loadparm: make the source3/ lp_ functions take an explicit TALLOC_CTX *.

They use talloc_tos() internally: hoist that up to the callers, some
of whom don't want to us talloc_tos().

A simple patch, but hits a lot of files.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

86 files changed, 661 insertions, 622 deletions

diff --git a/lib/util/debug_s3.c b/lib/util/debug_s3.c
index cfb675583c..ccf577f7b5 100644
--- a/lib/util/debug_s3.c
+++ b/lib/util/debug_s3.c
@@ -30,7 +30,7 @@ bool reopen_logs(void)
 {
 	if (lp_loaded()) {
 		struct debug_settings settings;
-		debug_set_logfile(lp_logfile());
+		debug_set_logfile(lp_logfile(talloc_tos()));
 
 		ZERO_STRUCT(settings);
 		settings.max_log_size = lp_max_log_size();
diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c
index b38ee48d7f..b41fac8039 100644
--- a/source3/auth/auth_util.c
+++ b/source3/auth/auth_util.c
@@ -47,7 +47,7 @@ static int _smb_create_user(const char *domain, const char *unix_username, const
 	char *add_script;
 	int ret;
 
-	add_script = talloc_strdup(ctx, lp_adduser_script());
+	add_script = lp_adduser_script(ctx);
 	if (!add_script || !*add_script) {
 		return -1;
 	}
@@ -416,8 +416,8 @@ static NTSTATUS log_nt_token(struct security_token *token)
 	char *group_sidstr;
 	size_t i;
 
-	if ((lp_log_nt_token_command() == NULL) ||
-	    (strlen(lp_log_nt_token_command()) == 0)) {
+	if ((lp_log_nt_token_command(frame) == NULL) ||
+	    (strlen(lp_log_nt_token_command(frame)) == 0)) {
 		TALLOC_FREE(frame);
 		return NT_STATUS_OK;
 	}
@@ -430,7 +430,7 @@ static NTSTATUS log_nt_token(struct security_token *token)
 	}
 
 	command = talloc_string_sub(
-		frame, lp_log_nt_token_command(),
+		frame, lp_log_nt_token_command(frame),
 		"%s", sid_string_talloc(frame, &token->sids[0]));
 	command = talloc_string_sub(frame, command, "%t", group_sidstr);
 
diff --git a/source3/auth/pampass.c b/source3/auth/pampass.c
index c4da1e676c..87fa8ca9fa 100644
--- a/source3/auth/pampass.c
+++ b/source3/auth/pampass.c
@@ -299,7 +299,7 @@ static int smb_pam_passchange_conv(int num_msg,
 	if (num_msg <= 0)
 		return PAM_CONV_ERR;
 
-	if ((pw_chat = make_pw_chat(lp_passwd_chat())) == NULL)
+	if ((pw_chat = make_pw_chat(lp_passwd_chat(talloc_tos()))) == NULL)
 		return PAM_CONV_ERR;
 
 	/*
diff --git a/source3/auth/user_util.c b/source3/auth/user_util.c
index d982c746c6..8938aeb003 100644
--- a/source3/auth/user_util.c
+++ b/source3/auth/user_util.c
@@ -267,11 +267,11 @@ bool user_in_list(TALLOC_CTX *ctx, const char *user,const char **list)
 bool map_username(TALLOC_CTX *ctx, const char *user_in, char **p_user_out)
 {
 	XFILE *f;
-	char *mapfile = lp_username_map();
+	char *mapfile = lp_username_map(talloc_tos());
 	char *s;
 	char buf[512];
 	bool mapped_user = False;
-	char *cmd = lp_username_map_script();
+	char *cmd = lp_username_map_script(talloc_tos());
 
 	*p_user_out = NULL;
 
diff --git a/source3/client/client.c b/source3/client/client.c
index e31cd6b85a..821bd0a32e 100644
--- a/source3/client/client.c
+++ b/source3/client/client.c
@@ -5501,7 +5501,7 @@ static int do_message_op(struct user_auth_info *a_info)
 	}
 
 	if ( override_logfile )
-		setup_logging( lp_logfile(), DEBUG_FILE );
+		setup_logging( lp_logfile(talloc_tos()), DEBUG_FILE );
 
 	if (!lp_load_client(get_dyn_CONFIGFILE())) {
 		fprintf(stderr, "%s: Can't load %s - run testparm to debug it\n",
diff --git a/source3/groupdb/mapping.c b/source3/groupdb/mapping.c
index 2c0fea0cb9..c6fcc8aa71 100644
--- a/source3/groupdb/mapping.c
+++ b/source3/groupdb/mapping.c
@@ -213,11 +213,11 @@ int smb_create_group(const char *unix_group, gid_t *new_gid)
 
 	/* defer to scripts */
 
-	if ( *lp_addgroup_script() ) {
+	if ( *lp_addgroup_script(talloc_tos()) ) {
 		TALLOC_CTX *ctx = talloc_tos();
 
 		add_script = talloc_strdup(ctx,
-					lp_addgroup_script());
+					lp_addgroup_script(ctx));
 		if (!add_script) {
 			return -1;
 		}
@@ -269,11 +269,11 @@ int smb_delete_group(const char *unix_group)
 
 	/* defer to scripts */
 
-	if ( *lp_delgroup_script() ) {
+	if ( *lp_delgroup_script(talloc_tos()) ) {
 		TALLOC_CTX *ctx = talloc_tos();
 
 		del_script = talloc_strdup(ctx,
-				lp_delgroup_script());
+				lp_delgroup_script(ctx));
 		if (!del_script) {
 			return -1;
 		}
@@ -304,11 +304,11 @@ int smb_set_primary_group(const char *unix_group, const char* unix_user)
 
 	/* defer to scripts */
 
-	if ( *lp_setprimarygroup_script() ) {
+	if ( *lp_setprimarygroup_script(talloc_tos()) ) {
 		TALLOC_CTX *ctx = talloc_tos();
 
 		add_script = talloc_strdup(ctx,
-				lp_setprimarygroup_script());
+				lp_setprimarygroup_script(ctx));
 		if (!add_script) {
 			return -1;
 		}
@@ -346,11 +346,11 @@ int smb_add_user_group(const char *unix_group, const char *unix_user)
 
 	/* defer to scripts */
 
-	if ( *lp_addusertogroup_script() ) {
+	if ( *lp_addusertogroup_script(talloc_tos()) ) {
 		TALLOC_CTX *ctx = talloc_tos();
 
 		add_script = talloc_strdup(ctx,
-				lp_addusertogroup_script());
+				lp_addusertogroup_script(ctx));
 		if (!add_script) {
 			return -1;
 		}
@@ -386,11 +386,11 @@ int smb_delete_user_group(const char *unix_group, const char *unix_user)
 
 	/* defer to scripts */
 
-	if ( *lp_deluserfromgroup_script() ) {
+	if ( *lp_deluserfromgroup_script(talloc_tos()) ) {
 		TALLOC_CTX *ctx = talloc_tos();
 
 		del_script = talloc_strdup(ctx,
-				lp_deluserfromgroup_script());
+				lp_deluserfromgroup_script(ctx));
 		if (!del_script) {
 			return -1;
 		}
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 95dded820d..d4be239120 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -1019,34 +1019,34 @@ NTSTATUS change_trust_account_password( const char *domain, const char *remote_m
 const char *lp_smb_ports(void);
 const char *lp_dos_charset(void);
 const char *lp_unix_charset(void);
-char *lp_logfile(void);
-char *lp_configfile(void);
+char *lp_logfile(TALLOC_CTX *ctx);
+char *lp_configfile(TALLOC_CTX *ctx);
 const char *lp_smb_passwd_file(void);
 const char *lp_private_dir(void);
-char *lp_serverstring(void);
+char *lp_serverstring(TALLOC_CTX *ctx);
 int lp_printcap_cache_time(void);
-char *lp_addport_cmd(void);
-char *lp_enumports_cmd(void);
-char *lp_addprinter_cmd(void);
-char *lp_deleteprinter_cmd(void);
-char *lp_os2_driver_map(void);
+char *lp_addport_cmd(TALLOC_CTX *ctx);
+char *lp_enumports_cmd(TALLOC_CTX *ctx);
+char *lp_addprinter_cmd(TALLOC_CTX *ctx);
+char *lp_deleteprinter_cmd(TALLOC_CTX *ctx);
+char *lp_os2_driver_map(TALLOC_CTX *ctx);
 const char *lp_lockdir(void);
 const char *lp_statedir(void);
 const char *lp_cachedir(void);
 const char *lp_piddir(void);
-char *lp_mangling_method(void);
+char *lp_mangling_method(TALLOC_CTX *ctx);
 int lp_mangle_prefix(void);
 const char *lp_utmpdir(void);
 const char *lp_wtmpdir(void);
 bool lp_utmp(void);
-char *lp_rootdir(void);
-char *lp_defaultservice(void);
-char *lp_msg_command(void);
-char *lp_get_quota_command(void);
-char *lp_set_quota_command(void);
-char *lp_auto_services(void);
-char *lp_passwd_program(void);
-char *lp_passwd_chat(void);
+char *lp_rootdir(TALLOC_CTX *ctx);
+char *lp_defaultservice(TALLOC_CTX *ctx);
+char *lp_msg_command(TALLOC_CTX *ctx);
+char *lp_get_quota_command(TALLOC_CTX *ctx);
+char *lp_set_quota_command(TALLOC_CTX *ctx);
+char *lp_auto_services(TALLOC_CTX *ctx);
+char *lp_passwd_program(TALLOC_CTX *ctx);
+char *lp_passwd_chat(TALLOC_CTX *ctx);
 const char *lp_passwordserver(void);
 const char *lp_name_resolve_order(void);
 const char *lp_netbios_scope(void);
@@ -1056,39 +1056,39 @@ const char *lp_realm(void);
 const char *lp_dnsdomain(void);
 const char *lp_afs_username_map(void);
 int lp_afs_token_lifetime(void);
-char *lp_log_nt_token_command(void);
-char *lp_username_map(void);
+char *lp_log_nt_token_command(TALLOC_CTX *ctx);
+char *lp_username_map(TALLOC_CTX *ctx);
 const char *lp_logon_script(void);
 const char *lp_logon_path(void);
 const char *lp_logon_drive(void);
 const char *lp_logon_home(void);
-char *lp_remote_announce(void);
-char *lp_remote_browse_sync(void);
+char *lp_remote_announce(TALLOC_CTX *ctx);
+char *lp_remote_browse_sync(TALLOC_CTX *ctx);
 bool lp_nmbd_bind_explicit_broadcast(void);
 const char **lp_wins_server_list(void);
 const char **lp_interfaces(void);
 const char *lp_socket_address(void);
-char *lp_nis_home_map_name(void);
+char *lp_nis_home_map_name(TALLOC_CTX *ctx);
 const char **lp_netbios_aliases(void);
 const char *lp_passdb_backend(void);
 const char **lp_preload_modules(void);
-char *lp_panic_action(void);
-char *lp_adduser_script(void);
-char *lp_renameuser_script(void);
-char *lp_deluser_script(void);
+char *lp_panic_action(TALLOC_CTX *ctx);
+char *lp_adduser_script(TALLOC_CTX *ctx);
+char *lp_renameuser_script(TALLOC_CTX *ctx);
+char *lp_deluser_script(TALLOC_CTX *ctx);
 const char *lp_guestaccount(void);
-char *lp_addgroup_script(void);
-char *lp_delgroup_script(void);
-char *lp_addusertogroup_script(void);
-char *lp_deluserfromgroup_script(void);
-char *lp_setprimarygroup_script(void);
-char *lp_addmachine_script(void);
-char *lp_shutdown_script(void);
-char *lp_abort_shutdown_script(void);
-char *lp_username_map_script(void);
+char *lp_addgroup_script(TALLOC_CTX *ctx);
+char *lp_delgroup_script(TALLOC_CTX *ctx);
+char *lp_addusertogroup_script(TALLOC_CTX *ctx);
+char *lp_deluserfromgroup_script(TALLOC_CTX *ctx);
+char *lp_setprimarygroup_script(TALLOC_CTX *ctx);
+char *lp_addmachine_script(TALLOC_CTX *ctx);
+char *lp_shutdown_script(TALLOC_CTX *ctx);
+char *lp_abort_shutdown_script(TALLOC_CTX *ctx);
+char *lp_username_map_script(TALLOC_CTX *ctx);
 int lp_username_map_cache_time(void);
-char *lp_check_password_script(void);
-char *lp_wins_hook(void);
+char *lp_check_password_script(TALLOC_CTX *ctx);
+char *lp_wins_hook(TALLOC_CTX *ctx);
 const char *lp_template_homedir(void);
 const char *lp_template_shell(void);
 const char *lp_winbind_separator(void);
@@ -1110,8 +1110,8 @@ int lp_idmap_cache_time(void);
 int lp_idmap_negative_cache_time(void);
 int lp_keepalive(void);
 bool lp_passdb_expand_explicit(void);
-char *lp_ldap_suffix(void);
-char *lp_ldap_admin_dn(void);
+char *lp_ldap_suffix(TALLOC_CTX *ctx);
+char *lp_ldap_admin_dn(TALLOC_CTX *ctx);
 int lp_ldap_ssl(void);
 bool lp_ldap_ssl_ads(void);
 int lp_ldap_deref(void);
@@ -1124,10 +1124,10 @@ int lp_ldap_connection_timeout(void);
 int lp_ldap_page_size(void);
 int lp_ldap_debug_level(void);
 int lp_ldap_debug_threshold(void);
-char *lp_add_share_cmd(void);
-char *lp_change_share_cmd(void);
-char *lp_delete_share_cmd(void);
-char *lp_usershare_path(void);
+char *lp_add_share_cmd(TALLOC_CTX *ctx);
+char *lp_change_share_cmd(TALLOC_CTX *ctx);
+char *lp_delete_share_cmd(TALLOC_CTX *ctx);
+char *lp_usershare_path(TALLOC_CTX *ctx);
 const char **lp_usershare_prefix_allow_list(void);
 const char **lp_usershare_prefix_deny_list(void);
 const char **lp_eventlog_list(void);
@@ -1231,23 +1231,23 @@ int lp_smb2_max_read(void);
 int lp_smb2_max_write(void);
 int lp_smb2_max_trans(void);
 int lp_smb2_max_credits(void);
-char *lp_preexec(int );
-char *lp_postexec(int );
-char *lp_rootpreexec(int );
-char *lp_rootpostexec(int );
-char *lp_servicename(int );
+char *lp_preexec(TALLOC_CTX *ctx, int );
+char *lp_postexec(TALLOC_CTX *ctx, int );
+char *lp_rootpreexec(TALLOC_CTX *ctx, int );
+char *lp_rootpostexec(TALLOC_CTX *ctx, int );
+char *lp_servicename(TALLOC_CTX *ctx, int );
 const char *lp_const_servicename(int );
-char *lp_pathname(int );
-char *lp_dontdescend(int );
-char *lp_username(int );
+char *lp_pathname(TALLOC_CTX *ctx, int );
+char *lp_dontdescend(TALLOC_CTX *ctx, int );
+char *lp_username(TALLOC_CTX *ctx, int );
 const char **lp_invalid_users(int );
 const char **lp_valid_users(int );
 const char **lp_admin_users(int );
 const char **lp_svcctl_list(void);
-char *lp_cups_options(int );
-char *lp_cups_server(void);
+char *lp_cups_options(TALLOC_CTX *ctx, int );
+char *lp_cups_server(TALLOC_CTX *ctx);
 int lp_cups_encrypt(void);
-char *lp_iprint_server(void);
+char *lp_iprint_server(TALLOC_CTX *ctx);
 int lp_cups_connection_timeout(void);
 const char *lp_ctdbd_socket(void);
 const char *_lp_ctdbd_socket(void);
@@ -1255,32 +1255,32 @@ const char **lp_cluster_addresses(void);
 bool lp_clustering(void);
 int lp_ctdb_timeout(void);
 int lp_ctdb_locktime_warn_threshold(void);
-char *lp_printcommand(int );
-char *lp_lpqcommand(int );
-char *lp_lprmcommand(int );
-char *lp_lppausecommand(int );
-char *lp_lpresumecommand(int );
-char *lp_queuepausecommand(int );
-char *lp_queueresumecommand(int );
+char *lp_printcommand(TALLOC_CTX *ctx, int );
+char *lp_lpqcommand(TALLOC_CTX *ctx, int );
+char *lp_lprmcommand(TALLOC_CTX *ctx, int );
+char *lp_lppausecommand(TALLOC_CTX *ctx, int );
+char *lp_lpresumecommand(TALLOC_CTX *ctx, int );
+char *lp_queuepausecommand(TALLOC_CTX *ctx, int );
+char *lp_queueresumecommand(TALLOC_CTX *ctx, int );
 const char *lp_printjob_username(int );
 const char **lp_hostsallow(int );
 const char **lp_hostsdeny(int );
-char *lp_magicscript(int );
-char *lp_magicoutput(int );
-char *lp_comment(int );
-char *lp_force_user(int );
-char *lp_force_group(int );
+char *lp_magicscript(TALLOC_CTX *ctx, int );
+char *lp_magicoutput(TALLOC_CTX *ctx, int );
+char *lp_comment(TALLOC_CTX *ctx, int );
+char *lp_force_user(TALLOC_CTX *ctx, int );
+char *lp_force_group(TALLOC_CTX *ctx, int );
 const char **lp_readlist(int );
 const char **lp_writelist(int );
-char *lp_fstype(int );
+char *lp_fstype(TALLOC_CTX *ctx, int );
 const char **lp_vfs_objects(int );
-char *lp_msdfs_proxy(int );
-char *lp_veto_files(int );
-char *lp_hide_files(int );
-char *lp_veto_oplocks(int );
+char *lp_msdfs_proxy(TALLOC_CTX *ctx, int );
+char *lp_veto_files(TALLOC_CTX *ctx, int );
+char *lp_hide_files(TALLOC_CTX *ctx, int );
+char *lp_veto_oplocks(TALLOC_CTX *ctx, int );
 bool lp_msdfs_root(int );
-char *lp_aio_write_behind(int );
-char *lp_dfree_command(int );
+char *lp_aio_write_behind(TALLOC_CTX *ctx, int );
+char *lp_dfree_command(TALLOC_CTX *ctx, int );
 bool lp_autoloaded(int );
 bool lp_preexec_close(int );
 bool lp_rootpreexec_close(int );
@@ -1379,7 +1379,7 @@ int lp_name_cache_timeout(void);
 int lp_client_signing(void);
 int lp_server_signing(void);
 int lp_client_ldap_sasl_wrapping(void);
-char *lp_parm_talloc_string(int snum, const char *type, const char *option, const char *def);
+char *lp_parm_talloc_string(TALLOC_CTX *ctx, int snum, const char *type, const char *option, const char *def);
 const char *lp_parm_const_string(int snum, const char *type, const char *option, const char *def);
 struct loadparm_service;
 const char *lp_parm_const_string_service(struct loadparm_service *service, const char *type, const char *option);
@@ -1416,10 +1416,10 @@ bool lp_config_backend_is_file(void);
 bool lp_file_list_changed(void);
 bool lp_idmap_uid(uid_t *low, uid_t *high);
 bool lp_idmap_gid(gid_t *low, gid_t *high);
-const char *lp_ldap_machine_suffix(void);
-const char *lp_ldap_user_suffix(void);
-const char *lp_ldap_group_suffix(void);
-const char *lp_ldap_idmap_suffix(void);
+const char *lp_ldap_machine_suffix(TALLOC_CTX *ctx);
+const char *lp_ldap_user_suffix(TALLOC_CTX *ctx);
+const char *lp_ldap_group_suffix(TALLOC_CTX *ctx);
+const char *lp_ldap_idmap_suffix(TALLOC_CTX *ctx);
 struct parm_struct;
 /* Return a pointer to a service by name.  */
 struct loadparm_service *lp_service(const char *pszServiceName);
@@ -1480,14 +1480,14 @@ void lp_dump_one(FILE * f, bool show_defaults, int snum);
 int lp_servicenumber(const char *pszServiceName);
 struct share_params *get_share_params(TALLOC_CTX *mem_ctx,
 				      const char *sharename);
-const char *volume_label(int snum);
+const char *volume_label(TALLOC_CTX *ctx, int snum);
 bool lp_domain_master(void);
 bool lp_preferred_master(void);
 void lp_remove_service(int snum);
 void lp_copy_service(int snum, const char *new_name);
 int lp_default_server_announce(void);
 void lp_set_name_resolve_order(const char *new_order);
-const char *lp_printername(int snum);
+const char *lp_printername(TALLOC_CTX *ctx, int snum);
 void lp_set_logfile(const char *name);
 int lp_maxprintjobs(int snum);
 const char *lp_printcapname(void);
@@ -1504,7 +1504,7 @@ void lp_set_posix_pathnames(void);
 enum brl_flavour lp_posix_cifsu_locktype(files_struct *fsp);
 void lp_set_posix_default_cifsx_readwrite_locktype(enum brl_flavour val);
 int lp_min_receive_file_size(void);
-char* lp_perfcount_module(void);
+char* lp_perfcount_module(TALLOC_CTX *ctx);
 void widelinks_warning(int snum);
 const char *lp_ncalrpc_dir(void);
 void _lp_set_server_role(int server_role);
diff --git a/source3/lib/netapi/serverinfo.c b/source3/lib/netapi/serverinfo.c
index 4b11339f94..046b693f1f 100644
--- a/source3/lib/netapi/serverinfo.c
+++ b/source3/lib/netapi/serverinfo.c
@@ -40,7 +40,7 @@ static WERROR NetServerGetInfo_l_101(struct libnetapi_ctx *ctx,
 	i.sv101_version_major	= SAMBA_MAJOR_NBT_ANNOUNCE_VERSION;
 	i.sv101_version_minor	= SAMBA_MINOR_NBT_ANNOUNCE_VERSION;
 	i.sv101_type		= lp_default_server_announce();
-	i.sv101_comment		= lp_serverstring();
+	i.sv101_comment		= lp_serverstring(ctx);
 
