ea |
+ except RuntimeError, (num, message):
|
|
|
9991ea |
+ # Ignore anything but access denied (NT_STATUS_ACCESS_DENIED)
|
|
|
9991ea |
+ if num == -1073741790:
|
|
|
9991ea |
+ raise access_denied_error
|
|
|
9991ea |
+
|
|
|
9991ea |
try:
|
|
|
9991ea |
trustdom_handle = self._pipe.CreateTrustedDomainEx2(self._policy_handle, info, self.auth_info, security.SEC_STD_DELETE)
|
|
|
9991ea |
except RuntimeError, (num, message):
|
|
|
9991ea |
--
|
|
|
9991ea |
1.8.5.3
|
|
|
9991ea |
|