s4:dsdb/schema_data: allow DSDB_CONTROL_SEC_DESC_PROPAGATION_OID on modify

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

diff --git a/source4/dsdb/samdb/ldb_modules/schema_data.c b/source4/dsdb/samdb/ldb_modules/schema_data.c
index 223d69830298882841228a5f717ceee5af1c12c2..bc9488b4e9719c6faa6473255fb425e3ef8bc820 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/schema_data.c
+++ b/source4/dsdb/samdb/ldb_modules/schema_data.c
@@ -256,6 +256,7 @@ static int schema_data_modify(struct ldb_module *module, struct ldb_request *req
        int cmp;
        bool rodc = false;
        int ret;
+       struct ldb_control *sd_propagation_control;
 
        ldb = ldb_module_get_ctx(module);
 
@@ -274,6 +275,21 @@ static int schema_data_modify(struct ldb_module *module, struct ldb_request *req
                return ldb_next_request(module, req);
        }
 
+       sd_propagation_control = ldb_request_get_control(req,
+                                       DSDB_CONTROL_SEC_DESC_PROPAGATION_OID);
+       if (sd_propagation_control != NULL) {
+               if (req->op.mod.message->num_elements != 1) {
+                       return ldb_module_operr(module);
+               }
+               ret = strcmp(req->op.mod.message->elements[0].name,
+                            "nTSecurityDescriptor");
+               if (ret != 0) {
+                       return ldb_module_operr(module);
+               }
+
+               return ldb_next_request(module, req);
+       }
+
        schema = dsdb_get_schema(ldb, req);
        if (!schema) {
                return ldb_next_request(module, req);