 	*buffer = (uint8_t *)talloc_memdup(ctx, &i, sizeof(i));
 	if (!*buffer) {
@@ -58,7 +58,7 @@ static WERROR NetServerGetInfo_l_1005(struct libnetapi_ctx *ctx,
 {
 	struct SERVER_INFO_1005 info1005;
 
-	info1005.sv1005_comment = lp_serverstring();
+	info1005.sv1005_comment = lp_serverstring(ctx);
 	*buffer = (uint8_t *)talloc_memdup(ctx, &info1005, sizeof(info1005));
 	if (!*buffer) {
 		return WERR_NOMEM;
diff --git a/source3/lib/smbldap.c b/source3/lib/smbldap.c
index 81276936e6..85a9ac557f 100644
--- a/source3/lib/smbldap.c
+++ b/source3/lib/smbldap.c
@@ -1626,7 +1626,8 @@ int smbldap_search_suffix (struct smbldap_state *ldap_state,
 			   const char *filter, const char **search_attr,
 			   LDAPMessage ** result)
 {
-	return smbldap_search(ldap_state, lp_ldap_suffix(), LDAP_SCOPE_SUBTREE,
+	return smbldap_search(ldap_state, lp_ldap_suffix(talloc_tos()),
+			      LDAP_SCOPE_SUBTREE,
 			      filter, search_attr, 0, result);
 }
 
diff --git a/source3/lib/sysquotas.c b/source3/lib/sysquotas.c
index 12c34edaa2..08f8444e2f 100644
--- a/source3/lib/sysquotas.c
+++ b/source3/lib/sysquotas.c
@@ -188,7 +188,7 @@ static int command_get_quota(const char *path, enum SMB_QUOTA_TYPE qtype, unid_t
 	const char *get_quota_command;
 	char **lines = NULL;
 
-	get_quota_command = lp_get_quota_command();
+	get_quota_command = lp_get_quota_command(talloc_tos());
 	if (get_quota_command && *get_quota_command) {
 		const char *p;
 		char *p2;
@@ -332,7 +332,7 @@ static int command_set_quota(const char *path, enum SMB_QUOTA_TYPE qtype, unid_t
 {
 	const char *set_quota_command;
 
-	set_quota_command = lp_set_quota_command();
+	set_quota_command = lp_set_quota_command(talloc_tos());
 	if (set_quota_command && *set_quota_command) {
 		char **lines = NULL;
 		char *syscmd = NULL;
diff --git a/source3/lib/util.c b/source3/lib/util.c
index fa46448296..9c380c5a02 100644
--- a/source3/lib/util.c
+++ b/source3/lib/util.c
@@ -669,7 +669,7 @@ char *automount_lookup(TALLOC_CTX *ctx, const char *user_name)
 	char *nis_result;     /* yp_match inits this */
 	int nis_result_len;  /* and set this */
 	char *nis_domain;     /* yp_get_default_domain inits this */
-	char *nis_map = (char *)lp_nis_home_map_name();
+	char *nis_map = lp_nis_home_map_name(talloc_tos());
 
 	if ((nis_error = yp_get_default_domain(&nis_domain)) != 0) {
 		DEBUG(3, ("YP Error: %s\n", yperr_string(nis_error)));
@@ -899,7 +899,7 @@ void smb_panic_s3(const char *why)
 	prctl(PR_SET_PTRACER, getpid(), 0, 0, 0);
 #endif
 
-	cmd = lp_panic_action();
+	cmd = lp_panic_action(talloc_tos());
 	if (cmd && *cmd) {
 		DEBUG(0, ("smb_panic(): calling panic action [%s]\n", cmd));
 		result = system(cmd);
diff --git a/source3/libnet/libnet_dssync_passdb.c b/source3/libnet/libnet_dssync_passdb.c
index b56c2d4451..edadddbb28 100644
--- a/source3/libnet/libnet_dssync_passdb.c
+++ b/source3/libnet/libnet_dssync_passdb.c
@@ -670,11 +670,11 @@ static NTSTATUS smb_create_user(TALLOC_CTX *mem_ctx,
 
 	/* Create appropriate user */
 	if (acct_flags & ACB_NORMAL) {
-		add_script = talloc_strdup(mem_ctx, lp_adduser_script());
+		add_script = lp_adduser_script(mem_ctx);
 	} else if ( (acct_flags & ACB_WSTRUST) ||
 		    (acct_flags & ACB_SVRTRUST) ||
 		    (acct_flags & ACB_DOMTRUST) ) {
-		add_script = talloc_strdup(mem_ctx, lp_addmachine_script());
+		add_script = lp_addmachine_script(mem_ctx);
 	} else {
 		DEBUG(1, ("Unknown user type: %s\n",
 			  pdb_encode_acct_ctrl(acct_flags, NEW_PW_FORMAT_SPACE_PADDED_LEN)));
diff --git a/source3/libnet/libnet_samsync_ldif.c b/source3/libnet/libnet_samsync_ldif.c
index a46bfca554..c492b9fda5 100644
--- a/source3/libnet/libnet_samsync_ldif.c
+++ b/source3/libnet/libnet_samsync_ldif.c
@@ -130,7 +130,7 @@ static NTSTATUS populate_ldap_for_ldif(const char *sid,
 	fprintf(add_fd, "\n");
 	fflush(add_fd);
 
-	user_suffix = lp_ldap_user_suffix();
+	user_suffix = lp_ldap_user_suffix(talloc_tos());
 	if (user_suffix == NULL) {
 		SAFE_FREE(suffix_attr);
 		return NT_STATUS_NO_MEMORY;
@@ -138,7 +138,7 @@ static NTSTATUS populate_ldap_for_ldif(const char *sid,
 	/* If it exists and is distinct from other containers,
 	   Write the Users entity */
 	if (*user_suffix && strcmp(user_suffix, suffix)) {
-		user_attr = sstring_sub(lp_ldap_user_suffix(), '=', ',');
+		user_attr = sstring_sub(lp_ldap_user_suffix(talloc_tos()), '=', ',');
 		fprintf(add_fd, "# %s\n", user_suffix);
 		fprintf(add_fd, "dn: %s\n", user_suffix);
 		fprintf(add_fd, "objectClass: organizationalUnit\n");
@@ -148,7 +148,7 @@ static NTSTATUS populate_ldap_for_ldif(const char *sid,
 	}
 
 
-	group_suffix = lp_ldap_group_suffix();
+	group_suffix = lp_ldap_group_suffix(talloc_tos());
 	if (group_suffix == NULL) {
 		SAFE_FREE(suffix_attr);
 		SAFE_FREE(user_attr);
@@ -157,7 +157,7 @@ static NTSTATUS populate_ldap_for_ldif(const char *sid,
 	/* If it exists and is distinct from other containers,
 	   Write the Groups entity */
 	if (*group_suffix && strcmp(group_suffix, suffix)) {
-		group_attr = sstring_sub(lp_ldap_group_suffix(), '=', ',');
+		group_attr = sstring_sub(lp_ldap_group_suffix(talloc_tos()), '=', ',');
 		fprintf(add_fd, "# %s\n", group_suffix);
 		fprintf(add_fd, "dn: %s\n", group_suffix);
 		fprintf(add_fd, "objectClass: organizationalUnit\n");
@@ -168,7 +168,7 @@ static NTSTATUS populate_ldap_for_ldif(const char *sid,
 
 	/* If it exists and is distinct from other containers,
 	   Write the Computers entity */
-	machine_suffix = lp_ldap_machine_suffix();
+	machine_suffix = lp_ldap_machine_suffix(talloc_tos());
 	if (machine_suffix == NULL) {
 		SAFE_FREE(suffix_attr);
 		SAFE_FREE(user_attr);
@@ -183,7 +183,7 @@ static NTSTATUS populate_ldap_for_ldif(const char *sid,
 		fprintf(add_fd, "objectClass: organizationalUnit\n");
 		/* this isn't totally correct as it assumes that
 		   there _must_ be an ou. just fixing memleak now. jmcd */
-		machine_ou = sstring_sub(lp_ldap_machine_suffix(), '=', ',');
+		machine_ou = sstring_sub(lp_ldap_machine_suffix(talloc_tos()), '=', ',');
 		fprintf(add_fd, "ou: %s\n", machine_ou);
 		SAFE_FREE(machine_ou);
 		fprintf(add_fd, "\n");
@@ -192,7 +192,7 @@ static NTSTATUS populate_ldap_for_ldif(const char *sid,
 
 	/* If it exists and is distinct from other containers,
 	   Write the IdMap entity */
-	idmap_suffix = lp_ldap_idmap_suffix();
+	idmap_suffix = lp_ldap_idmap_suffix(talloc_tos());
 	if (idmap_suffix == NULL) {
 		SAFE_FREE(suffix_attr);
 		SAFE_FREE(user_attr);
@@ -206,7 +206,7 @@ static NTSTATUS populate_ldap_for_ldif(const char *sid,
 		fprintf(add_fd, "# %s\n", idmap_suffix);
 		fprintf(add_fd, "dn: %s\n", idmap_suffix);
 		fprintf(add_fd, "ObjectClass: organizationalUnit\n");
-		s = sstring_sub(lp_ldap_idmap_suffix(), '=', ',');
+		s = sstring_sub(lp_ldap_idmap_suffix(talloc_tos()), '=', ',');
 		fprintf(add_fd, "ou: %s\n", s);
 		SAFE_FREE(s);
 		fprintf(add_fd, "\n");
@@ -370,7 +370,7 @@ static NTSTATUS map_populate_groups(TALLOC_CTX *mem_ctx,
 				    const char *suffix,
 				    const char *builtin_sid)
 {
-	char *group_attr = sstring_sub(lp_ldap_group_suffix(), '=', ',');
+	char *group_attr = sstring_sub(lp_ldap_group_suffix(talloc_tos()), '=', ',');
 
 	/* Map the groups created by populate_ldap_for_ldif */
 	groupmap[0].rid		= 512;
@@ -576,7 +576,7 @@ static NTSTATUS fetch_group_info_to_ldif(TALLOC_CTX *mem_ctx,
 {
 	const char *groupname = r->group_name.string;
 	uint32 grouptype = 0, g_rid = 0;
-	char *group_attr = sstring_sub(lp_ldap_group_suffix(), '=', ',');
+	char *group_attr = sstring_sub(lp_ldap_group_suffix(talloc_tos()), '=', ',');
 
 	/* Set up the group type (always 2 for group info) */
 	grouptype = 2;
@@ -673,9 +673,9 @@ static NTSTATUS fetch_account_info_to_ldif(TALLOC_CTX *mem_ctx,
 		} else {
 			snprintf(homedir, sizeof(homedir), "/nobodyshomedir");
 		}
-		ou = lp_ldap_user_suffix();
+		ou = lp_ldap_user_suffix(talloc_tos());
 	} else {
-		ou = lp_ldap_machine_suffix();
+		ou = lp_ldap_machine_suffix(talloc_tos());
 		snprintf(homedir, sizeof(homedir), "/machinehomedir");
 	}
 
@@ -795,7 +795,7 @@ static NTSTATUS fetch_alias_info_to_ldif(TALLOC_CTX *mem_ctx,
 {
 	fstring aliasname, description;
 	uint32 grouptype = 0, g_rid = 0;
-	char *group_attr = sstring_sub(lp_ldap_group_suffix(), '=', ',');
+	char *group_attr = sstring_sub(lp_ldap_group_suffix(talloc_tos()), '=', ',');
 
 	/* Get the alias name */
 	fstrcpy(aliasname, r->alias_name.string);
@@ -930,6 +930,12 @@ static NTSTATUS ldif_init_context(TALLOC_CTX *mem_ctx,
 	const char *mod_template = "/tmp/mod.ldif.XXXXXX";
 	const char *builtin_sid = "S-1-5-32";
 
+	r = talloc_zero(mem_ctx, struct samsync_ldif_context);
+	NT_STATUS_HAVE_NO_MEMORY(r);
+
+	/* Get the ldap suffix */
+	r->suffix = lp_ldap_suffix(talloc_tos());
+
 	/* Get other smb.conf data */
 	if (!(lp_workgroup()) || !*(lp_workgroup())) {
 		DEBUG(0,("workgroup missing from smb.conf--exiting\n"));
@@ -937,7 +943,7 @@ static NTSTATUS ldif_init_context(TALLOC_CTX *mem_ctx,
 	}
 
 	/* Get the ldap suffix */
-	if (!(lp_ldap_suffix()) || !*(lp_ldap_suffix())) {
+	if (!r->suffix || !*r->suffix) {
 		DEBUG(0,("ldap suffix missing from smb.conf--exiting\n"));
 		exit(1);
 	}
@@ -946,12 +952,6 @@ static NTSTATUS ldif_init_context(TALLOC_CTX *mem_ctx,
 		return NT_STATUS_OK;
 	}
 
-	r = talloc_zero(mem_ctx, struct samsync_ldif_context);
-	NT_STATUS_HAVE_NO_MEMORY(r);
-
-	/* Get the ldap suffix */
-	r->suffix = lp_ldap_suffix();
-
 	/* Ensure we have an output file */
 	if (ldif_filename) {
 		r->ldif_file = fopen(ldif_filename, "a");
diff --git a/source3/libnet/libnet_samsync_passdb.c b/source3/libnet/libnet_samsync_passdb.c
index cf47934475..c09474e9b7 100644
--- a/source3/libnet/libnet_samsync_passdb.c
+++ b/source3/libnet/libnet_samsync_passdb.c
@@ -250,11 +250,11 @@ static NTSTATUS smb_create_user(TALLOC_CTX *mem_ctx,
 
 	/* Create appropriate user */
 	if (acct_flags & ACB_NORMAL) {
-		add_script = talloc_strdup(mem_ctx, lp_adduser_script());
+		add_script = lp_adduser_script(mem_ctx);
 	} else if ( (acct_flags & ACB_WSTRUST) ||
 		    (acct_flags & ACB_SVRTRUST) ||
 		    (acct_flags & ACB_DOMTRUST) ) {
-		add_script = talloc_strdup(mem_ctx, lp_addmachine_script());
+		add_script = lp_addmachine_script(mem_ctx);
 	} else {
 		DEBUG(1, ("Unknown user type: %s\n",
 			  pdb_encode_acct_ctrl(acct_flags, NEW_PW_FORMAT_SPACE_PADDED_LEN)));
diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c
index 8485495bb5..f8c5b75977 100644
--- a/source3/modules/vfs_default.c
+++ b/source3/modules/vfs_default.c
@@ -161,7 +161,7 @@ static uint32_t vfswrap_fs_capabilities(struct vfs_handle_struct *handle,
 			"resolution of %s "
 			"available on share %s, directory %s\n",
 			*p_ts_res == TIMESTAMP_SET_MSEC ? "msec" : "sec",
-			lp_servicename(conn->params->service),
+			lp_servicename(talloc_tos(), conn->params->service),
 			conn->connectpath ));
 	}
 	TALLOC_FREE(smb_fname_cpath);
diff --git a/source3/modules/vfs_dfs_samba4.c b/source3/modules/vfs_dfs_samba4.c
index 200c744889..e77a993331 100644
--- a/source3/modules/vfs_dfs_samba4.c
+++ b/source3/modules/vfs_dfs_samba4.c
@@ -96,7 +96,7 @@ static int dfs_samba4_connect(struct vfs_handle_struct *handle,
 static void dfs_samba4_disconnect(struct vfs_handle_struct *handle)
 {
 	DEBUG(10,("dfs_samba4_disconnect() connect to service[%s].\n",
-		  lp_servicename(SNUM(handle->conn))));
+		  lp_servicename(talloc_tos(), SNUM(handle->conn))));
 
 	SMB_VFS_NEXT_DISCONNECT(handle);
 }
diff --git a/source3/modules/vfs_expand_msdfs.c b/source3/modules/vfs_expand_msdfs.c
index d6e25776f1..eaf96e0ae0 100644
--- a/source3/modules/vfs_expand_msdfs.c
+++ b/source3/modules/vfs_expand_msdfs.c
@@ -156,7 +156,7 @@ static char *expand_msdfs_target(TALLOC_CTX *ctx,
 	}
 
 	targethost = talloc_sub_advanced(ctx,
-				lp_servicename(SNUM(conn)),
+				lp_servicename(talloc_tos(), SNUM(conn)),
 				conn->session_info->unix_info->unix_name,
 				conn->connectpath,
 				conn->session_info->unix_token->gid,
diff --git a/source3/modules/vfs_fileid.c b/source3/modules/vfs_fileid.c
index 6237513f23..25048e767d 100644
--- a/source3/modules/vfs_fileid.c
+++ b/source3/modules/vfs_fileid.c
@@ -229,7 +229,7 @@ static int fileid_connect(struct vfs_handle_struct *handle,
 static void fileid_disconnect(struct vfs_handle_struct *handle)
 {
 	DEBUG(10,("fileid_disconnect() connect to service[%s].\n",
-		lp_servicename(SNUM(handle->conn))));
+		  lp_servicename(talloc_tos(), SNUM(handle->conn))));
 
 	SMB_VFS_NEXT_DISCONNECT(handle);
 }
diff --git a/source3/modules/vfs_full_audit.c b/source3/modules/vfs_full_audit.c
index de4f7996bf..b93df5090d 100644
--- a/source3/modules/vfs_full_audit.c
+++ b/source3/modules/vfs_full_audit.c
@@ -397,7 +397,7 @@ static char *audit_prefix(TALLOC_CTX *ctx, connection_struct *conn)
 		return NULL;
 	}
 	result = talloc_sub_advanced(ctx,
-			lp_servicename(SNUM(conn)),
+			lp_servicename(talloc_tos(), SNUM(conn)),
 			conn->session_info->unix_info->unix_name,
 			conn->connectpath,
 			conn->session_info->unix_token->gid,
@@ -637,7 +637,7 @@ static void smb_full_audit_disconnect(vfs_handle_struct *handle)
 	SMB_VFS_NEXT_DISCONNECT(handle);
 
 	do_log(SMB_VFS_OP_DISCONNECT, True, handle,
-	       "%s", lp_servicename(SNUM(handle->conn)));
+	       "%s", lp_servicename(talloc_tos(), SNUM(handle->conn)));
 
 	/* The bitmaps will be disconnected when the private
 	   data is deleted. */
diff --git a/source3/modules/vfs_recycle.c b/source3/modules/vfs_recycle.c
index 37d930f793..3e6825041e 100644
--- a/source3/modules/vfs_recycle.c
+++ b/source3/modules/vfs_recycle.c
@@ -448,7 +448,7 @@ static int recycle_unlink(vfs_handle_struct *handle,
 	NTSTATUS status;
 	int rc = -1;
 
-	repository = talloc_sub_advanced(NULL, lp_servicename(SNUM(conn)),
+	repository = talloc_sub_advanced(NULL, lp_servicename(talloc_tos(), SNUM(conn)),
 					conn->session_info->unix_info->unix_name,
 					conn->connectpath,
 					conn->session_info->unix_token->gid,
diff --git a/source3/nmbd/nmbd.c b/source3/nmbd/nmbd.c
index d464e7e0f6..ebe83a6147 100644
--- a/source3/nmbd/nmbd.c
+++ b/source3/nmbd/nmbd.c
@@ -382,7 +382,7 @@ static bool reload_nmbd_services(bool test)
 	set_remote_machine_name("nmbd", False);
 
 	if ( lp_loaded() ) {
-		char *fname = lp_configfile();
+		char *fname = lp_configfile(talloc_tos());
 		if (file_exist(fname) && !strcsequal(fname,get_dyn_CONFIGFILE())) {
 			set_dyn_CONFIGFILE(fname);
 			test = False;
@@ -843,7 +843,7 @@ static bool open_sockets(bool isdaemon, int port)
 	}
 
 	fault_setup();
-	dump_core_setup("nmbd", lp_logfile());
+	dump_core_setup("nmbd", lp_logfile(talloc_tos()));
 
