CVE-2019-14902 repl_meta_data: Fix issue where inherited Security Descriptors were...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12497

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/selftest/knownfail.d/repl_secdesc b/selftest/knownfail.d/repl_secdesc
index 7d554ff237a546c1000b41a2b03be94edee31362..13a9ce458dda1691d534efb2c1b1d92fcf6263ac 100644 (file)
--- a/selftest/knownfail.d/repl_secdesc
+++ b/selftest/knownfail.d/repl_secdesc
@@ -1,3 +1,2 @@
 ^samba4.drs.repl_secdesc.python\(.*\).repl_secdesc.ReplAclTestCase.test_acl_inheirt_renamed_object_in_conflict
-^samba4.drs.repl_secdesc.python\(.*\).repl_secdesc.ReplAclTestCase.test_acl_inherit_existing_object
 ^samba4.drs.repl_secdesc.python\(.*\).repl_secdesc.ReplAclTestCase.test_acl_inheirt_renamed_child_object

diff --git a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
index 5f29b955a94a7a361414ce4166f98c5c5ff86aa4..c15361cdc1bd49c19a897aed884b4007757e59c0 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
+++ b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
@@ -5634,6 +5634,15 @@ static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
        replmd_ldb_message_sort(msg, ar->schema);
 
        if (!remote_isDeleted) {
+               /*
+                * Ensure any local ACL inheritence is applied from
+                * the parent object.
+                *
+                * This is needed because descriptor is above
+                * repl_meta_data in the module stack, so this will
+                * not be trigered 'naturally' by the flow of
+                * operations.
+                */
                ret = dsdb_module_schedule_sd_propagation(ar->module,
                                                          ar->objs->partition_dn,
                                                          msg->dn, true);
@@ -6335,9 +6344,20 @@ static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
        }
 
        if (sd_updated && !isDeleted) {
+               /*
+                * This is an existing object, so there is no need to
+                * inherit from the parent, but we must inherit any
+                * incoming changes to our child objects.
+                *
+                * This is needed because descriptor is above
+                * repl_meta_data in the module stack, so this will
+                * not be trigered 'naturally' by the flow of
+                * operations.
+                */
                ret = dsdb_module_schedule_sd_propagation(ar->module,
                                                          ar->objs->partition_dn,
-                                                         msg->dn, true);
+                                                         msg->dn,
+                                                         false);
                if (ret != LDB_SUCCESS) {
                        return ldb_operr(ldb);
                }