diff options
| author | Andrew Bartlett <abartlet@samba.org> | 2019-12-06 18:05:54 +1300 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2020-01-08 11:31:41 +0100 |
| commit | 2cf368d0023c68dc91f50e4cd73fcc83f77cf234 (patch) | |
| tree | 68cbae66be20d937618307a7b0319c08d2d2c2d5 /source4 | |
| parent | dc1b30c8316d99415e4968dc98779763102994dd (diff) | |
| download | samba-2cf368d0023c68dc91f50e4cd73fcc83f77cf234.tar.gz | |
CVE-2019-14902 repl_meta_data: schedule SD propagation to a renamed DN
We need to check the SD of the parent if we rename, it is not the same as an incoming SD change.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'source4')
| -rw-r--r-- | source4/dsdb/samdb/ldb_modules/repl_meta_data.c | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c index 1d800feb0c1..942de232ede 100644 --- a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c +++ b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c @@ -6353,7 +6353,22 @@ static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar) ar->index_current, msg->num_elements); if (renamed) { - sd_updated = true; + /* + * This is an new name for this object, so we must + * inherit from the parent + * + * This is needed because descriptor is above + * repl_meta_data in the module stack, so this will + * not be trigered 'naturally' by the flow of + * operations. + */ + ret = dsdb_module_schedule_sd_propagation(ar->module, + ar->objs->partition_dn, + msg->dn, + true); + if (ret != LDB_SUCCESS) { + return ldb_operr(ldb); + } } if (sd_updated && !isDeleted) { |