 	/* POSIX demands that signals are inherited. If the invoking process has
 	 * these signals masked, we will have problems, as we won't receive them. */
diff --git a/source3/nmbd/nmbd_sendannounce.c b/source3/nmbd/nmbd_sendannounce.c
index 39e63d29ab..97bab9d25a 100644
--- a/source3/nmbd/nmbd_sendannounce.c
+++ b/source3/nmbd/nmbd_sendannounce.c
@@ -470,11 +470,12 @@ void announce_remote(time_t t)
 
 	last_time = t;
 
-	s = lp_remote_announce();
+	s = lp_remote_announce(talloc_tos());
 	if (!*s)
 		return;
 
-	comment = string_truncate(lp_serverstring(), MAX_SERVER_STRING_LENGTH);
+	comment = string_truncate(lp_serverstring(talloc_tos()),
+				  MAX_SERVER_STRING_LENGTH);
 
 	frame = talloc_stackframe();
 	for (ptr=s; next_token_talloc(frame,&ptr,&s2,NULL); ) {
@@ -540,7 +541,7 @@ void browse_sync_remote(time_t t)
 
 	last_time = t;
 
-	s = lp_remote_browse_sync();
+	s = lp_remote_browse_sync(talloc_tos());
 	if (!*s)
 		return;
 
diff --git a/source3/nmbd/nmbd_serverlistdb.c b/source3/nmbd/nmbd_serverlistdb.c
index 01627c3331..ac16b5a98c 100644
--- a/source3/nmbd/nmbd_serverlistdb.c
+++ b/source3/nmbd/nmbd_serverlistdb.c
@@ -355,7 +355,7 @@ void write_browse_list(time_t t, bool force_write)
 
 		/* Output server details, plus what workgroup they're in. */
 		write_browse_list_entry(fp, my_netbios_names(i), stype,
-			string_truncate(lp_serverstring(), MAX_SERVER_STRING_LENGTH), lp_workgroup());
+			string_truncate(lp_serverstring(talloc_tos()), MAX_SERVER_STRING_LENGTH), lp_workgroup());
 	}
 
 	for (subrec = FIRST_SUBNET; subrec ; subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec)) { 
diff --git a/source3/nmbd/nmbd_winsserver.c b/source3/nmbd/nmbd_winsserver.c
index ff5fae70b1..87b9990a63 100644
--- a/source3/nmbd/nmbd_winsserver.c
+++ b/source3/nmbd/nmbd_winsserver.c
@@ -461,7 +461,7 @@ static void get_global_id_and_update(uint64_t *current_id, bool update)
 static void wins_hook(const char *operation, struct name_record *namerec, int ttl)
 {
 	char *command = NULL;
-	char *cmd = lp_wins_hook();
+	char *cmd = lp_wins_hook(talloc_tos());
 	char *p, *namestr;
 	int i;
 	TALLOC_CTX *ctx = talloc_tos();
diff --git a/source3/nmbd/nmbd_workgroupdb.c b/source3/nmbd/nmbd_workgroupdb.c
index 43a28aa669..14b33b321e 100644
--- a/source3/nmbd/nmbd_workgroupdb.c
+++ b/source3/nmbd/nmbd_workgroupdb.c
@@ -254,7 +254,7 @@ workgroup %s on subnet %s\n", work->work_group, subrec->subnet_name));
 			stype &= ~(SV_TYPE_MASTER_BROWSER|SV_TYPE_POTENTIAL_BROWSER|SV_TYPE_DOMAIN_MASTER|SV_TYPE_DOMAIN_MEMBER);
    
 		create_server_on_workgroup(work,name,stype|SV_TYPE_LOCAL_LIST_ONLY, PERMANENT_TTL, 
-				string_truncate(lp_serverstring(), MAX_SERVER_STRING_LENGTH));
+				string_truncate(lp_serverstring(talloc_tos()), MAX_SERVER_STRING_LENGTH));
 		DEBUG(3,("initiate_myworkgroup_startup: Added server name entry %s \
 on subnet %s\n", name, subrec->subnet_name));
 	}
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index f8e7aced50..d834fd7bd0 100644
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -4371,57 +4371,52 @@ static void init_printer_values(struct loadparm_service *pService)
 	case PRINT_TEST:
 	case PRINT_VLP: {
 		const char *tdbfile;
+		TALLOC_CTX *tmp_ctx = talloc_stackframe();
 		char *tmp;
 
 		tdbfile = talloc_asprintf(
-			talloc_tos(), "tdbfile=%s",
+			tmp_ctx, "tdbfile=%s",
 			lp_parm_const_string(-1, "vlp", "tdbfile",
 					     "/tmp/vlp.tdb"));
 		if (tdbfile == NULL) {
 			tdbfile="tdbfile=/tmp/vlp.tdb";
 		}
 
-		tmp = talloc_asprintf(talloc_tos(), "vlp %s print %%p %%s",
+		tmp = talloc_asprintf(tmp_ctx, "vlp %s print %%p %%s",
 				      tdbfile);
 		string_set(&pService->szPrintcommand,
 			   tmp ? tmp : "vlp print %p %s");
-		TALLOC_FREE(tmp);
 
-		tmp = talloc_asprintf(talloc_tos(), "vlp %s lpq %%p",
+		tmp = talloc_asprintf(tmp_ctx, "vlp %s lpq %%p",
 				      tdbfile);
 		string_set(&pService->szLpqcommand,
 			   tmp ? tmp : "vlp lpq %p");
-		TALLOC_FREE(tmp);
 
-		tmp = talloc_asprintf(talloc_tos(), "vlp %s lprm %%p %%j",
+		tmp = talloc_asprintf(tmp_ctx, "vlp %s lprm %%p %%j",
 				      tdbfile);
 		string_set(&pService->szLprmcommand,
 			   tmp ? tmp : "vlp lprm %p %j");
-		TALLOC_FREE(tmp);
 
-		tmp = talloc_asprintf(talloc_tos(), "vlp %s lppause %%p %%j",
+		tmp = talloc_asprintf(tmp_ctx, "vlp %s lppause %%p %%j",
 				      tdbfile);
 		string_set(&pService->szLppausecommand,
 			   tmp ? tmp : "vlp lppause %p %j");
-		TALLOC_FREE(tmp);
 
-		tmp = talloc_asprintf(talloc_tos(), "vlp %s lpresume %%p %%j",
+		tmp = talloc_asprintf(tmp_ctx, "vlp %s lpresume %%p %%j",
 				      tdbfile);
 		string_set(&pService->szLpresumecommand,
 			   tmp ? tmp : "vlp lpresume %p %j");
-		TALLOC_FREE(tmp);
 
-		tmp = talloc_asprintf(talloc_tos(), "vlp %s queuepause %%p",
+		tmp = talloc_asprintf(tmp_ctx, "vlp %s queuepause %%p",
 				      tdbfile);
 		string_set(&pService->szQueuepausecommand,
 			   tmp ? tmp : "vlp queuepause %p");
-		TALLOC_FREE(tmp);
 
-		tmp = talloc_asprintf(talloc_tos(), "vlp %s queueresume %%p",
+		tmp = talloc_asprintf(tmp_ctx, "vlp %s queueresume %%p",
 				      tdbfile);
 		string_set(&pService->szQueueresumecommand,
 			   tmp ? tmp : "vlp queueresume %p");
-		TALLOC_FREE(tmp);
+		TALLOC_FREE(tmp_ctx);
 
 		break;
 	}
@@ -4971,15 +4966,14 @@ static void init_globals(bool reinit_globals)
 }
 
 /*******************************************************************
- Convenience routine to grab string parameters into temporary memory
+ Convenience routine to grab string parameters into talloced memory
  and run standard_sub_basic on them. The buffers can be written to by
  callers without affecting the source string.
 ********************************************************************/
 
-static char *lp_string(const char *s)
+static char *lp_string(TALLOC_CTX *ctx, const char *s)
 {
 	char *ret;
-	TALLOC_CTX *ctx = talloc_tos();
 
 	/* The follow debug is useful for tracking down memory problems
 	   especially if you have an inner loop that is calling a lp_*()
@@ -5015,7 +5009,7 @@ static char *lp_string(const char *s)
 */
 
 #define FN_GLOBAL_STRING(fn_name,ptr) \
- char *lp_ ## fn_name(void) {return(lp_string(*(char **)(&Globals.ptr) ? *(char **)(&Globals.ptr) : ""));}
+char *lp_ ## fn_name(TALLOC_CTX *ctx) {return(lp_string((ctx), *(char **)(&Globals.ptr) ? *(char **)(&Globals.ptr) : ""));}
 #define FN_GLOBAL_CONST_STRING(fn_name,ptr) \
  const char *lp_ ## fn_name(void) {return(*(const char **)(&Globals.ptr) ? *(const char **)(&Globals.ptr) : "");}
 #define FN_GLOBAL_LIST(fn_name,ptr) \
@@ -5028,7 +5022,7 @@ static char *lp_string(const char *s)
  int lp_ ## fn_name(void) {return(*(int *)(&Globals.ptr));}
 
 #define FN_LOCAL_STRING(fn_name,val) \
- char *lp_ ## fn_name(int i) {return(lp_string((LP_SNUM_OK(i) && ServicePtrs[(i)]->val) ? ServicePtrs[(i)]->val : sDefault.val));}
+char *lp_ ## fn_name(TALLOC_CTX *ctx,int i) {return(lp_string((ctx), (LP_SNUM_OK(i) && ServicePtrs[(i)]->val) ? ServicePtrs[(i)]->val : sDefault.val));}
 #define FN_LOCAL_CONST_STRING(fn_name,val) \
  const char *lp_ ## fn_name(int i) {return (const char *)((LP_SNUM_OK(i) && ServicePtrs[(i)]->val) ? ServicePtrs[(i)]->val : sDefault.val);}
 #define FN_LOCAL_LIST(fn_name,val) \
@@ -5289,20 +5283,19 @@ static int lp_enum(const char *s,const struct enum_list *_enum)
 
 /* Return parametric option from a given service. Type is a part of option before ':' */
 /* Parametric option has following syntax: 'Type: option = value' */
-/* the returned value is talloced on the talloc_tos() */
-char *lp_parm_talloc_string(int snum, const char *type, const char *option, const char *def)
+char *lp_parm_talloc_string(TALLOC_CTX *ctx, int snum, const char *type, const char *option, const char *def)
 {
 	struct parmlist_entry *data = get_parametrics(snum, type, option);
 
 	if (data == NULL||data->value==NULL) {
 		if (def) {
-			return lp_string(def);
+			return lp_string(ctx, def);
 		} else {
 			return NULL;
 		}
 	}
 
-	return lp_string(data->value);
+	return lp_string(ctx, data->value);
 }
 
 /* Return parametric option from a given service. Type is a part of option before ':' */
@@ -5637,7 +5630,8 @@ bool lp_add_home(const char *pszHomename, int iDefaultService,
 		return false;
 
 	if (!(*(ServicePtrs[iDefaultService]->szPath))
-	    || strequal(ServicePtrs[iDefaultService]->szPath, lp_pathname(GLOBAL_SECTION_SNUM))) {
+	    || strequal(ServicePtrs[iDefaultService]->szPath,
+			lp_pathname(talloc_tos(), GLOBAL_SECTION_SNUM))) {
 		string_set(&ServicePtrs[i]->szPath, pszHomedir);
 	}
 
@@ -6713,13 +6707,12 @@ static bool handle_realm(struct loadparm_context *unused, int snum, const char *
 {
 	bool ret = true;
 	char *realm = strupper_talloc(talloc_tos(), pszParmValue);
-	char *dnsdomain = strlower_talloc(talloc_tos(), pszParmValue);
+	char *dnsdomain = strlower_talloc(realm, pszParmValue);
 
 	ret &= string_set(&Globals.szRealm, pszParmValue);
 	ret &= string_set(&Globals.szRealm_upper, realm);
 	ret &= string_set(&Globals.szRealm_lower, dnsdomain);
 	TALLOC_FREE(realm);
-	TALLOC_FREE(dnsdomain);
 
 	return ret;
 }
@@ -6912,12 +6905,11 @@ static bool handle_debug_list(struct loadparm_context *unused, int snum, const c
  Handle ldap suffixes - default to ldapsuffix if sub-suffixes are not defined.
 ***************************************************************************/
 
-static const char *append_ldap_suffix( const char *str )
+static const char *append_ldap_suffix(TALLOC_CTX *ctx, const char *str )
 {
 	const char *suffix_string;
 
-
-	suffix_string = talloc_asprintf(talloc_tos(), "%s,%s", str,
+	suffix_string = talloc_asprintf(ctx, "%s,%s", str,
 					Globals.szLdapSuffix );
 	if ( !suffix_string ) {
 		DEBUG(0,("append_ldap_suffix: talloc_asprintf() failed!\n"));
@@ -6927,36 +6919,36 @@ static const char *append_ldap_suffix( const char *str )
 	return suffix_string;
 }
 
-const char *lp_ldap_machine_suffix(void)
+const char *lp_ldap_machine_suffix(TALLOC_CTX *ctx)
 {
 	if (Globals.szLdapMachineSuffix[0])
-		return append_ldap_suffix(Globals.szLdapMachineSuffix);
+		return append_ldap_suffix(ctx, Globals.szLdapMachineSuffix);
 
-	return lp_string(Globals.szLdapSuffix);
+	return lp_string(ctx, Globals.szLdapSuffix);
 }
 
-const char *lp_ldap_user_suffix(void)
+const char *lp_ldap_user_suffix(TALLOC_CTX *ctx)
 {
 	if (Globals.szLdapUserSuffix[0])
-		return append_ldap_suffix(Globals.szLdapUserSuffix);
+		return append_ldap_suffix(ctx, Globals.szLdapUserSuffix);
 
-	return lp_string(Globals.szLdapSuffix);
+	return lp_string(ctx, Globals.szLdapSuffix);
 }
 
-const char *lp_ldap_group_suffix(void)
+const char *lp_ldap_group_suffix(TALLOC_CTX *ctx)
 {
 	if (Globals.szLdapGroupSuffix[0])
-		return append_ldap_suffix(Globals.szLdapGroupSuffix);
+		return append_ldap_suffix(ctx, Globals.szLdapGroupSuffix);
 
-	return lp_string(Globals.szLdapSuffix);
+	return lp_string(ctx, Globals.szLdapSuffix);
 }
 
-const char *lp_ldap_idmap_suffix(void)
+const char *lp_ldap_idmap_suffix(TALLOC_CTX *ctx)
 {
 	if (Globals.szLdapIdmapSuffix[0])
-		return append_ldap_suffix(Globals.szLdapIdmapSuffix);
+		return append_ldap_suffix(ctx, Globals.szLdapIdmapSuffix);
 
-	return lp_string(Globals.szLdapSuffix);
+	return lp_string(ctx, Globals.szLdapSuffix);
 }
 
 /****************************************************************************
@@ -8508,6 +8500,7 @@ int load_usershare_shares(struct smbd_server_connection *sconn,
 	int snum_template = -1;
 	const char *usersharepath = Globals.szUsersharePath;
 	int ret = lp_numservices();
+	TALLOC_CTX *tmp_ctx;
 
 	if (max_user_shares == 0 || *usersharepath == '\0') {
 		return lp_numservices();
@@ -8630,18 +8623,25 @@ int load_usershare_shares(struct smbd_server_connection *sconn,
 
 	/* Sweep through and delete any non-refreshed usershares that are
 	   not currently in use. */
+	tmp_ctx = talloc_stackframe();
 	for (iService = iNumServices - 1; iService >= 0; iService--) {
 		if (VALID(iService) && (ServicePtrs[iService]->usershare == USERSHARE_PENDING_DELETE)) {
+			char *servname;
+
 			if (snumused && snumused(sconn, iService)) {
 				continue;
 			}
+
+			servname = lp_servicename(tmp_ctx, iService);
+
 			/* Remove from the share ACL db. */
 			DEBUG(10,("load_usershare_shares: Removing deleted usershare %s\n",
-				lp_servicename(iService) ));
-			delete_share_security(lp_servicename(iService));
+				  servname ));
+			delete_share_security(servname);
 			free_service_byindex(iService);
 		}
 	}
+	talloc_free(tmp_ctx);
 
 	return lp_numservices();
 }
@@ -8791,7 +8791,7 @@ static bool lp_load_ex(const char *pszFname,
 	}
 
 	{
-		char *serv = lp_auto_services();
+		char *serv = lp_auto_services(talloc_tos());
 		lp_add_auto_services(serv);
 		TALLOC_FREE(serv);
 	}
@@ -9000,7 +9000,7 @@ int lp_servicenumber(const char *pszServiceName)
 
 		if (!usershare_exists(iService, &last_mod)) {
 			/* Remove the share security tdb entry for it. */
-			delete_share_security(lp_servicename(iService));
+			delete_share_security(lp_servicename(talloc_tos(), iService));
 			/* Remove it from the array. */
 			free_service_byindex(iService);
 			/* Doesn't exist anymore. */
@@ -9029,16 +9029,16 @@ int lp_servicenumber(const char *pszServiceName)
  A useful volume label function. 
 ********************************************************************/
 
-const char *volume_label(int snum)
+const char *volume_label(TALLOC_CTX *ctx, int snum)
 {
 	char *ret;
-	const char *label = lp_volume(snum);
+	const char *label = lp_volume(ctx, snum);
 	if (!*label) {
-		label = lp_servicename(snum);
+		label = lp_servicename(ctx, snum);
 	}
 
 	/* This returns a 33 byte guarenteed null terminated string. */
-	ret = talloc_strndup(talloc_tos(), label, 32);
+	ret = talloc_strndup(ctx, label, 32);
 	if (!ret) {
 		return "";
 	}		
@@ -9143,8 +9143,10 @@ void lp_copy_service(int snum, const char *new_name)
 	do_section(new_name, NULL);
 	if (snum >= 0) {
 		snum = lp_servicenumber(new_name);
-		if (snum >= 0)
-			lp_do_parameter(snum, "copy", lp_servicename(snum));
+		if (snum >= 0) {
+			char *name = lp_servicename(talloc_tos(), snum);
+			lp_do_parameter(snum, "copy", name);
+		}
 	}
 }
 
@@ -9158,11 +9160,12 @@ void lp_set_name_resolve_order(const char *new_order)
 	string_set(&Globals.szNameResolveOrder, new_order);
 }
 
-const char *lp_printername(int snum)
+const char *lp_printername(TALLOC_CTX *ctx, int snum)
 {
-	const char *ret = lp__printername(snum);
-	if (ret == NULL || (ret != NULL && *ret == '\0'))
+	const char *ret = lp__printername(talloc_tos(), snum);
+	if (ret == NULL || *ret == '\0') {
 		ret = lp_const_servicename(snum);
+	}
 
 	return ret;
 }
@@ -9372,7 +9375,7 @@ void widelinks_warning(int snum)
 		DEBUG(0,("Share '%s' has wide links and unix extensions enabled. "
 			"These parameters are incompatible. "
 			"Wide links will be disabled for this share.\n",
-			lp_servicename(snum) ));
+			 lp_servicename(talloc_tos(), snum) ));
 	}
 }
 
diff --git a/source3/param/service.c b/source3/param/service.c
index f0cec4e216..5f0910fe0a 100644
--- a/source3/param/service.c
+++ b/source3/param/service.c
@@ -189,7 +189,7 @@ int find_service(TALLOC_CTX *ctx, const char *service_in, char **p_service_out)
 	}
 
 	/* Is it a usershare service ? */
-	if (iService < 0 && *lp_usershare_path()) {
+	if (iService < 0 && *lp_usershare_path(talloc_tos())) {
 		/* Ensure the name is canonicalized. */
 		strlower_m(*p_service_out);
 		iService = load_usershare_service(*p_service_out);
@@ -197,7 +197,7 @@ int find_service(TALLOC_CTX *ctx, const char *service_in, char **p_service_out)
 
