samba_upgradeprovision: fix resetting of 'nTSecurityDescriptor' on schema objects

Without this schema_data_modify() will reject updates to schema objects
by default.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/source4/scripting/bin/samba_upgradeprovision b/source4/scripting/bin/samba_upgradeprovision
index 9daabe318facd80df6183cd34c55bbd946b1f2ce..9898333bfe51985deba2db4101688dc246577d45 100755 (executable)
--- a/source4/scripting/bin/samba_upgradeprovision
+++ b/source4/scripting/bin/samba_upgradeprovision
@@ -1360,7 +1360,7 @@ def rebuild_sd(samdb, names):
             descr = get_empty_descriptor(names.domainsid)
             delta["nTSecurityDescriptor"] = MessageElement(descr, FLAG_MOD_REPLACE,
                                                     "nTSecurityDescriptor")
-            samdb.modify(delta, ["sd_flags:1:%d" % sd_flags,"relax:0"])
+            samdb.modify(delta, ["sd_flags:1:%d" % sd_flags,"relax:0","local_oid:%s:0" % dsdb.DSDB_CONTROL_DBCHECK])
         except LdbError, e:
             samdb.transaction_cancel()
             res = samdb.search(expression="objectClass=*", base=str(delta.dn),