summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndrew Bartlett <abartlet@samba.org>2019-12-06 18:05:54 +1300
committerKarolin Seeger <kseeger@samba.org>2020-01-10 11:56:20 +0100
commit9ac2b09fa5a2de44967a0b190918825e7dca8d53 (patch)
treedc734f96974fc6ffc324732e434af829441dd00c
parent0fa9a362e55abb289cbf0fe24baa09c45af4837e (diff)
downloadsamba-9ac2b09fa5a2de44967a0b190918825e7dca8d53.tar.gz
CVE-2019-14902 repl_meta_data: schedule SD propagation to a renamed DN
We need to check the SD of the parent if we rename, it is not the same as an incoming SD change. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
-rw-r--r--source4/dsdb/samdb/ldb_modules/repl_meta_data.c17
1 files changed, 16 insertions, 1 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
index 04a51ecab51..52ff3d75ee2 100644
--- a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
+++ b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
@@ -6290,7 +6290,22 @@ static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
ar->index_current, msg->num_elements);
if (renamed) {
- sd_updated = true;
+ /*
+ * This is an new name for this object, so we must
+ * inherit from the parent
+ *
+ * This is needed because descriptor is above
+ * repl_meta_data in the module stack, so this will
+ * not be trigered 'naturally' by the flow of
+ * operations.
+ */
+ ret = dsdb_module_schedule_sd_propagation(ar->module,
+ ar->objs->partition_dn,
+ msg->dn,
+ true);
+ if (ret != LDB_SUCCESS) {
+ return ldb_operr(ldb);
+ }
}
if (sd_updated && !isDeleted) {