 	/* just possibly it's a default service? */
 	if (iService < 0) {
-		char *pdefservice = lp_defaultservice();
+		char *pdefservice = lp_defaultservice(talloc_tos());
 		if (pdefservice &&
 				*pdefservice &&
 				!strequal(pdefservice, *p_service_out)
diff --git a/source3/passdb/pdb_interface.c b/source3/passdb/pdb_interface.c
index fee1e00231..7a73fbfacf 100644
--- a/source3/passdb/pdb_interface.c
+++ b/source3/passdb/pdb_interface.c
@@ -458,11 +458,9 @@ static NTSTATUS pdb_default_create_user(struct pdb_methods *methods,
 		fstring name2;
 
 		if ((acb_info & ACB_NORMAL) && name[strlen(name)-1] != '$') {
-			add_script = talloc_strdup(tmp_ctx,
-					lp_adduser_script());
+			add_script = lp_adduser_script(tmp_ctx);
 		} else {
-			add_script = talloc_strdup(tmp_ctx,
-					lp_addmachine_script());
+			add_script = lp_addmachine_script(tmp_ctx);
 		}
 
 		if (!add_script || add_script[0] == '\0') {
@@ -556,7 +554,7 @@ static int smb_delete_user(const char *unix_user)
 		return -1;
 	}
 
-	del_script = talloc_strdup(talloc_tos(), lp_deluser_script());
+	del_script = lp_deluser_script(talloc_tos());
 	if (!del_script || !*del_script) {
 		return -1;
 	}
diff --git a/source3/passdb/pdb_ipa.c b/source3/passdb/pdb_ipa.c
index c4c3bc8e11..bbd3339f2f 100644
--- a/source3/passdb/pdb_ipa.c
+++ b/source3/passdb/pdb_ipa.c
@@ -121,10 +121,10 @@ static char *get_account_dn(const char *name)
 
 	if (name[strlen(name)-1] == '$') {
 		dn = talloc_asprintf(talloc_tos(), "uid=%s,%s", escape_name,
-				     lp_ldap_machine_suffix());
+				     lp_ldap_machine_suffix(talloc_tos()));
 	} else {
 		dn = talloc_asprintf(talloc_tos(), "uid=%s,%s", escape_name,
-				     lp_ldap_user_suffix());
+				     lp_ldap_user_suffix(talloc_tos()));
 	}
 
 	SAFE_FREE(escape_name);
@@ -1364,11 +1364,11 @@ static NTSTATUS ipasam_create_user(struct pdb_methods *pdb_methods,
 		if (name[strlen(name)-1] == '$') {
 			dn = talloc_asprintf(tmp_ctx, "uid=%s,%s",
 					     escape_username,
-					     lp_ldap_machine_suffix());
+					     lp_ldap_machine_suffix(talloc_tos()));
 		} else {
 			dn = talloc_asprintf(tmp_ctx, "uid=%s,%s",
 					     escape_username,
-					     lp_ldap_user_suffix());
+					     lp_ldap_user_suffix(talloc_tos()));
 		}
 		SAFE_FREE(escape_username);
 		if (!dn) {
diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c
index 68ced934d3..e4dcbc370c 100644
--- a/source3/passdb/pdb_ldap.c
+++ b/source3/passdb/pdb_ldap.c
@@ -190,9 +190,9 @@ static NTSTATUS ldapsam_get_seq_num(struct pdb_methods *my_methods, time_t *seq_
 		return ntstatus;
 	}
 
-	if (!smbldap_has_naming_context(ldap_state->smbldap_state->ldap_struct, lp_ldap_suffix())) {
+	if (!smbldap_has_naming_context(ldap_state->smbldap_state->ldap_struct, lp_ldap_suffix(talloc_tos()))) {
 		DEBUG(3,("ldapsam_get_seq_num: DIT not configured to hold %s "
-			 "as top-level namingContext\n", lp_ldap_suffix()));
+			 "as top-level namingContext\n", lp_ldap_suffix(talloc_tos())));
 		return ntstatus;
 	}
 
@@ -215,7 +215,7 @@ static NTSTATUS ldapsam_get_seq_num(struct pdb_methods *my_methods, time_t *seq_
 		attrs[0] = talloc_strdup(mem_ctx, "syncreplCookie");
 		attrs[1] = NULL;
 		suffix = talloc_asprintf(mem_ctx,
-				"cn=syncrepl%d,%s", rid, lp_ldap_suffix());
+				"cn=syncrepl%d,%s", rid, lp_ldap_suffix(talloc_tos()));
 		if (!suffix) {
 			ntstatus = NT_STATUS_NO_MEMORY;
 			goto done;
@@ -227,7 +227,7 @@ static NTSTATUS ldapsam_get_seq_num(struct pdb_methods *my_methods, time_t *seq_
 		attrs[0] = talloc_strdup(mem_ctx, "contextCSN");
 		attrs[1] = NULL;
 		suffix = talloc_asprintf(mem_ctx,
-				"cn=ldapsync,%s", lp_ldap_suffix());
+				"cn=ldapsync,%s", lp_ldap_suffix(talloc_tos()));
 
 		if (!suffix) {
 			ntstatus = NT_STATUS_NO_MEMORY;
@@ -1998,7 +1998,7 @@ static NTSTATUS ldapsam_rename_sam_account(struct pdb_methods *my_methods,
 	oldname = pdb_get_username(old_acct);
 
 	/* rename the posix user */
-	rename_script = talloc_strdup(talloc_tos(), lp_renameuser_script());
+	rename_script = lp_renameuser_script(talloc_tos());
 	if (rename_script == NULL) {
 		return NT_STATUS_NO_MEMORY;
 	}
@@ -2219,12 +2219,12 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, struct s
 			dn = talloc_asprintf(ctx,
 					"uid=%s,%s",
 					escape_username,
-					lp_ldap_machine_suffix());
+					lp_ldap_machine_suffix(talloc_tos()));
 		} else {
 			dn = talloc_asprintf(ctx,
 					"uid=%s,%s",
 					escape_username,
-					lp_ldap_user_suffix());
+					lp_ldap_user_suffix(talloc_tos()));
 		}
 
 		SAFE_FREE(escape_username);
@@ -2291,7 +2291,7 @@ static int ldapsam_search_one_group (struct ldapsam_privates *ldap_state,
 
 	attr_list = get_attr_list(NULL, groupmap_attr_list);
 	rc = smbldap_search(ldap_state->smbldap_state,
-			    lp_ldap_suffix (), scope,
+			    lp_ldap_suffix (talloc_tos()), scope,
 			    filter, attr_list, 0, result);
 	TALLOC_FREE(attr_list);
 
@@ -2623,7 +2623,7 @@ static NTSTATUS ldapsam_enum_group_members(struct pdb_methods *methods,
 		goto done;
 	}
 
-	rc = smbldap_search(conn, lp_ldap_suffix(),
+	rc = smbldap_search(conn, lp_ldap_suffix(talloc_tos()),
 			    LDAP_SCOPE_SUBTREE, filter, id_attrs, 0,
 			    &result);
 
@@ -2691,7 +2691,7 @@ static NTSTATUS ldapsam_enum_group_members(struct pdb_methods *methods,
 			goto done;
 		}
 
-		rc = smbldap_search(conn, lp_ldap_suffix(),
+		rc = smbldap_search(conn, lp_ldap_suffix(talloc_tos()),
 				    LDAP_SCOPE_SUBTREE, filter, sid_attrs, 0,
 				    &result);
 
@@ -2747,7 +2747,7 @@ static NTSTATUS ldapsam_enum_group_members(struct pdb_methods *methods,
 				 LDAP_OBJ_SAMBASAMACCOUNT,
 				 gidstr);
 
-	rc = smbldap_search(conn, lp_ldap_suffix(),
+	rc = smbldap_search(conn, lp_ldap_suffix(talloc_tos()),
 			    LDAP_SCOPE_SUBTREE, filter, sid_attrs, 0,
 			    &result);
 
@@ -2834,7 +2834,7 @@ static NTSTATUS ldapsam_enum_group_memberships(struct pdb_methods *methods,
 			goto done;
 		}
 
-		rc = smbldap_search(conn, lp_ldap_suffix(),
+		rc = smbldap_search(conn, lp_ldap_suffix(talloc_tos()),
 				    LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
 
 		if (rc != LDAP_SUCCESS)
@@ -2875,7 +2875,7 @@ static NTSTATUS ldapsam_enum_group_memberships(struct pdb_methods *methods,
 		goto done;
 	}
 
-	rc = smbldap_search(conn, lp_ldap_suffix(),
+	rc = smbldap_search(conn, lp_ldap_suffix(talloc_tos()),
 			    LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
 
 	if (rc != LDAP_SUCCESS)
@@ -3052,7 +3052,7 @@ static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods,
 		goto done;
 	}
 
-	rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(),
+	rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(talloc_tos()),
 			    LDAP_SCOPE_SUBTREE, filter, attrs, True, &msg);
 	talloc_autofree_ldapmsg(mem_ctx, msg);
 
@@ -3113,7 +3113,7 @@ static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods,
 
 	dn = talloc_asprintf(mem_ctx, "sambaSid=%s,%s",
 			     sid_string_talloc(mem_ctx, &map->sid),
-			     lp_ldap_group_suffix());
+			     lp_ldap_group_suffix(talloc_tos()));
 	if (dn == NULL) {
 		result = NT_STATUS_NO_MEMORY;
 		goto done;
@@ -3334,7 +3334,7 @@ static NTSTATUS ldapsam_setsamgrent(struct pdb_methods *my_methods,
 		return NT_STATUS_NO_MEMORY;
 	}
 	attr_list = get_attr_list( NULL, groupmap_attr_list );
-	rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(),
+	rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(talloc_tos()),
 			    LDAP_SCOPE_SUBTREE, filter,
 			    attr_list, 0, &ldap_state->result);
 	TALLOC_FREE(attr_list);
@@ -3343,7 +3343,7 @@ static NTSTATUS ldapsam_setsamgrent(struct pdb_methods *my_methods,
 		DEBUG(0, ("ldapsam_setsamgrent: LDAP search failed: %s\n",
 			  ldap_err2string(rc)));
 		DEBUG(3, ("ldapsam_setsamgrent: Query was: %s, %s\n",
-			  lp_ldap_suffix(), filter));
+			  lp_ldap_suffix(talloc_tos()), filter));
 		ldap_msgfree(ldap_state->result);
 		ldap_state->result = NULL;
 		TALLOC_FREE(filter);
@@ -3764,7 +3764,7 @@ static NTSTATUS ldapsam_alias_memberships(struct pdb_methods *methods,
 		result = ldap_state->search_cache.result;
 		ldap_state->search_cache.result = NULL;
 	} else {
-		rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(),
+		rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(talloc_tos()),
 				    LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
 		if (rc != LDAP_SUCCESS) {
 			return NT_STATUS_UNSUCCESSFUL;
@@ -4076,7 +4076,7 @@ static NTSTATUS ldapsam_lookup_rids(struct pdb_methods *methods,
 		}
 
 		rc = smbldap_search(ldap_state->smbldap_state,
-				    lp_ldap_user_suffix(),
+				    lp_ldap_user_suffix(talloc_tos()),
 				    LDAP_SCOPE_SUBTREE, filter, ldap_attrs, 0,
 				    &msg);
 		talloc_autofree_ldapmsg(mem_ctx, msg);
@@ -4144,7 +4144,7 @@ static NTSTATUS ldapsam_lookup_rids(struct pdb_methods *methods,
 		}
 
 		rc = smbldap_search(ldap_state->smbldap_state,
-				    lp_ldap_suffix(),
+				    lp_ldap_suffix(talloc_tos()),
 				    LDAP_SCOPE_SUBTREE, filter, ldap_attrs, 0,
 				    &msg);
 		talloc_autofree_ldapmsg(mem_ctx, msg);
@@ -4573,12 +4573,12 @@ static bool ldapsam_search_users(struct pdb_methods *methods,
 	state->connection = ldap_state->smbldap_state;
 
 	if ((acct_flags != 0) && ((acct_flags & ACB_NORMAL) != 0))
-		state->base = lp_ldap_user_suffix();
+		state->base = lp_ldap_user_suffix(talloc_tos());
 	else if ((acct_flags != 0) &&
 		 ((acct_flags & (ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)) != 0))
-		state->base = lp_ldap_machine_suffix();
+		state->base = lp_ldap_machine_suffix(talloc_tos());
 	else
-		state->base = lp_ldap_suffix();
+		state->base = lp_ldap_suffix(talloc_tos());
 
 	state->acct_flags = acct_flags;
 	state->base = talloc_strdup(search, state->base);
@@ -4746,7 +4746,7 @@ static bool ldapsam_search_grouptype(struct pdb_methods *methods,
 
 	state->connection = ldap_state->smbldap_state;
 
-	state->base = talloc_strdup(search, lp_ldap_suffix());
+	state->base = lp_ldap_suffix(search);
 	state->connection = ldap_state->smbldap_state;
 	state->scope = LDAP_SCOPE_SUBTREE;
 	state->filter =	talloc_asprintf(search, "(&(objectclass=%s)"
@@ -5345,9 +5345,9 @@ static NTSTATUS ldapsam_create_user(struct pdb_methods *my_methods,
 		}
 
 		if (is_machine) {
-			dn = talloc_asprintf(tmp_ctx, "uid=%s,%s", escape_name, lp_ldap_machine_suffix ());
+			dn = talloc_asprintf(tmp_ctx, "uid=%s,%s", escape_name, lp_ldap_machine_suffix (talloc_tos()));
 		} else {
-			dn = talloc_asprintf(tmp_ctx, "uid=%s,%s", escape_name, lp_ldap_user_suffix ());
+			dn = talloc_asprintf(tmp_ctx, "uid=%s,%s", escape_name, lp_ldap_user_suffix (talloc_tos()));
 		}
 
 		SAFE_FREE(escape_name);
@@ -5610,7 +5610,7 @@ static NTSTATUS ldapsam_create_dom_group(struct pdb_methods *my_methods,
 			return NT_STATUS_NO_MEMORY;
 		}
 
-		dn = talloc_asprintf(tmp_ctx, "cn=%s,%s", escape_name, lp_ldap_group_suffix());
+		dn = talloc_asprintf(tmp_ctx, "cn=%s,%s", escape_name, lp_ldap_group_suffix(talloc_tos()));
 
 		SAFE_FREE(escape_name);
 
diff --git a/source3/passdb/pdb_ldap_util.c b/source3/passdb/pdb_ldap_util.c
index 4c86201fb0..522c64fb5d 100644
--- a/source3/passdb/pdb_ldap_util.c
+++ b/source3/passdb/pdb_ldap_util.c
@@ -53,7 +53,7 @@ static NTSTATUS add_new_domain_account_policies(struct smbldap_state *ldap_state
 
 	if (asprintf(&dn, "%s=%s,%s",
 		get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN),
-		escape_domain_name, lp_ldap_suffix()) < 0) {
+		escape_domain_name, lp_ldap_suffix(talloc_tos())) < 0) {
 		SAFE_FREE(escape_domain_name);
 		return NT_STATUS_NO_MEMORY;
 	}
@@ -174,7 +174,7 @@ static NTSTATUS add_new_domain_info(struct smbldap_state *ldap_state,
 
 	if (asprintf(&dn, "%s=%s,%s",
 		     get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN),
-		     escape_domain_name, lp_ldap_suffix()) < 0) {
+		     escape_domain_name, lp_ldap_suffix(talloc_tos())) < 0) {
 		SAFE_FREE(escape_domain_name);
 		return NT_STATUS_NO_MEMORY;
 	}
@@ -285,7 +285,7 @@ NTSTATUS smbldap_search_domain_info(struct smbldap_state *ldap_state,
 
 	if (rc != LDAP_SUCCESS) {
 		DEBUG(2,("smbldap_search_domain_info: Problem during LDAPsearch: %s\n", ldap_err2string (rc)));
-		DEBUG(2,("smbldap_search_domain_info: Query was: %s, %s\n", lp_ldap_suffix(), filter));
+		DEBUG(2,("smbldap_search_domain_info: Query was: %s, %s\n", lp_ldap_suffix(talloc_tos()), filter));
 		goto failed;
 	}
 
diff --git a/source3/passdb/pdb_smbpasswd.c b/source3/passdb/pdb_smbpasswd.c
index 99b275de40..0703ea4607 100644
--- a/source3/passdb/pdb_smbpasswd.c
+++ b/source3/passdb/pdb_smbpasswd.c
@@ -1448,7 +1448,7 @@ static NTSTATUS smbpasswd_rename_sam_account (struct pdb_methods *my_methods,
 	TALLOC_CTX *ctx = talloc_tos();
 	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
 
-	if (!*(lp_renameuser_script()))
+	if (!*(lp_renameuser_script(talloc_tos())))
 		goto done;
 
 	if ( !(new_acct = samu_new( NULL )) ) {
@@ -1468,8 +1468,7 @@ static NTSTATUS smbpasswd_rename_sam_account (struct pdb_methods *my_methods,
 	interim_account = True;
 
 	/* rename the posix user */
-	rename_script = talloc_strdup(ctx,
-				lp_renameuser_script());
+	rename_script = lp_renameuser_script(ctx);
 	if (!rename_script) {
 		ret = NT_STATUS_NO_MEMORY;
 		goto done;
diff --git a/source3/passdb/pdb_tdb.c b/source3/passdb/pdb_tdb.c
index 8b923d6cd8..e0b6261eb9 100644
--- a/source3/passdb/pdb_tdb.c
+++ b/source3/passdb/pdb_tdb.c
@@ -991,7 +991,7 @@ static NTSTATUS tdbsam_rename_sam_account(struct pdb_methods *my_methods,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	rename_script = talloc_strdup(new_acct, lp_renameuser_script());
+	rename_script = lp_renameuser_script(new_acct);
 	if (!rename_script) {
 		TALLOC_FREE(new_acct);
 		return NT_STATUS_NO_MEMORY;
diff --git a/source3/passdb/secrets.c b/source3/passdb/secrets.c
index 83d3e72059..dff855cce6 100644
--- a/source3/passdb/secrets.c
+++ b/source3/passdb/secrets.c
@@ -332,7 +332,7 @@ bool fetch_ldap_pw(char **dn, char** pw)
 	char *key = NULL;
 	size_t size = 0;
 
-	*dn = smb_xstrdup(lp_ldap_admin_dn());
+	*dn = smb_xstrdup(lp_ldap_admin_dn(talloc_tos()));
 
 	if (asprintf(&key, "%s/%s", SECRETS_LDAP_BIND_PW, *dn) < 0) {
 		SAFE_FREE(*dn);
diff --git a/source3/printing/load.c b/source3/printing/load.c
index af4dcc7a2b..136d055088 100644
--- a/source3/printing/load.c
+++ b/source3/printing/load.c
@@ -40,7 +40,7 @@ static void add_auto_printers(void)
 	if (pnum < 0)
 		return;
 
