s4-acl: Moved aclread module below descriptor and acl.

The aclread needs to be belod descriptor, as it needs to have the full nTsecurityDescriptor to make the
checks, and the descriptor module may filter out parts of it if SD_FLAGS_CONTROL is provided.

diff --git a/source4/dsdb/samdb/ldb_modules/samba_dsdb.c b/source4/dsdb/samdb/ldb_modules/samba_dsdb.c
index f07d03f9a792d5be5cc0dbbd7e220fd4b40cb0d1..f6c8e3ccf4f04d5950d09c63f93d3b3fc9149978 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/samba_dsdb.c
+++ b/source4/dsdb/samdb/ldb_modules/samba_dsdb.c
@@ -162,7 +162,6 @@ static int samba_dsdb_init(struct ldb_module *module)
        */
        static const char *modules_list[] = {"resolve_oids",
                                             "rootdse",
-                                            "aclread",
                                             "lazy_commit",
                                             "paged_results",
                                             "ranged_results",
@@ -174,6 +173,7 @@ static int samba_dsdb_init(struct ldb_module *module)
                                             "objectclass",
                                             "descriptor",
                                             "acl",
+                                            "aclread",
                                             "samldb",
                                             "password_hash",
                                             "operational",