-	auto_serv = lp_auto_services();
+	auto_serv = lp_auto_services(talloc_tos());
 	str = SMB_STRDUP(auto_serv);
 	TALLOC_FREE(auto_serv);
 	if (str == NULL) {
diff --git a/source3/printing/notify.c b/source3/printing/notify.c
index b6b7ea045e..4040a2bab4 100644
--- a/source3/printing/notify.c
+++ b/source3/printing/notify.c
@@ -423,7 +423,7 @@ void notify_printer_status(struct tevent_context *ev,
 			   struct messaging_context *msg_ctx,
 			   int snum, uint32 status)
 {
-	const char *sharename = lp_servicename(snum);
+	const char *sharename = lp_servicename(talloc_tos(), snum);
 
 	if (sharename)
 		notify_printer_status_byname(ev, msg_ctx, sharename, status);
@@ -511,7 +511,7 @@ void notify_printer_driver(struct tevent_context *ev,
 			   struct messaging_context *msg_ctx,
 			   int snum, const char *driver_name)
 {
-	const char *sharename = lp_servicename(snum);
+	const char *sharename = lp_servicename(talloc_tos(), snum);
 
 	send_notify_field_buffer(
 		ev, msg_ctx,
@@ -523,7 +523,7 @@ void notify_printer_comment(struct tevent_context *ev,
 			    struct messaging_context *msg_ctx,
 			    int snum, const char *comment)
 {
-	const char *sharename = lp_servicename(snum);
+	const char *sharename = lp_servicename(talloc_tos(), snum);
 
 	send_notify_field_buffer(
 		ev, msg_ctx,
@@ -535,7 +535,7 @@ void notify_printer_sharename(struct tevent_context *ev,
 			      struct messaging_context *msg_ctx,
 			      int snum, const char *share_name)
 {
-	const char *sharename = lp_servicename(snum);
+	const char *sharename = lp_servicename(talloc_tos(), snum);
 
 	send_notify_field_buffer(
 		ev, msg_ctx,
@@ -547,7 +547,7 @@ void notify_printer_printername(struct tevent_context *ev,
 				struct messaging_context *msg_ctx,
 				int snum, const char *printername)
 {
-	const char *sharename = lp_servicename(snum);
+	const char *sharename = lp_servicename(talloc_tos(), snum);
 
 	send_notify_field_buffer(
 		ev, msg_ctx,
@@ -559,7 +559,7 @@ void notify_printer_port(struct tevent_context *ev,
 			 struct messaging_context *msg_ctx,
 			 int snum, const char *port_name)
 {
-	const char *sharename = lp_servicename(snum);
+	const char *sharename = lp_servicename(talloc_tos(), snum);
 
 	send_notify_field_buffer(
 		ev, msg_ctx,
@@ -571,7 +571,7 @@ void notify_printer_location(struct tevent_context *ev,
 			     struct messaging_context *msg_ctx,
 			     int snum, const char *location)
 {
-	const char *sharename = lp_servicename(snum);
+	const char *sharename = lp_servicename(talloc_tos(), snum);
 
 	send_notify_field_buffer(
 		ev, msg_ctx,
@@ -583,7 +583,7 @@ void notify_printer_sepfile(struct tevent_context *ev,
 			    struct messaging_context *msg_ctx,
 			    int snum, const char *sepfile)
 {
-	const char *sharename = lp_servicename(snum);
+	const char *sharename = lp_servicename(talloc_tos(), snum);
 
 	send_notify_field_buffer(
 		ev, msg_ctx,
diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c
index b821d28326..5050a5d0dc 100644
--- a/source3/printing/nt_printing.c
+++ b/source3/printing/nt_printing.c
@@ -621,7 +621,7 @@ static uint32 get_correct_cversion(struct auth_session_info *session_info,
 				       server_messaging_context(),
 				       &conn,
 				       printdollar_snum,
-				       lp_pathname(printdollar_snum),
+				       lp_pathname(talloc_tos(), printdollar_snum),
 				       session_info, &oldcwd);
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		DEBUG(0,("get_correct_cversion: create_conn_struct "
@@ -1008,7 +1008,7 @@ WERROR move_driver_to_download_area(struct auth_session_info *session_info,
 				       server_messaging_context(),
 				       &conn,
 				       printdollar_snum,
-				       lp_pathname(printdollar_snum),
+				       lp_pathname(talloc_tos(), printdollar_snum),
 				       session_info, &oldcwd);
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		DEBUG(0,("move_driver_to_download_area: create_conn_struct "
@@ -1206,7 +1206,7 @@ bool printer_driver_in_use(TALLOC_CTX *mem_ctx,
 		}
 
 		result = winreg_get_printer(mem_ctx, b,
-					    lp_servicename(snum),
+					    lp_servicename(talloc_tos(), snum),
 					    &pinfo2);
 		if (!W_ERROR_IS_OK(result)) {
 			continue; /* skip */
@@ -1544,7 +1544,7 @@ bool delete_driver_files(const struct auth_session_info *session_info,
 				       server_messaging_context(),
 				       &conn,
 				       printdollar_snum,
-				       lp_pathname(printdollar_snum),
+				       lp_pathname(talloc_tos(), printdollar_snum),
 				       session_info, &oldcwd);
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		DEBUG(0,("delete_driver_files: create_conn_struct "
@@ -1728,7 +1728,7 @@ bool print_access_check(const struct auth_session_info *session_info,
 
 	/* Get printer name */
 
-	pname = lp_printername(snum);
+	pname = lp_printername(talloc_tos(), snum);
 
 	if (!pname || !*pname) {
 		errno = EACCES;
diff --git a/source3/printing/nt_printing_ads.c b/source3/printing/nt_printing_ads.c
index 3551148565..87cab63ceb 100644
--- a/source3/printing/nt_printing_ads.c
+++ b/source3/printing/nt_printing_ads.c
@@ -366,7 +366,7 @@ WERROR check_published_printers(struct messaging_context *msg_ctx)
 		}
 
 		result = winreg_get_printer_internal(tmp_ctx, session_info, msg_ctx,
-					    lp_servicename(snum),
+					    lp_servicename(talloc_tos(), snum),
 					    &pinfo2);
 		if (!W_ERROR_IS_OK(result)) {
 			continue;
diff --git a/source3/printing/nt_printing_os2.c b/source3/printing/nt_printing_os2.c
index 80c02ebc1a..de76d72940 100644
--- a/source3/printing/nt_printing_os2.c
+++ b/source3/printing/nt_printing_os2.c
@@ -73,7 +73,7 @@ static bool set_driver_mapping(const char *from, const char *to)
  */
 WERROR spoolss_map_to_os2_driver(TALLOC_CTX *mem_ctx, const char **pdrivername)
 {
-	const char *mapfile = lp_os2_driver_map();
+	const char *mapfile = lp_os2_driver_map(talloc_tos());
 	char **lines = NULL;
 	const char *drivername;
 	int numlines = 0;
diff --git a/source3/printing/print_cups.c b/source3/printing/print_cups.c
index b5c7b0d4ec..d6903bc3ff 100644
--- a/source3/printing/print_cups.c
+++ b/source3/printing/print_cups.c
@@ -66,8 +66,8 @@ static http_t *cups_connect(TALLOC_CTX *frame)
 	int timeout = lp_cups_connection_timeout();
 	size_t size;
 
-	if (lp_cups_server() != NULL && strlen(lp_cups_server()) > 0) {
-		if (!push_utf8_talloc(frame, &server, lp_cups_server(), &size)) {
+	if (lp_cups_server(talloc_tos()) != NULL && strlen(lp_cups_server(talloc_tos())) > 0) {
+		if (!push_utf8_talloc(frame, &server, lp_cups_server(talloc_tos()), &size)) {
 			return NULL;
 		}
 	} else {
@@ -914,7 +914,8 @@ static int cups_job_submit(int snum, struct printjob *pjob,
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_LANGUAGE,
         	     "attributes-natural-language", NULL, language->language);
 
-	if (!push_utf8_talloc(frame, &printername, lp_printername(snum),
+	if (!push_utf8_talloc(frame, &printername,
+			      lp_printername(talloc_tos(), snum),
 			      &size)) {
 		goto out;
 	}
@@ -951,7 +952,8 @@ static int cups_job_submit(int snum, struct printjob *pjob,
 	 * add any options defined in smb.conf
 	 */
 
-	if (!push_utf8_talloc(frame, &cupsoptions, lp_cups_options(snum), &size)) {
+	if (!push_utf8_talloc(frame, &cupsoptions,
+			      lp_cups_options(talloc_tos(), snum), &size)) {
 		goto out;
 	}
 	num_options = 0;
@@ -973,7 +975,7 @@ static int cups_job_submit(int snum, struct printjob *pjob,
 	if ((response = cupsDoFileRequest(http, request, uri, pjob->filename)) != NULL) {
 		if (response->request.status.status_code >= IPP_OK_CONFLICT) {
 			DEBUG(0,("Unable to print file to %s - %s\n",
-				 lp_printername(snum),
+				 lp_printername(talloc_tos(), snum),
 			         ippErrorString(cupsLastError())));
 		} else {
 			ret = 0;
@@ -987,7 +989,7 @@ static int cups_job_submit(int snum, struct printjob *pjob,
 		}
 	} else {
 		DEBUG(0,("Unable to print file to `%s' - %s\n",
-			 lp_printername(snum),
+			 lp_printername(talloc_tos(), snum),
 			 ippErrorString(cupsLastError())));
 	}
 
@@ -1412,8 +1414,8 @@ static int cups_queue_pause(int snum)
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_LANGUAGE,
         	     "attributes-natural-language", NULL, language->language);
 
-	if (!push_utf8_talloc(frame, &printername, lp_printername(snum),
-			      &size)) {
+	if (!push_utf8_talloc(frame, &printername,
+			      lp_printername(talloc_tos(), snum), &size)) {
 		goto out;
 	}
 	slprintf(uri, sizeof(uri) - 1, "ipp://localhost/printers/%s",
@@ -1434,14 +1436,14 @@ static int cups_queue_pause(int snum)
 	if ((response = cupsDoRequest(http, request, "/admin/")) != NULL) {
 		if (response->request.status.status_code >= IPP_OK_CONFLICT) {
 			DEBUG(0,("Unable to pause printer %s - %s\n",
-				 lp_printername(snum),
+				 lp_printername(talloc_tos(), snum),
 				ippErrorString(cupsLastError())));
 		} else {
 			ret = 0;
 		}
 	} else {
 		DEBUG(0,("Unable to pause printer %s - %s\n",
-			 lp_printername(snum),
+			 lp_printername(talloc_tos(), snum),
 			ippErrorString(cupsLastError())));
 	}
 
@@ -1516,7 +1518,7 @@ static int cups_queue_resume(int snum)
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_LANGUAGE,
         	     "attributes-natural-language", NULL, language->language);
 
-	if (!push_utf8_talloc(frame, &printername, lp_printername(snum),
+	if (!push_utf8_talloc(frame, &printername, lp_printername(talloc_tos(), snum),
 			      &size)) {
 		goto out;
 	}
@@ -1538,14 +1540,14 @@ static int cups_queue_resume(int snum)
 	if ((response = cupsDoRequest(http, request, "/admin/")) != NULL) {
 		if (response->request.status.status_code >= IPP_OK_CONFLICT) {
 			DEBUG(0,("Unable to resume printer %s - %s\n",
-				 lp_printername(snum),
+				 lp_printername(talloc_tos(), snum),
 				ippErrorString(cupsLastError())));
 		} else {
 			ret = 0;
 		}
 	} else {
 		DEBUG(0,("Unable to resume printer %s - %s\n",
-			 lp_printername(snum),
+			 lp_printername(talloc_tos(), snum),
 			ippErrorString(cupsLastError())));
 	}
 
diff --git a/source3/printing/print_generic.c b/source3/printing/print_generic.c
index 8f557376d7..efe910d7b4 100644
--- a/source3/printing/print_generic.c
+++ b/source3/printing/print_generic.c
@@ -73,7 +73,7 @@ static int print_run_command(int snum, const char* printername, bool do_sub,
 
 	if (do_sub && snum != -1) {
 		syscmd = talloc_sub_advanced(ctx,
-				lp_servicename(snum),
+				lp_servicename(talloc_tos(), snum),
 				current_user_info.unix_name,
 				"",
 				current_user.ut.gid,
@@ -117,8 +117,8 @@ static int generic_job_pause(int snum, struct printjob *pjob)
 	
 	/* need to pause the spooled entry */
 	slprintf(jobstr, sizeof(jobstr)-1, "%d", pjob->sysjob);
-	return print_run_command(snum, lp_printername(snum), True,
-				 lp_lppausecommand(snum), NULL,
+	return print_run_command(snum, lp_printername(talloc_tos(), snum), True,
+				 lp_lppausecommand(talloc_tos(), snum), NULL,
 				 "%j", jobstr,
 				 NULL);
 }
@@ -132,8 +132,8 @@ static int generic_job_resume(int snum, struct printjob *pjob)
 
 	/* need to pause the spooled entry */
 	slprintf(jobstr, sizeof(jobstr)-1, "%d", pjob->sysjob);
-	return print_run_command(snum, lp_printername(snum), True,
-				 lp_lpresumecommand(snum), NULL,
+	return print_run_command(snum, lp_printername(talloc_tos(), snum), True,
+				 lp_lpresumecommand(talloc_tos(), snum), NULL,
 				 "%j", jobstr,
 				 NULL);
 }
@@ -254,8 +254,8 @@ static int generic_job_submit(int snum, struct printjob *pjob,
 	slprintf(job_size, sizeof(job_size)-1, "%lu", (unsigned long)pjob->size);
 
 	/* send it to the system spooler */
-	ret = print_run_command(snum, lp_printername(snum), True,
-			lp_printcommand(snum), NULL,
+	ret = print_run_command(snum, lp_printername(talloc_tos(), snum), True,
+			lp_printcommand(talloc_tos(), snum), NULL,
 			"%s", p,
 			"%J", jobname,
 			"%f", p,
@@ -272,8 +272,8 @@ static int generic_job_submit(int snum, struct printjob *pjob,
 	 * determine the backend job identifier (sysjob).
 	 */
 	pjob->sysjob = -1;
-	ret = generic_queue_get(lp_printername(snum), printing_type, lpq_cmd,
-				&q, &status);
+	ret = generic_queue_get(lp_printername(talloc_tos(), snum),
+				printing_type, lpq_cmd, &q, &status);
 	if (ret > 0) {
 		int i;
 		for (i = 0; i < ret; i++) {
@@ -307,8 +307,8 @@ static int generic_job_submit(int snum, struct printjob *pjob,
 ****************************************************************************/
 static int generic_queue_pause(int snum)
 {
-	return print_run_command(snum, lp_printername(snum), True,
-				 lp_queuepausecommand(snum), NULL, NULL);
+	return print_run_command(snum, lp_printername(talloc_tos(), snum), True,
+				 lp_queuepausecommand(talloc_tos(), snum), NULL, NULL);
 }
 
 /****************************************************************************
@@ -316,8 +316,8 @@ static int generic_queue_pause(int snum)
 ****************************************************************************/
 static int generic_queue_resume(int snum)
 {
-	return print_run_command(snum, lp_printername(snum), True,
-				 lp_queueresumecommand(snum), NULL, NULL);
+	return print_run_command(snum, lp_printername(talloc_tos(), snum), True,
+				 lp_queueresumecommand(talloc_tos(), snum), NULL, NULL);
 }
 
 /****************************************************************************
diff --git a/source3/printing/print_iprint.c b/source3/printing/print_iprint.c
index ea0c93778b..62073ddf89 100644
--- a/source3/printing/print_iprint.c
+++ b/source3/printing/print_iprint.c
@@ -50,10 +50,12 @@ iprint_passwd_cb(const char *prompt)	/* I - Prompt */
 
 static const char *iprint_server(void)
 {
-	if ((lp_iprint_server() != NULL) && (strlen(lp_iprint_server()) > 0)) {
+	const char *server = lp_iprint_server(talloc_tos());
+
+	if ((lp_iprint_server(server) != NULL) && (strlen(server) > 0)) {
 		DEBUG(10, ("iprint server explicitly set to %s\n",
-			   lp_iprint_server()));
-		return lp_iprint_server();
+			   server));
+		return server;
 	}
 
 	DEBUG(10, ("iprint server left to default %s\n", cupsServer()));
@@ -576,7 +578,7 @@ static int iprint_job_pause(int snum, struct printjob *pjob)
 	             "attributes-natural-language", NULL, language->language);
 
 	slprintf(uri, sizeof(uri) - 1, "ipp://%s/ipp/%s", iprint_server(),
-		 lp_printername(snum));
+		 lp_printername(talloc_tos(), snum));
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri", NULL, uri);
 
@@ -590,7 +592,7 @@ static int iprint_job_pause(int snum, struct printjob *pjob)
 	*/
 
 	slprintf(httpPath, sizeof(httpPath) - 1, "/ipp/%s",
-		 lp_printername(snum));
+		 lp_printername(talloc_tos(), snum));
 
 	if ((response = cupsDoRequest(http, request, httpPath)) != NULL) {
 		if (response->request.status.status_code >= IPP_OK_CONFLICT) {
@@ -676,7 +678,7 @@ static int iprint_job_resume(int snum, struct printjob *pjob)
 	             "attributes-natural-language", NULL, language->language);
 
 	slprintf(uri, sizeof(uri) - 1, "ipp://%s/ipp/%s", iprint_server(),
-		 lp_printername(snum));
+		 lp_printername(talloc_tos(), snum));
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri", NULL, uri);
 
@@ -690,7 +692,7 @@ static int iprint_job_resume(int snum, struct printjob *pjob)
 	*/
 
 	slprintf(httpPath, sizeof(httpPath) - 1, "/ipp/%s",
-		 lp_printername(snum));
+		 lp_printername(talloc_tos(), snum));
 
 	if ((response = cupsDoRequest(http, request, httpPath)) != NULL) {
 		if (response->request.status.status_code >= IPP_OK_CONFLICT) {
@@ -777,7 +779,7 @@ static int iprint_job_submit(int snum, struct printjob *pjob,
 	             "attributes-natural-language", NULL, language->language);
 
 	slprintf(uri, sizeof(uri) - 1, "ipp://%s/ipp/%s", iprint_server(),
-		 lp_printername(snum));
+		 lp_printername(talloc_tos(), snum));
 
 	ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI,
 	             "printer-uri", NULL, uri);
@@ -796,19 +798,19 @@ static int iprint_job_submit(int snum, struct printjob *pjob,
 	* Do the request and get back a response...
 	*/
 
-	slprintf(uri, sizeof(uri) - 1, "/ipp/%s", lp_printername(snum));
+	slprintf(uri, sizeof(uri) - 1, "/ipp/%s", lp_printername(talloc_tos(), snum));
 
 	if ((response = cupsDoFileRequest(http, request, uri, pjob->filename)) != NULL) {
 		if (response->request.status.status_code >= IPP_OK_CONFLICT) {
 			DEBUG(0,("Unable to print file to %s - %s\n",
-				 lp_printername(snum),
+				 lp_printername(talloc_tos(), snum),
 			         ippErrorString(cupsLastError())));
 		} else {
 			ret = 0;
 		}
 	} else {
 		DEBUG(0,("Unable to print file to `%s' - %s\n",
-			 lp_printername(snum),
+			 lp_printername(talloc_tos(), snum),
 			 ippErrorString(cupsLastError())));
 	}
 
diff --git a/source3/printing/printing.c b/source3/printing/printing.c
index b473c9492f..9a7b110925 100644
--- a/source3/printing/printing.c
+++ b/source3/printing/printing.c
@@ -1660,15 +1660,15 @@ static void print_queue_update(struct messaging_context *msg_ctx,
 	/* don't strip out characters like '$' from the printername */
 
 	lpqcommand = talloc_string_sub2(ctx,
-			lp_lpqcommand(snum),
+			lp_lpqcommand(talloc_tos(), snum),
 			"%p",
-			lp_printername(snum),
+			lp_printername(talloc_tos(), snum),
 			false, false, false);
 	if (!lpqcommand) {
 		return;
 	}
 	lpqcommand = talloc_sub_advanced(ctx,
-			lp_servicename(snum),
+			lp_servicename(talloc_tos(), snum),
 			current_user_info.unix_name,
 			"",
 			current_user.ut.gid,
@@ -1680,15 +1680,15 @@ static void print_queue_update(struct messaging_context *msg_ctx,
 	}
 
 	lprmcommand = talloc_string_sub2(ctx,
-			lp_lprmcommand(snum),
+			lp_lprmcommand(talloc_tos(), snum),
 			"%p",
-			lp_printername(snum),
+			lp_printername(talloc_tos(), snum),
 			false, false, false);
 	if (!lprmcommand) {
 		return;
 	}
 	lprmcommand = talloc_sub_advanced(ctx,
-			lp_servicename(snum),
+			lp_servicename(talloc_tos(), snum),
 			current_user_info.unix_name,
 			"",
 			current_user.ut.gid,
@@ -2141,8 +2141,8 @@ static bool print_job_delete1(struct tevent_context *ev,
 	if (pjob->spooled && pjob->sysjob != -1)
 	{
 		result = (*(current_printif->job_delete))(
-			lp_printername(snum),
-			lp_lprmcommand(snum),
+			lp_printername(talloc_tos(), snum),
+			lp_lprmcommand(talloc_tos(), snum),
 			pjob);
 
 		/* Delete the tdb entry if the delete succeeded or the job hasn't
@@ -2230,7 +2230,7 @@ WERROR print_job_delete(const struct auth_session_info *server_info,
 			      "Permission denied-- user not allowed to delete, \
 pause, or resume print job. User name: %s. Printer name: %s.",
 			      uidtoname(server_info->unix_token->uid),
-			      lp_printername(snum) );
+			      lp_printername(talloc_tos(), snum) );
 		/* END_ADMIN_LOG */
 
 		werr = WERR_ACCESS_DENIED;
@@ -2320,7 +2320,7 @@ WERROR print_job_pause(const struct auth_session_info *server_info,
 			"Permission denied-- user not allowed to delete, \
 pause, or resume print job. User name: %s. Printer name: %s.",
 			      uidtoname(server_info->unix_token->uid),
-			      lp_printername(snum) );
+			      lp_printername(talloc_tos(), snum) );
 		/* END_ADMIN_LOG */
 
 		werr = WERR_ACCESS_DENIED;
@@ -2392,7 +2392,7 @@ WERROR print_job_resume(const struct auth_session_info *server_info,
 			 "Permission denied-- user not allowed to delete, \
 pause, or resume print job. User name: %s. Printer name: %s.",
 			      uidtoname(server_info->unix_token->uid),
-			      lp_printername(snum) );
+			      lp_printername(talloc_tos(), snum) );
 		/* END_ADMIN_LOG */
 		werr = WERR_ACCESS_DENIED;
 		goto err_out;
@@ -2665,7 +2665,7 @@ static WERROR print_job_checks(const struct auth_session_info *server_info,
 	/* see if we have sufficient disk space */
 	if (lp_minprintspace(snum)) {
 		minspace = lp_minprintspace(snum);
-		ret = sys_fsusage(lp_pathname(snum), &dspace, &dsize);
+		ret = sys_fsusage(lp_pathname(talloc_tos(), snum), &dspace, &dsize);
 		if (ret == 0 && dspace < 2*minspace) {
 			DEBUG(3, ("print_job_checks: "
 				  "disk space check failed.\n"));
@@ -2710,7 +2710,7 @@ static WERROR print_job_spool_file(int snum, uint32_t jobid,
 	 * Verify that the file name is ok, within path, and it is
 	 * already already there */
 	if (output_file) {
-		path = lp_pathname(snum);
+		path = lp_pathname(talloc_tos(), snum);
 		len = strlen(path);
 		if (strncmp(output_file, path, len) == 0 &&
 		    (output_file[len - 1] == '/' || output_file[len] == '/')) {
@@ -2739,7 +2739,7 @@ static WERROR print_job_spool_file(int snum, uint32_t jobid,
 	}
 
 	slprintf(pjob->filename, sizeof(pjob->filename)-1,
-		 "%s/%s%.8u.XXXXXX", lp_pathname(snum),
+		 "%s/%s%.8u.XXXXXX", lp_pathname(talloc_tos(), snum),
 		 PRINT_SPOOL_PREFIX, (unsigned int)jobid);
 	pjob->fd = mkstemp(pjob->filename);
 
@@ -2784,7 +2784,7 @@ WERROR print_job_start(const struct auth_session_info *server_info,
 		return WERR_INTERNAL_DB_CORRUPTION;
 	}
 
-	path = lp_pathname(snum);
+	path = lp_pathname(talloc_tos(), snum);
 
 	werr = print_job_checks(server_info, msg_ctx, snum, &njobs);
 	if (!W_ERROR_IS_OK(werr)) {
@@ -2974,16 +2974,16 @@ NTSTATUS print_job_end(struct messaging_context *msg_ctx, int snum,
 
 	/* don't strip out characters like '$' from the printername */
 	lpq_cmd = talloc_string_sub2(tmp_ctx,
-				     lp_lpqcommand(snum),
+				     lp_lpqcommand(talloc_tos(), snum),
 				     "%p",
-				     lp_printername(snum),
+				     lp_printername(talloc_tos(), snum),
 				     false, false, false);
 	if (lpq_cmd == NULL) {
 		status = NT_STATUS_PRINT_CANCELLED;
 		goto fail;
 	}
 	lpq_cmd = talloc_sub_advanced(tmp_ctx,
-				      lp_servicename(snum),
+				      lp_servicename(talloc_tos(), snum),
 				      current_user_info.unix_name,
 				      "",
 				      current_user.ut.gid,
@@ -3044,7 +3044,7 @@ static bool get_stored_queue_info(struct messaging_context *msg_ctx,
 	uint32 i;
 	int max_reported_jobs = lp_max_reported_jobs(snum);
 	bool ret = False;
-	const char* sharename = lp_servicename(snum);
+	const char* sharename = lp_servicename(talloc_tos(), snum);
 	TALLOC_CTX *tmp_ctx = talloc_new(msg_ctx);
 	if (tmp_ctx == NULL) {
 		return false;
diff --git a/source3/printing/printspoolss.c b/source3/printing/printspoolss.c
index b94314e420..8a38a7fe7a 100644
--- a/source3/printing/printspoolss.c
+++ b/source3/printing/printspoolss.c
@@ -78,7 +78,7 @@ NTSTATUS print_spool_open(files_struct *fsp,
 		status = NT_STATUS_NO_MEMORY;
 		goto done;
 	}
-	pf->svcname = talloc_strdup(pf, lp_servicename(SNUM(fsp->conn)));
+	pf->svcname = lp_servicename(pf, SNUM(fsp->conn));
 
 	/* the document name is derived from the file name.
 	 * "Remote Downlevel Document" is added in front to
@@ -118,7 +118,8 @@ NTSTATUS print_spool_open(files_struct *fsp,
 	 */
 
 	pf->filename = talloc_asprintf(pf, "%s/%sXXXXXX",
-					lp_pathname(SNUM(fsp->conn)),
+					lp_pathname(talloc_tos(),
+						    SNUM(fsp->conn)),
 					PRINT_SPOOL_PREFIX);
 	if (!pf->filename) {
 		status = NT_STATUS_NO_MEMORY;
diff --git a/source3/printing/spoolssd.c b/source3/printing/spoolssd.c
index f4bba76bc7..bb043bdba7 100644
--- a/source3/printing/spoolssd.c
+++ b/source3/printing/spoolssd.c
@@ -58,7 +58,7 @@ pid_t start_spoolssd(struct tevent_context *ev_ctx,
 
 static void spoolss_reopen_logs(int child_id)
 {
-	char *lfile = lp_logfile();
+	char *lfile = lp_logfile(talloc_tos());
 	char *ext;
 	int rc;
 
@@ -80,10 +80,12 @@ static void spoolss_reopen_logs(int child_id)
 		if (strstr(lfile, ext) == NULL) {
 			if (child_id) {
 				rc = asprintf(&lfile, "%s.%d",
-					      lp_logfile(), child_id);
+					      lp_logfile(talloc_tos()),
+					      child_id);
 			} else {
 				rc = asprintf(&lfile, "%s.%s",
-					      lp_logfile(), ext);
+					      lp_logfile(talloc_tos()),
+					      ext);
 			}
 		}
 	}
@@ -607,14 +609,14 @@ static void print_queue_forward(struct messaging_context *msg,
 
 static char *get_bq_logfile(void)
 {
-	char *lfile = lp_logfile();
+	char *lfile = lp_logfile(talloc_tos());
 	int rc;
 
 	if (lfile == NULL || lfile[0] == '\0') {
 		rc = asprintf(&lfile, "%s/log.%s.bq",
 					get_dyn_LOGFILEBASE(), DAEMON_NAME);
 	} else {
-		rc = asprintf(&lfile, "%s.bq", lp_logfile());
+		rc = asprintf(&lfile, "%s.bq", lp_logfile(talloc_tos()));
 	}
 	if (rc == -1) {
 		lfile = NULL;
diff --git a/source3/rpc_server/epmd.c b/source3/rpc_server/epmd.c
index 46b5c52bb7..f30372edad 100644
--- a/source3/rpc_server/epmd.c
+++ b/source3/rpc_server/epmd.c
@@ -38,7 +38,7 @@ void start_epmd(struct tevent_context *ev_ctx,
 
 static void epmd_reopen_logs(void)
 {
-	char *lfile = lp_logfile();
+	char *lfile = lp_logfile(talloc_tos());
 	int rc;
 
 	if (lfile == NULL || lfile[0] == '\0') {
@@ -49,7 +49,8 @@ static void epmd_reopen_logs(void)
 		}
 	} else {
 		if (strstr(lfile, DAEMON_NAME) == NULL) {
-			rc = asprintf(&lfile, "%s.%s", lp_logfile(), DAEMON_NAME);
+			rc = asprintf(&lfile, "%s.%s",
+				      lp_logfile(talloc_tos()), DAEMON_NAME);
 			if (rc > 0) {
 				lp_set_logfile(lfile);
 				SAFE_FREE(lfile);
diff --git a/source3/rpc_server/lsasd.c b/source3/rpc_server/lsasd.c
index 8be70984db..fd6c248294 100644
--- a/source3/rpc_server/lsasd.c
+++ b/source3/rpc_server/lsasd.c
@@ -61,7 +61,7 @@ void start_lsasd(struct tevent_context *ev_ctx,
 
 static void lsasd_reopen_logs(int child_id)
 {
-	char *lfile = lp_logfile();
+	char *lfile = lp_logfile(talloc_tos());
 	char *extension;
 	int rc;
 
@@ -82,11 +82,11 @@ static void lsasd_reopen_logs(int child_id)
 		if (strstr(lfile, extension) == NULL) {
 			if (child_id) {
 				rc = asprintf(&lfile, "%s.%d",
-						lp_logfile(),
+						lp_logfile(talloc_tos()),
 						child_id);
 			} else {
 				rc = asprintf(&lfile, "%s.%s",
-						lp_logfile(),
+						lp_logfile(talloc_tos()),
 						extension);
 			}
 		}
diff --git a/source3/rpc_server/samr/srv_samr_chgpasswd.c b/source3/rpc_server/samr/srv_samr_chgpasswd.c
index 94d7021349..51c0d0f96a 100644
--- a/source3/rpc_server/samr/srv_samr_chgpasswd.c
+++ b/source3/rpc_server/samr/srv_samr_chgpasswd.c
@@ -582,12 +582,12 @@ bool chgpasswd(const char *name, const char *rhost, const struct passwd *pass,
 		return false;
 	}
 
-	passwordprogram = talloc_strdup(ctx, lp_passwd_program());
+	passwordprogram = lp_passwd_program(ctx);
 	if (!passwordprogram || !*passwordprogram) {
 		DEBUG(2, ("chgpasswd: Null password program - no password changing\n"));
 		return false;
 	}
-	chatsequence = talloc_strdup(ctx, lp_passwd_chat());
+	chatsequence = lp_passwd_chat(ctx);
 	if (!chatsequence || !*chatsequence) {
 		DEBUG(2, ("chgpasswd: Null chat sequence - no password changing\n"));
 		return false;
@@ -938,12 +938,12 @@ NTSTATUS check_password_complexity(const char *username,
 	char *cmd;
 
 	/* Use external script to check password complexity */
-	if ((lp_check_password_script() == NULL)
-	    || (*(lp_check_password_script()) == '\0')) {
+	if ((lp_check_password_script(tosctx) == NULL)
+	    || (*(lp_check_password_script(tosctx)) == '\0')) {
 		return NT_STATUS_OK;
 	}
 
-	cmd = talloc_string_sub(tosctx, lp_check_password_script(), "%u",
+	cmd = talloc_string_sub(tosctx, lp_check_password_script(tosctx), "%u",
 				username);
 	if (!cmd) {
 		return NT_STATUS_PASSWORD_RESTRICTION;
diff --git a/source3/rpc_server/samr/srv_samr_nt.c b/source3/rpc_server/samr/srv_samr_nt.c
index d7cebb4535..1065f2ac6a 100644
--- a/source3/rpc_server/samr/srv_samr_nt.c
+++ b/source3/rpc_server/samr/srv_samr_nt.c
@@ -545,7 +545,8 @@ NTSTATUS _samr_GetUserPwInfo(struct pipes_struct *p,
 					       &password_properties);
 			unbecome_root();
 
-			if (lp_check_password_script() && *lp_check_password_script()) {
+			if (lp_check_password_script(talloc_tos())
+			    && *lp_check_password_script(talloc_tos())) {
 				password_properties |= DOMAIN_PASSWORD_COMPLEX;
 			}
 
@@ -2050,7 +2051,8 @@ NTSTATUS _samr_ChangePasswordUser3(struct pipes_struct *p,
 		unix_to_nt_time_abs((NTTIME *)&dominfo->max_password_age, u_expire);
 		unix_to_nt_time_abs((NTTIME *)&dominfo->min_password_age, u_min_age);
 
-		if (lp_check_password_script() && *lp_check_password_script()) {
+		if (lp_check_password_script(talloc_tos())
+			&& *lp_check_password_script(talloc_tos())) {
 			dominfo->password_properties |= DOMAIN_PASSWORD_COMPLEX;
 		}
 
@@ -3313,7 +3315,7 @@ static NTSTATUS query_dom_info_1(TALLOC_CTX *mem_ctx,
 	unix_to_nt_time_abs((NTTIME *)&r->max_password_age, u_expire);
 	unix_to_nt_time_abs((NTTIME *)&r->min_password_age, u_min_age);
 
-	if (lp_check_password_script() && *lp_check_password_script()) {
+	if (lp_check_password_script(talloc_tos()) && *lp_check_password_script(talloc_tos())) {
 		r->password_properties |= DOMAIN_PASSWORD_COMPLEX;
 	}
 
@@ -3350,7 +3352,7 @@ static NTSTATUS query_dom_info_2(TALLOC_CTX *mem_ctx,
 
 	unbecome_root();
 
-	r->oem_information.string	= lp_serverstring();
+	r->oem_information.string	= lp_serverstring(r);
 	r->domain_name.string		= lp_workgroup();
 	r->primary.string		= lp_netbios_name();
 	r->sequence_num			= seq_num;
@@ -3394,7 +3396,7 @@ static NTSTATUS query_dom_info_3(TALLOC_CTX *mem_ctx,
 static NTSTATUS query_dom_info_4(TALLOC_CTX *mem_ctx,
 				 struct samr_DomOEMInformation *r)
 {
-	r->oem_information.string = lp_serverstring();
+	r->oem_information.string = lp_serverstring(r);
 
 	return NT_STATUS_OK;
 }
@@ -6266,7 +6268,7 @@ NTSTATUS _samr_GetDomPwInfo(struct pipes_struct *p,
 			       &password_properties);
 	unbecome_root();
 
-	if (lp_check_password_script() && *lp_check_password_script()) {
+	if (lp_check_password_script(talloc_tos()) && *lp_check_password_script(talloc_tos())) {
 		password_properties |= DOMAIN_PASSWORD_COMPLEX;
 	}
 
diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c
index e0612ac36c..ff342dea92 100644
--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c
+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c
@@ -374,7 +374,7 @@ static WERROR delete_printer_hook(TALLOC_CTX *ctx, struct security_token *token,
 				  const char *sharename,
 				  struct messaging_context *msg_ctx)
 {
-	char *cmd = lp_deleteprinter_cmd();
+	char *cmd = lp_deleteprinter_cmd(talloc_tos());
 	char *command = NULL;
 	int ret;
 	bool is_print_op = false;
@@ -2772,7 +2772,7 @@ static void spoolss_notify_share_name(struct messaging_context *msg_ctx,
 				      struct spoolss_PrinterInfo2 *pinfo2,
 				      TALLOC_CTX *mem_ctx)
 {
-	SETUP_SPOOLSS_NOTIFY_DATA_STRING(data, lp_servicename(snum));
+	SETUP_SPOOLSS_NOTIFY_DATA_STRING(data, lp_servicename(talloc_tos(), snum));
 }
 
 /*******************************************************************
@@ -2818,7 +2818,7 @@ static void spoolss_notify_comment(struct messaging_context *msg_ctx,
 	const char *p;
 
 	if (*pinfo2->comment == '\0') {
-		p = lp_comment(snum);
+		p = lp_comment(talloc_tos(), snum);
 	} else {
 		p = pinfo2->comment;
 	}
@@ -3385,7 +3385,7 @@ static bool construct_notify_printer_info(struct messaging_context *msg_ctx,
 
 	DEBUG(4,("construct_notify_printer_info: Notify type: [%s], number of notify info: [%d] on printer: [%s]\n",
 		(type == PRINTER_NOTIFY_TYPE ? "PRINTER_NOTIFY_TYPE" : "JOB_NOTIFY_TYPE"),
-		option_type->count, lp_servicename(snum)));
+		option_type->count, lp_servicename(talloc_tos(), snum)));
 
 	for(field_num=0; field_num < option_type->count; field_num++) {
 		field = option_type->fields[field_num].field;
@@ -3552,12 +3552,12 @@ static WERROR printserver_notify_info(struct pipes_struct *p,
 			result = winreg_get_printer_internal(mem_ctx,
 						    get_session_info_system(),
 						    p->msg_ctx,
-						    lp_servicename(snum),
+						    lp_servicename(talloc_tos(), snum),
 						    &pinfo2);
 			if (!W_ERROR_IS_OK(result)) {
 				DEBUG(4, ("printserver_notify_info: "
 					  "Failed to get printer [%s]\n",
-					  lp_servicename(snum)));
+					  lp_servicename(talloc_tos(), snum)));
 				continue;
 			}
 
@@ -3640,7 +3640,7 @@ static WERROR printer_notify_info(struct pipes_struct *p,
 	result = winreg_get_printer_internal(mem_ctx,
 				    get_session_info_system(),
 				    p->msg_ctx,
-				    lp_servicename(snum), &pinfo2);
+				    lp_servicename(talloc_tos(), snum), &pinfo2);
 	if (!W_ERROR_IS_OK(result)) {
 		return WERR_BADFID;
 	}
@@ -3929,7 +3929,7 @@ static WERROR construct_printer_info1(TALLOC_CTX *mem_ctx,
 	r->flags		= flags;
 
 	if (info2->comment == NULL || info2->comment[0] == '\0') {
-		r->comment	= talloc_strdup(mem_ctx, lp_comment(snum));
+		r->comment	= lp_comment(mem_ctx, snum);
 	} else {
 		r->comment	= talloc_strdup(mem_ctx, info2->comment); /* saved comment */
 	}
@@ -3979,7 +3979,7 @@ static WERROR construct_printer_info2(TALLOC_CTX *mem_ctx,
 		return result;
 	}
 
-	r->sharename		= talloc_strdup(mem_ctx, lp_servicename(snum));
+	r->sharename		= lp_servicename(mem_ctx, snum);
 	W_ERROR_HAVE_NO_MEMORY(r->sharename);
 	r->portname		= talloc_strdup(mem_ctx, info2->portname);
 	W_ERROR_HAVE_NO_MEMORY(r->portname);
@@ -3987,7 +3987,7 @@ static WERROR construct_printer_info2(TALLOC_CTX *mem_ctx,
 	W_ERROR_HAVE_NO_MEMORY(r->drivername);
 
 	if (info2->comment[0] == '\0') {
-		r->comment	= talloc_strdup(mem_ctx, lp_comment(snum));
+		r->comment	= lp_comment(mem_ctx, snum);
 	} else {
 		r->comment	= talloc_strdup(mem_ctx, info2->comment);
 	}
@@ -4170,7 +4170,7 @@ static WERROR construct_printer_info7(TALLOC_CTX *mem_ctx,
 
 	if (is_printer_published(mem_ctx, session_info, msg_ctx,
 				 servername,
-				 lp_servicename(snum), &guid, NULL)) {
+				 lp_servicename(talloc_tos(), snum), &guid, NULL)) {
 		r->guid = talloc_strdup_upper(mem_ctx, GUID_string2(mem_ctx, &guid));
 		r->action = DSPRINT_PUBLISH;
 	} else {
@@ -6089,7 +6089,7 @@ static bool check_printer_ok(TALLOC_CTX *mem_ctx,
 
 static WERROR add_port_hook(TALLOC_CTX *ctx, struct security_token *token, const char *portname, const char *uri)
 {
-	char *cmd = lp_addport_cmd();
+	char *cmd = lp_addport_cmd(talloc_tos());
 	char *command = NULL;
 	int ret;
 	bool is_print_op = false;
@@ -6150,7 +6150,7 @@ static bool add_printer_hook(TALLOC_CTX *ctx, struct security_token *token,
 			     const char *remote_machine,
 			     struct messaging_context *msg_ctx)
 {
-	char *cmd = lp_addprinter_cmd();
+	char *cmd = lp_addprinter_cmd(talloc_tos());
 	char **qlines;
 	char *command = NULL;
 	int numlines;
@@ -6705,7 +6705,7 @@ static WERROR update_printer(struct pipes_struct *p,
 	/* Call addprinter hook */
 	/* Check changes to see if this is really needed */
 
-	if (*lp_addprinter_cmd() &&
+	if (*lp_addprinter_cmd(talloc_tos()) &&
 			(!strequal(printer->drivername, old_printer->drivername) ||
 			 !strequal(printer->comment, old_printer->comment) ||
 			 !strequal(printer->portname, old_printer->portname) ||
@@ -6785,7 +6785,7 @@ static WERROR publish_or_unpublish_printer(struct pipes_struct *p,
 	result = winreg_get_printer_internal(p->mem_ctx,
 				    get_session_info_system(),
 				    p->msg_ctx,
-				    lp_servicename(snum),
+				    lp_servicename(talloc_tos(), snum),
 				    &pinfo2);
 	if (!W_ERROR_IS_OK(result)) {
 		return WERR_BADFID;
@@ -6961,7 +6961,7 @@ static WERROR fill_job_info1(TALLOC_CTX *mem_ctx,
 
 	r->job_id		= queue->sysjob;
 
-	r->printer_name		= talloc_strdup(mem_ctx, lp_servicename(snum));
+	r->printer_name		= lp_servicename(mem_ctx, snum);
 	W_ERROR_HAVE_NO_MEMORY(r->printer_name);
 	r->server_name		= talloc_strdup(mem_ctx, pinfo2->servername);
 	W_ERROR_HAVE_NO_MEMORY(r->server_name);
@@ -7002,7 +7002,7 @@ static WERROR fill_job_info2(TALLOC_CTX *mem_ctx,
 
 	r->job_id		= queue->sysjob;
 
-	r->printer_name		= talloc_strdup(mem_ctx, lp_servicename(snum));
+	r->printer_name		= lp_servicename(mem_ctx, snum);
 	W_ERROR_HAVE_NO_MEMORY(r->printer_name);
 	r->server_name		= talloc_strdup(mem_ctx, pinfo2->servername);
 	W_ERROR_HAVE_NO_MEMORY(r->server_name);
@@ -7779,7 +7779,7 @@ static WERROR fill_port_2(TALLOC_CTX *mem_ctx,
 
 static WERROR enumports_hook(TALLOC_CTX *ctx, int *count, char ***lines)
 {
-	char *cmd = lp_enumports_cmd();
+	char *cmd = lp_enumports_cmd(talloc_tos());
 	char **qlines = NULL;
 	char *command = NULL;
 	int numlines;
@@ -8043,7 +8043,7 @@ static WERROR spoolss_addprinterex_level_2(struct pipes_struct *p,
 	/* FIXME!!!  smbd should check to see if the driver is installed before
 	   trying to add a printer like this  --jerry */
 
-	if (*lp_addprinter_cmd() ) {
+	if (*lp_addprinter_cmd(talloc_tos()) ) {
 		char *raddr;
 
 		raddr = tsocket_address_inet_addr_string(p->remote_address,
@@ -9572,7 +9572,7 @@ WERROR _spoolss_SetPrinterDataEx(struct pipes_struct *p,
 	}
 
 	result = winreg_get_printer(tmp_ctx, b,
-				    lp_servicename(snum),
+				    lp_servicename(talloc_tos(), snum),
 				    &pinfo2);
 	if (!W_ERROR_IS_OK(result)) {
 		goto done;
diff --git a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
index e61fd2f47f..7f34ec28e0 100644
--- a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
+++ b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
@@ -261,7 +261,7 @@ static enum srvsvc_ShareType get_share_type(int snum)
 		type = lp_administrative_share(snum)
 			? STYPE_PRINTQ_HIDDEN : STYPE_PRINTQ;
 	}
-	if (strequal(lp_fstype(snum), "IPC")) {
+	if (strequal(lp_fstype(talloc_tos(), snum), "IPC")) {
 		type = lp_administrative_share(snum)
 			? STYPE_IPC_HIDDEN : STYPE_IPC;
 	}
@@ -275,7 +275,7 @@ static enum srvsvc_ShareType get_share_type(int snum)
 static void init_srv_share_info_0(struct pipes_struct *p,
 				  struct srvsvc_NetShareInfo0 *r, int snum)
 {
-	r->name		= lp_servicename(snum);
+	r->name		= lp_servicename(talloc_tos(), snum);
 }
 
 /*******************************************************************
@@ -286,13 +286,13 @@ static void init_srv_share_info_1(struct pipes_struct *p,
 				  struct srvsvc_NetShareInfo1 *r,
 				  int snum)
 {
-	char *net_name = lp_servicename(snum);
-	char *remark = talloc_strdup(p->mem_ctx, lp_comment(snum));
+	char *net_name = lp_servicename(talloc_tos(), snum);
+	char *remark = lp_comment(p->mem_ctx, snum);
 
 	if (remark) {
 		remark = talloc_sub_advanced(
-			p->mem_ctx, lp_servicename(snum),
-			get_current_username(), lp_pathname(snum),
+			p->mem_ctx, lp_servicename(talloc_tos(), snum),
+			get_current_username(), lp_pathname(talloc_tos(), snum),
 			p->session_info->unix_token->uid, get_current_username(),
 			"", remark);
 	}
@@ -314,18 +314,18 @@ static void init_srv_share_info_2(struct pipes_struct *p,
 	char *path = NULL;
 	int max_connections = lp_max_connections(snum);
 	uint32_t max_uses = max_connections!=0 ? max_connections : (uint32_t)-1;
-	char *net_name = lp_servicename(snum);
+	char *net_name = lp_servicename(talloc_tos(), snum);
 
-	remark = talloc_strdup(p->mem_ctx, lp_comment(snum));
+	remark = lp_comment(p->mem_ctx, snum);
 	if (remark) {
 		remark = talloc_sub_advanced(
-			p->mem_ctx, lp_servicename(snum),
-			get_current_username(), lp_pathname(snum),
+			p->mem_ctx, lp_servicename(talloc_tos(), snum),
+			get_current_username(), lp_pathname(talloc_tos(), snum),
 			p->session_info->unix_token->uid, get_current_username(),
 			"", remark);
 	}
 	path = talloc_asprintf(p->mem_ctx,
-			"C:%s", lp_pathname(snum));
+			"C:%s", lp_pathname(talloc_tos(), snum));
 
 	if (path) {
 		/*
@@ -379,13 +379,13 @@ static void map_generic_share_sd_bits(struct security_descriptor *psd)
 static void init_srv_share_info_501(struct pipes_struct *p,
 				    struct srvsvc_NetShareInfo501 *r, int snum)
 {
-	const char *net_name = lp_servicename(snum);
-	char *remark = talloc_strdup(p->mem_ctx, lp_comment(snum));
+	const char *net_name = lp_servicename(talloc_tos(), snum);
+	char *remark = lp_comment(p->mem_ctx, snum);
 
 	if (remark) {
 		remark = talloc_sub_advanced(
-			p->mem_ctx, lp_servicename(snum),
-			get_current_username(), lp_pathname(snum),
+			p->mem_ctx, lp_servicename(talloc_tos(), snum),
+			get_current_username(), lp_pathname(talloc_tos(), snum),
 			p->session_info->unix_token->uid, get_current_username(),
 			"", remark);
 	}
@@ -403,22 +403,22 @@ static void init_srv_share_info_501(struct pipes_struct *p,
 static void init_srv_share_info_502(struct pipes_struct *p,
 				    struct srvsvc_NetShareInfo502 *r, int snum)
 {
-	const char *net_name = lp_servicename(snum);
+	const char *net_name = lp_servicename(talloc_tos(), snum);
 	char *path = NULL;
 	struct security_descriptor *sd = NULL;
 	struct sec_desc_buf *sd_buf = NULL;
 	size_t sd_size = 0;
 	TALLOC_CTX *ctx = p->mem_ctx;
-	char *remark = talloc_strdup(ctx, lp_comment(snum));
+	char *remark = lp_comment(ctx, snum);
 
 	if (remark) {
 		remark = talloc_sub_advanced(
-			p->mem_ctx, lp_servicename(snum),
-			get_current_username(), lp_pathname(snum),
+			p->mem_ctx, lp_servicename(talloc_tos(), snum),
+			get_current_username(), lp_pathname(talloc_tos(), snum),
 			p->session_info->unix_token->uid, get_current_username(),
 			"", remark);
 	}
-	path = talloc_asprintf(ctx, "C:%s", lp_pathname(snum));
+	path = talloc_asprintf(ctx, "C:%s", lp_pathname(talloc_tos(), snum));
 	if (path) {
 		/*
 		 * Change / to \\ so that win2k will see it as a valid path.  This was added to
@@ -427,7 +427,7 @@ static void init_srv_share_info_502(struct pipes_struct *p,
 		string_replace(path, '/', '\\');
 	}
 
-	sd = get_share_security(ctx, lp_servicename(snum), &sd_size);
+	sd = get_share_security(ctx, lp_servicename(talloc_tos(), snum), &sd_size);
 
 	sd_buf = make_sec_desc_buf(p->mem_ctx, sd_size, sd);
 
@@ -450,12 +450,12 @@ static void init_srv_share_info_1004(struct pipes_struct *p,
 				     struct srvsvc_NetShareInfo1004 *r,
 				     int snum)
 {
-	char *remark = talloc_strdup(p->mem_ctx, lp_comment(snum));
+	char *remark = lp_comment(p->mem_ctx, snum);
 
 	if (remark) {
 		remark = talloc_sub_advanced(
-			p->mem_ctx, lp_servicename(snum),
-			get_current_username(), lp_pathname(snum),
+			p->mem_ctx, lp_servicename(talloc_tos(), snum),
+			get_current_username(), lp_pathname(talloc_tos(), snum),
 			p->session_info->unix_token->uid, get_current_username(),
 			"", remark);
 	}
@@ -518,7 +518,7 @@ static void init_srv_share_info_1501(struct pipes_struct *p,
 	size_t sd_size;
 	TALLOC_CTX *ctx = p->mem_ctx;
 
-	sd = get_share_security(ctx, lp_servicename(snum), &sd_size);
+	sd = get_share_security(ctx, lp_servicename(talloc_tos(), snum), &sd_size);
 	if (sd) {
 		sd_buf = make_sec_desc_buf(p->mem_ctx, sd_size, sd);
 	}
@@ -532,7 +532,7 @@ static void init_srv_share_info_1501(struct pipes_struct *p,
 
 static bool is_hidden_share(int snum)
 {
-	const char *net_name = lp_servicename(snum);
+	const char *net_name = lp_servicename(talloc_tos(), snum);
 
 	return (net_name[strlen(net_name) - 1] == '$') ? True : False;
 }
@@ -547,7 +547,8 @@ static bool is_enumeration_allowed(struct pipes_struct *p,
         return true;
 
     return share_access_check(p->session_info->security_token,
-			      lp_servicename(snum), FILE_READ_DATA, NULL);
+			      lp_servicename(talloc_tos(), snum),
+			      FILE_READ_DATA, NULL);
 }
 
 /*******************************************************************
@@ -589,12 +590,12 @@ static WERROR init_srv_share_info_ctr(struct pipes_struct *p,
                     is_enumeration_allowed(p, snum) &&
                     (all_shares || !is_hidden_share(snum)) ) {
                         DEBUG(10, ("counting service %s\n",
-				lp_servicename(snum) ? lp_servicename(snum) : "(null)"));
+				lp_servicename(talloc_tos(), snum) ? lp_servicename(talloc_tos(), snum) : "(null)"));
                         allowed[snum] = true;
                         num_entries++;
                 } else {
                         DEBUG(10, ("NOT counting service %s\n",
-				lp_servicename(snum) ? lp_servicename(snum) : "(null)"));
+				lp_servicename(talloc_tos(), snum) ? lp_servicename(talloc_tos(), snum) : "(null)"));
                 }
         }
 
@@ -1155,7 +1156,7 @@ WERROR _srvsvc_NetSrvGetInfo(struct pipes_struct *p,
 		info102->version_major	= SAMBA_MAJOR_NBT_ANNOUNCE_VERSION;
 		info102->version_minor	= SAMBA_MINOR_NBT_ANNOUNCE_VERSION;
 		info102->server_type	= lp_default_server_announce();
-		info102->comment	= string_truncate(lp_serverstring(),
+		info102->comment	= string_truncate(lp_serverstring(talloc_tos()),
 						MAX_SERVER_STRING_LENGTH);
 		info102->users		= 0xffffffff;
 		info102->disc		= 0xf;
@@ -1181,7 +1182,7 @@ WERROR _srvsvc_NetSrvGetInfo(struct pipes_struct *p,
 		info101->version_major	= SAMBA_MAJOR_NBT_ANNOUNCE_VERSION;
 		info101->version_minor	= SAMBA_MINOR_NBT_ANNOUNCE_VERSION;
 		info101->server_type	= lp_default_server_announce();
-		info101->comment	= string_truncate(lp_serverstring(),
+		info101->comment	= string_truncate(lp_serverstring(talloc_tos()),
 						MAX_SERVER_STRING_LENGTH);
 
 		r->out.info->info101 = info101;
@@ -1588,7 +1589,7 @@ WERROR _srvsvc_NetShareSetInfo(struct pipes_struct *p,
 
 	switch (r->in.level) {
 	case 1:
-		pathname = talloc_strdup(ctx, lp_pathname(snum));
+		pathname = lp_pathname(ctx, snum);
 		comment = talloc_strdup(ctx, info->info1->comment);
 		type = info->info1->type;
 		psd = NULL;
@@ -1617,7 +1618,7 @@ WERROR _srvsvc_NetShareSetInfo(struct pipes_struct *p,
 		map_generic_share_sd_bits(psd);
 		break;
 	case 1004:
-		pathname = talloc_strdup(ctx, lp_pathname(snum));
+		pathname = lp_pathname(ctx, snum);
 		comment = talloc_strdup(ctx, info->info1004->comment);
 		type = STYPE_DISKTREE;
 		break;
@@ -1638,8 +1639,8 @@ WERROR _srvsvc_NetShareSetInfo(struct pipes_struct *p,
 	case 1007:
 		return WERR_ACCESS_DENIED;
 	case 1501:
-		pathname = talloc_strdup(ctx, lp_pathname(snum));
-		comment = talloc_strdup(ctx, lp_comment(snum));
+		pathname = lp_pathname(ctx, snum);
+		comment = lp_comment(ctx, snum);
 		psd = info->info1501->sd;
 		map_generic_share_sd_bits(psd);
 		type = STYPE_DISKTREE;
@@ -1675,20 +1676,20 @@ WERROR _srvsvc_NetShareSetInfo(struct pipes_struct *p,
 	string_replace(comment, '"', ' ');
 
 	DEBUG(10,("_srvsvc_NetShareSetInfo: change share command = %s\n",
-		lp_change_share_cmd() ? lp_change_share_cmd() : "NULL" ));
+		lp_change_share_cmd(talloc_tos()) ? lp_change_share_cmd(talloc_tos()) : "NULL" ));
 
 	/* Only call modify function if something changed. */
 
-	if (strcmp(path, lp_pathname(snum)) || strcmp(comment, lp_comment(snum))
+	if (strcmp(path, lp_pathname(talloc_tos(), snum)) || strcmp(comment, lp_comment(talloc_tos(), snum))
 			|| (lp_max_connections(snum) != max_connections)) {
-		if (!lp_change_share_cmd() || !*lp_change_share_cmd()) {
+		if (!lp_change_share_cmd(talloc_tos()) || !*lp_change_share_cmd(talloc_tos())) {
 			DEBUG(10,("_srvsvc_NetShareSetInfo: No change share command\n"));
 			return WERR_ACCESS_DENIED;
 		}
 
 		command = talloc_asprintf(p->mem_ctx,
 				"%s \"%s\" \"%s\" \"%s\" \"%s\" %d",
-				lp_change_share_cmd(),
+				lp_change_share_cmd(talloc_tos()),
 				get_dyn_CONFIGFILE(),
 				share_name,
 				path,
@@ -1733,7 +1734,7 @@ WERROR _srvsvc_NetShareSetInfo(struct pipes_struct *p,
 		struct security_descriptor *old_sd;
 		size_t sd_size;
 
-		old_sd = get_share_security(p->mem_ctx, lp_servicename(snum), &sd_size);
+		old_sd = get_share_security(p->mem_ctx, lp_servicename(talloc_tos(), snum), &sd_size);
 
 		if (old_sd && !security_descriptor_equal(old_sd, psd)) {
 			if (!set_share_security(share_name, psd))
@@ -1781,7 +1782,7 @@ WERROR _srvsvc_NetShareAdd(struct pipes_struct *p,
 	if (p->session_info->unix_token->uid != sec_initial_uid()  && !is_disk_op )
 		return WERR_ACCESS_DENIED;
 
-	if (!lp_add_share_cmd() || !*lp_add_share_cmd()) {
+	if (!lp_add_share_cmd(talloc_tos()) || !*lp_add_share_cmd(talloc_tos())) {
 		DEBUG(10,("_srvsvc_NetShareAdd: No add share command\n"));
 		return WERR_ACCESS_DENIED;
 	}
@@ -1877,7 +1878,7 @@ WERROR _srvsvc_NetShareAdd(struct pipes_struct *p,
 
 	command = talloc_asprintf(ctx,
 			"%s \"%s\" \"%s\" \"%s\" \"%s\" %d",
-			lp_add_share_cmd(),
+			lp_add_share_cmd(talloc_tos()),
 			get_dyn_CONFIGFILE(),
 			share_name_in,
 			path,
@@ -1987,16 +1988,16 @@ WERROR _srvsvc_NetShareDel(struct pipes_struct *p,
 	if (p->session_info->unix_token->uid != sec_initial_uid()  && !is_disk_op )
 		return WERR_ACCESS_DENIED;
 
-	if (!lp_delete_share_cmd() || !*lp_delete_share_cmd()) {
+	if (!lp_delete_share_cmd(talloc_tos()) || !*lp_delete_share_cmd(talloc_tos())) {
 		DEBUG(10,("_srvsvc_NetShareDel: No delete share command\n"));
 		return WERR_ACCESS_DENIED;
 	}
 
 	command = talloc_asprintf(ctx,
 			"%s \"%s\" \"%s\"",
-			lp_delete_share_cmd(),
+			lp_delete_share_cmd(talloc_tos()),
 			get_dyn_CONFIGFILE(),
-			lp_servicename(snum));
+			lp_servicename(talloc_tos(), snum));
 	if (!command) {
 		return WERR_NOMEM;
 	}
@@ -2025,7 +2026,7 @@ WERROR _srvsvc_NetShareDel(struct pipes_struct *p,
 		return WERR_ACCESS_DENIED;
 
 	/* Delete the SD in the database. */
-	delete_share_security(lp_servicename(params->service));
+	delete_share_security(lp_servicename(talloc_tos(), params->service));
 
 	lp_killservice(params->service);
 
@@ -2138,7 +2139,7 @@ WERROR _srvsvc_NetGetFileSecurity(struct pipes_struct *p,
 				       server_event_context(),
 				       server_messaging_context(),
 				       &conn,
-				       snum, lp_pathname(snum),
+				       snum, lp_pathname(talloc_tos(), snum),
 				       p->session_info, &oldcwd);
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		DEBUG(10, ("create_conn_struct failed: %s\n",
@@ -2282,7 +2283,7 @@ WERROR _srvsvc_NetSetFileSecurity(struct pipes_struct *p,
 				       server_event_context(),
 				       server_messaging_context(),
 				       &conn,
-				       snum, lp_pathname(snum),
+				       snum, lp_pathname(talloc_tos(), snum),
 				       p->session_info, &oldcwd);
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		DEBUG(10, ("create_conn_struct failed: %s\n",
diff --git a/source3/rpc_server/winreg/srv_winreg_nt.c b/source3/rpc_server/winreg/srv_winreg_nt.c
index 176848b0d6..38040d4e51 100644
--- a/source3/rpc_server/winreg/srv_winreg_nt.c
+++ b/source3/rpc_server/winreg/srv_winreg_nt.c
@@ -528,7 +528,7 @@ WERROR _winreg_InitiateSystemShutdownEx(struct pipes_struct *p,
 	int ret = -1;
 	bool can_shutdown = false;
 
-	shutdown_script = talloc_strdup(p->mem_ctx, lp_shutdown_script());
+	shutdown_script = lp_shutdown_script(p->mem_ctx);
 	if (!shutdown_script) {
 		return WERR_NOMEM;
 	}
@@ -610,7 +610,7 @@ WERROR _winreg_InitiateSystemShutdownEx(struct pipes_struct *p,
 WERROR _winreg_AbortSystemShutdown(struct pipes_struct *p,
 				   struct winreg_AbortSystemShutdown *r)
 {
-	const char *abort_shutdown_script = lp_abort_shutdown_script();
+	const char *abort_shutdown_script = lp_abort_shutdown_script(talloc_tos());
 	int ret = -1;
 	bool can_shutdown = false;
 
@@ -661,7 +661,7 @@ static int validate_reg_filename(TALLOC_CTX *ctx, char **pp_fname )
 			continue;
 		}
 
-		share_path = lp_pathname(snum);
+		share_path = lp_pathname(talloc_tos(), snum);
 
 		/* make sure we have a path (e.g. [homes] ) */
 		if (strlen(share_path) == 0) {
@@ -712,7 +712,7 @@ WERROR _winreg_RestoreKey(struct pipes_struct *p,
 	}
 
 	DEBUG(2,("_winreg_RestoreKey: Restoring [%s] from %s in share %s\n",
-		 regkey->key->name, fname, lp_servicename(snum) ));
+		 regkey->key->name, fname, lp_servicename(talloc_tos(), snum) ));
 
 	return reg_restorekey(regkey, fname);
 }
@@ -746,7 +746,7 @@ WERROR _winreg_SaveKey(struct pipes_struct *p,
 		return WERR_OBJECT_PATH_INVALID;
 
 	DEBUG(2,("_winreg_SaveKey: Saving [%s] to %s in share %s\n",
-		 regkey->key->name, fname, lp_servicename(snum) ));
+		 regkey->key->name, fname, lp_servicename(talloc_tos(), snum) ));
 
 	return reg_savekey(regkey, fname);
 }
diff --git a/source3/smbd/close.c b/source3/smbd/close.c
index a3eedbfa6b..8633f82c0a 100644
--- a/source3/smbd/close.c
+++ b/source3/smbd/close.c
@@ -46,7 +46,7 @@ static NTSTATUS check_magic(struct files_struct *fsp)
 	char *fname = NULL;
 	NTSTATUS status;
 
-	if (!*lp_magicscript(SNUM(conn))) {
+	if (!*lp_magicscript(talloc_tos(), SNUM(conn))) {
 		return NT_STATUS_OK;
 	}
 
@@ -62,13 +62,13 @@ static NTSTATUS check_magic(struct files_struct *fsp)
 		p++;
 	}
 
-	if (!strequal(lp_magicscript(SNUM(conn)),p)) {
+	if (!strequal(lp_magicscript(talloc_tos(), SNUM(conn)),p)) {
 		status = NT_STATUS_OK;
 		goto out;
 	}
 
-	if (*lp_magicoutput(SNUM(conn))) {
-		magic_output = lp_magicoutput(SNUM(conn));
+	if (*lp_magicoutput(talloc_tos(), SNUM(conn))) {
+		magic_output = lp_magicoutput(talloc_tos(), SNUM(conn));
 	} else {
 		magic_output = talloc_asprintf(ctx,
 				"%s.out",
@@ -906,7 +906,7 @@ static NTSTATUS rmdir_internals(TALLOC_CTX *ctx, files_struct *fsp)
 		return NT_STATUS_OK;
 	}
 
-	if(((errno == ENOTEMPTY)||(errno == EEXIST)) && *lp_veto_files(SNUM(conn))) {
+	if(((errno == ENOTEMPTY)||(errno == EEXIST)) && *lp_veto_files(talloc_tos(), SNUM(conn))) {
 		/*
 		 * Check to see if the only thing in this directory are
 		 * vetoed files/directories. If so then delete them and
diff --git a/source3/smbd/conn_idle.c b/source3/smbd/conn_idle.c
index 60263667c1..916a2067ad 100644
--- a/source3/smbd/conn_idle.c
+++ b/source3/smbd/conn_idle.c
@@ -112,7 +112,8 @@ void conn_force_tdis(struct smbd_server_connection *sconn, const char *sharename
 
 		if (close_all) {
 			do_close = true;
-		} else if (strequal(lp_servicename(SNUM(conn)), sharename)) {
+		} else if (strequal(lp_servicename(talloc_tos(), SNUM(conn)),
+				    sharename)) {
 			DEBUG(1, ("conn_force_tdis: Forcing close of "
 				  "share '%s' (wire_id=0x%08x)\n",
 				  tcon->global->share_name,
diff --git a/source3/smbd/connection.c b/source3/smbd/connection.c
index 846a173ad7..d334e8bdc1 100644
--- a/source3/smbd/connection.c
+++ b/source3/smbd/connection.c
@@ -136,7 +136,8 @@ bool connections_snum_used(struct smbd_server_connection *unused, int snum)
 {
 	int active;
 
-	active = count_current_connections(lp_servicename(snum), true);
+	active = count_current_connections(lp_servicename(talloc_tos(), snum),
+					   true);
 	if (active > 0) {
 		return true;
 	}
@@ -173,12 +174,12 @@ bool claim_connection(connection_struct *conn, const char *name)
 	crec.cnum = conn->cnum;
 	crec.uid = conn->session_info->unix_token->uid;
 	crec.gid = conn->session_info->unix_token->gid;
-	strlcpy(crec.servicename, lp_servicename(SNUM(conn)),
+	strlcpy(crec.servicename, lp_servicename(rec, SNUM(conn)),
 		sizeof(crec.servicename));
 	crec.start = time(NULL);
 
 	raddr = tsocket_address_inet_addr_string(conn->sconn->remote_address,
-						 talloc_tos());
+						 rec);
 	if (raddr == NULL) {
 		return false;
 	}
diff --git a/source3/smbd/dfree.c b/source3/smbd/dfree.c
index 1a73132ae5..cb80e18d4a 100644
--- a/source3/smbd/dfree.c
+++ b/source3/smbd/dfree.c
@@ -80,7 +80,7 @@ uint64_t sys_disk_free(connection_struct *conn, const char *path, bool small_que
 	 * If external disk calculation specified, use it.
 	 */
 
-	dfree_command = lp_dfree_command(SNUM(conn));
+	dfree_command = lp_dfree_command(talloc_tos(), SNUM(conn));
 	if (dfree_command && *dfree_command) {
 		const char *p;
 		char **lines = NULL;
diff --git a/source3/smbd/dosmode.c b/source3/smbd/dosmode.c
index 747ba2169a..836ffd0de5 100644
--- a/source3/smbd/dosmode.c
+++ b/source3/smbd/dosmode.c
@@ -889,7 +889,7 @@ NTSTATUS file_set_sparse(connection_struct *conn,
 			"on readonly share[%s]\n",
 			smb_fname_str_dbg(fsp->fsp_name),
 			sparse,
-			lp_servicename(SNUM(conn))));
+			lp_servicename(talloc_tos(), SNUM(conn))));
 		return NT_STATUS_MEDIA_WRITE_PROTECTED;
 	}
 
diff --git a/source3/smbd/fake_file.c b/source3/smbd/fake_file.c
index ffc8d78020..d052d4965d 100644
--- a/source3/smbd/fake_file.c
+++ b/source3/smbd/fake_file.c
@@ -134,7 +134,7 @@ NTSTATUS open_fake_file(struct smb_request *req, connection_struct *conn,
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(10, ("open_fake_file: smbd_calculate_access_mask "
 			"on service[%s] file[%s] returned %s\n",
-			lp_servicename(SNUM(conn)),
+			lp_servicename(talloc_tos(), SNUM(conn)),
 			smb_fname_str_dbg(smb_fname),
 			nt_errstr(status)));
 		return status;
@@ -144,7 +144,7 @@ NTSTATUS open_fake_file(struct smb_request *req, connection_struct *conn,
 	if (geteuid() != sec_initial_uid()) {
 		DEBUG(3, ("open_fake_file_shared: access_denied to "
 			  "service[%s] file[%s] user[%s]\n",
-			  lp_servicename(SNUM(conn)),
+			  lp_servicename(talloc_tos(), SNUM(conn)),
 			  smb_fname_str_dbg(smb_fname),
 			  conn->session_info->unix_info->unix_name));
 		return NT_STATUS_ACCESS_DENIED;
diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c
index 5809abdf5f..1b5de57ad4 100644
--- a/source3/smbd/lanman.c
+++ b/source3/smbd/lanman.c
@@ -110,13 +110,13 @@ static int CopyExpanded(connection_struct *conn,
 		*p_space_remaining = 0;
 		return 0;
 	}
-	buf = talloc_string_sub(ctx, buf,"%S",lp_servicename(snum));
+	buf = talloc_string_sub(ctx, buf,"%S", lp_servicename(ctx, snum));
 	if (!buf) {
 		*p_space_remaining = 0;
 		return 0;
 	}
 	buf = talloc_sub_advanced(ctx,
-				lp_servicename(SNUM(conn)),
+				  lp_servicename(ctx, SNUM(conn)),
 				conn->session_info->unix_info->unix_name,
 				conn->connectpath,
 				conn->session_info->unix_token->gid,
@@ -162,12 +162,12 @@ static int StrlenExpanded(connection_struct *conn, int snum, char *s)
 	if (!buf) {
 		return 0;
 	}
-	buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(snum));
+	buf = talloc_string_sub(ctx,buf,"%S",lp_servicename(ctx, snum));
 	if (!buf) {
 		return 0;
 	}
 	buf = talloc_sub_advanced(ctx,
-				lp_servicename(SNUM(conn)),
+				  lp_servicename(ctx, SNUM(conn)),
 				conn->session_info->unix_info->unix_name,
 				conn->connectpath,
 				conn->session_info->unix_token->gid,
@@ -1906,10 +1906,10 @@ static int fill_share_info(connection_struct *conn, int snum, int uLevel,
 		len = 0;
 
 		if (uLevel > 0) {
-			len += StrlenExpanded(conn,snum,lp_comment(snum));
+			len += StrlenExpanded(conn,snum,lp_comment(talloc_tos(), snum));
 		}
 		if (uLevel > 1) {
-			len += strlen(lp_pathname(snum)) + 1;
+			len += strlen(lp_pathname(talloc_tos(), snum)) + 1;
 		}
 		if (buflen) {
 			*buflen = struct_len;
@@ -1938,7 +1938,7 @@ static int fill_share_info(connection_struct *conn, int snum, int uLevel,
 		baseaddr = p;
 	}
 
-	push_ascii(p,lp_servicename(snum),13, STR_TERMINATE);
+	push_ascii(p,lp_servicename(talloc_tos(), snum),13, STR_TERMINATE);
 
 	if (uLevel > 0) {
 		int type;
@@ -1948,12 +1948,12 @@ static int fill_share_info(connection_struct *conn, int snum, int uLevel,
 		if (lp_print_ok(snum)) {
 			type = STYPE_PRINTQ;
 		}
-		if (strequal("IPC",lp_fstype(snum))) {
+		if (strequal("IPC",lp_fstype(talloc_tos(),snum))) {
 			type = STYPE_IPC;
 		}
 		SSVAL(p,14,type);		/* device type */
 		SIVAL(p,16,PTR_DIFF(p2,baseaddr));
-		len += CopyExpanded(conn,snum,&p2,lp_comment(snum),&l2);
+		len += CopyExpanded(conn,snum,&p2,lp_comment(talloc_tos(),snum),&l2);
 	}
 
 	if (uLevel > 1) {
@@ -1961,7 +1961,7 @@ static int fill_share_info(connection_struct *conn, int snum, int uLevel,
 		SSVALS(p,22,-1);		/* max uses */
 		SSVAL(p,24,1); /* current uses */
 		SIVAL(p,26,PTR_DIFF(p2,baseaddr)); /* local pathname */
-		len += CopyAndAdvance(&p2,lp_pathname(snum),&l2);
+		len += CopyAndAdvance(&p2,lp_pathname(talloc_tos(),snum),&l2);
 		memset(p+30,0,SHPWLEN+2); /* passwd (reserved), pad field */
 	}
 
@@ -2101,7 +2101,7 @@ static bool api_RNetShareEnum(struct smbd_server_connection *sconn,
 		if (!(lp_browseable(i) && lp_snum_ok(i))) {
 			continue;
 		}
-		push_ascii_fstring(servicename_dos, lp_servicename(i));
+		push_ascii_fstring(servicename_dos, lp_servicename(talloc_tos(), i));
 		/* Maximum name length = 13. */
 		if( lp_browseable( i ) && lp_snum_ok( i ) && (strlen(servicename_dos) < 13)) {
 			total++;
@@ -2133,7 +2133,8 @@ static bool api_RNetShareEnum(struct smbd_server_connection *sconn,
 			continue;
 		}
 
-		push_ascii_fstring(servicename_dos, lp_servicename(i));
+		push_ascii_fstring(servicename_dos,
+				   lp_servicename(talloc_tos(), i));
 		if (lp_browseable(i) && lp_snum_ok(i) && (strlen(servicename_dos) < 13)) {
 			if (fill_share_info( conn,i,uLevel,&p,&f_len,&p2,&s_len,*rdata ) < 0) {
 				break;
diff --git a/source3/smbd/mangle.c b/source3/smbd/mangle.c
index 49599c1ee1..55da33a258 100644
--- a/source3/smbd/mangle.c
+++ b/source3/smbd/mangle.c
@@ -45,7 +45,7 @@ static void mangle_init(void)
 	if (mangle_fns)
 		return;
 
-	method = lp_mangling_method();
+	method = lp_mangling_method(talloc_tos());
 
 	/* find the first mangling method that manages to initialise and
 	   matches the "mangling method" parameter */
diff --git a/source3/smbd/message.c b/source3/smbd/message.c
index 8ae588b511..59949e21ae 100644
--- a/source3/smbd/message.c
+++ b/source3/smbd/message.c
@@ -51,7 +51,7 @@ static void msg_deliver(struct msg_state *state)
 	fstring alpha_buf;
 	char *s;
 
-	if (! (*lp_msg_command())) {
+	if (! (*lp_msg_command(frame))) {
 		DEBUG(1,("no messaging command specified\n"));
 		goto done;
 	}
@@ -96,7 +96,7 @@ static void msg_deliver(struct msg_state *state)
 	close(fd);
 
 	/* run the command */
-	s = talloc_strdup(talloc_tos(), lp_msg_command());
+	s = lp_msg_command(frame);
 	if (s == NULL) {
 		goto done;
 	}
@@ -146,7 +146,7 @@ void reply_sends(struct smb_request *req)
 
 	START_PROFILE(SMBsends);
 
-	if (!(*lp_msg_command())) {
+	if (!(*lp_msg_command(talloc_tos()))) {
 		reply_nterror(req, NT_STATUS_REQUEST_NOT_ACCEPTED);
 		END_PROFILE(SMBsends);
 		return;
@@ -194,7 +194,7 @@ void reply_sendstrt(struct smb_request *req)
 
 	START_PROFILE(SMBsendstrt);
 
-	if (!(*lp_msg_command())) {
+	if (!(*lp_msg_command(talloc_tos()))) {
 		reply_nterror(req, NT_STATUS_REQUEST_NOT_ACCEPTED);
 		END_PROFILE(SMBsendstrt);
 		return;
@@ -244,7 +244,7 @@ void reply_sendtxt(struct smb_request *req)
 
 	START_PROFILE(SMBsendtxt);
 
-	if (! (*lp_msg_command())) {
+	if (! (*lp_msg_command(talloc_tos()))) {
 		reply_nterror(req, NT_STATUS_REQUEST_NOT_ACCEPTED);
 		END_PROFILE(SMBsendtxt);
 		return;
@@ -293,7 +293,7 @@ void reply_sendend(struct smb_request *req)
 {
 	START_PROFILE(SMBsendend);
 
-	if (! (*lp_msg_command())) {
+	if (! (*lp_msg_command(talloc_tos()))) {
 		reply_nterror(req, NT_STATUS_REQUEST_NOT_ACCEPTED);
 		END_PROFILE(SMBsendend);
 		return;
diff --git a/source3/smbd/msdfs.c b/source3/smbd/msdfs.c
index 6f182b4920..97775d6a9d 100644
--- a/source3/smbd/msdfs.c
+++ b/source3/smbd/msdfs.c
@@ -147,9 +147,9 @@ static NTSTATUS parse_dfs_path(connection_struct *conn,
 	}
 
 	/* Is this really our servicename ? */
-	if (conn && !( strequal(servicename, lp_servicename(SNUM(conn)))
+	if (conn && !( strequal(servicename, lp_servicename(talloc_tos(), SNUM(conn)))
 			|| (strequal(servicename, HOMES_NAME)
-			&& strequal(lp_servicename(SNUM(conn)),
+			&& strequal(lp_servicename(talloc_tos(), SNUM(conn)),
 				get_current_username()) )) ) {
 		DEBUG(10,("parse_dfs_path: %s is not our servicename\n",
 			servicename));
@@ -249,7 +249,7 @@ NTSTATUS create_conn_struct(TALLOC_CTX *ctx,
 	connpath = talloc_string_sub(conn,
 				connpath,
 				"%S",
-				lp_servicename(snum));
+				lp_servicename(talloc_tos(), snum));
 	if (!connpath) {
 		TALLOC_FREE(conn);
 		return NT_STATUS_NO_MEMORY;
@@ -304,7 +304,8 @@ NTSTATUS create_conn_struct(TALLOC_CTX *ctx,
 	 */
 	if (conn->session_info) {
 		share_access_check(conn->session_info->security_token,
-				   lp_servicename(snum), MAXIMUM_ALLOWED_ACCESS,
+				   lp_servicename(talloc_tos(), snum),
+				   MAXIMUM_ALLOWED_ACCESS,
 				   &conn->share_access);
 
 		if ((conn->share_access & FILE_WRITE_DATA) == 0) {
@@ -313,7 +314,7 @@ NTSTATUS create_conn_struct(TALLOC_CTX *ctx,
 				DEBUG(0,("create_conn_struct: connection to %s "
 					 "denied due to security "
 					 "descriptor.\n",
-					 lp_servicename(snum)));
+					 lp_servicename(talloc_tos(), snum)));
 				conn_free(conn);
 				return NT_STATUS_ACCESS_DENIED;
 			} else {
@@ -333,7 +334,7 @@ NTSTATUS create_conn_struct(TALLOC_CTX *ctx,
 	}
 
 	/* this must be the first filesystem operation that we do */
-	if (SMB_VFS_CONNECT(conn, lp_servicename(snum), vfs_user) < 0) {
+	if (SMB_VFS_CONNECT(conn, lp_servicename(talloc_tos(), snum), vfs_user) < 0) {
 		DEBUG(0,("VFS connect failed!\n"));
 		conn_free(conn);
 		return NT_STATUS_UNSUCCESSFUL;
@@ -779,9 +780,9 @@ static NTSTATUS dfs_redirect(TALLOC_CTX *ctx,
 		return NT_STATUS_OK;
 	}
 
-	if (!( strequal(pdp->servicename, lp_servicename(SNUM(conn)))
+	if (!( strequal(pdp->servicename, lp_servicename(talloc_tos(), SNUM(conn)))
 			|| (strequal(pdp->servicename, HOMES_NAME)
-			&& strequal(lp_servicename(SNUM(conn)),
+			&& strequal(lp_servicename(talloc_tos(), SNUM(conn)),
 				conn->session_info->unix_info->sanitized_username) )) ) {
 
 		/* The given sharename doesn't match this connection. */
@@ -906,7 +907,7 @@ NTSTATUS get_referred_path(TALLOC_CTX *ctx,
 		}
 	}
 
-	if (!lp_msdfs_root(snum) && (*lp_msdfs_proxy(snum) == '\0')) {
+	if (!lp_msdfs_root(snum) && (*lp_msdfs_proxy(talloc_tos(), snum) == '\0')) {
 		DEBUG(3,("get_referred_path: |%s| in dfs path %s is not "
 			"a dfs root.\n",
 			pdp->servicename, dfs_path));
@@ -926,7 +927,7 @@ NTSTATUS get_referred_path(TALLOC_CTX *ctx,
 		char *tmp;
 		struct referral *ref;
 
-		if (*lp_msdfs_proxy(snum) == '\0') {
+		if (*lp_msdfs_proxy(talloc_tos(), snum) == '\0') {
 			TALLOC_FREE(pdp);
 			return self_ref(ctx,
 					dfs_path,
@@ -946,7 +947,7 @@ NTSTATUS get_referred_path(TALLOC_CTX *ctx,
 			return NT_STATUS_NO_MEMORY;
 		}
 
-		if (!(tmp = talloc_strdup(ctx, lp_msdfs_proxy(snum)))) {
+		if (!(tmp = talloc_strdup(ctx, lp_msdfs_proxy(talloc_tos(), snum)))) {
 			TALLOC_FREE(pdp);
 			return NT_STATUS_NO_MEMORY;
 		}
@@ -983,7 +984,7 @@ NTSTATUS get_referred_path(TALLOC_CTX *ctx,
 				    server_event_context(),
 				    server_messaging_context(),
 				    &conn, snum,
-				    lp_pathname(snum), NULL, &oldpath);
+				    lp_pathname(talloc_tos(), snum), NULL, &oldpath);
 	if (!NT_STATUS_IS_OK(status)) {
 		TALLOC_FREE(pdp);
 		return status;
@@ -1133,7 +1134,7 @@ bool create_junction(TALLOC_CTX *ctx,
 
 	jucn->service_name = talloc_strdup(ctx, pdp->servicename);
 	jucn->volume_name = talloc_strdup(ctx, pdp->reqpath);
-	jucn->comment = talloc_strdup(ctx, lp_comment(snum));
+	jucn->comment = lp_comment(ctx, snum);
 
 	TALLOC_FREE(pdp);
 	if (!jucn->service_name || !jucn->volume_name || ! jucn->comment) {
@@ -1162,14 +1163,14 @@ static bool junction_to_local_path(const struct junction_map *jucn,
 				    server_event_context(),
 				    server_messaging_context(),
 				    conn_out,
-				    snum, lp_pathname(snum), NULL, oldpath);
+				    snum, lp_pathname(talloc_tos(), snum), NULL, oldpath);
 	if (!NT_STATUS_IS_OK(status)) {
 		return False;
 	}
 
 	*pp_path_out = talloc_asprintf(*conn_out,
 			"%s/%s",
-			lp_pathname(snum),
+			lp_pathname(talloc_tos(), snum),
 			jucn->volume_name);
 	if (!*pp_path_out) {
 		vfs_ChDir(*conn_out, *oldpath);
@@ -1309,8 +1310,8 @@ static int count_dfs_links(TALLOC_CTX *ctx, int snum)
 	DIR *dirp = NULL;
 	const char *dname = NULL;
 	char *talloced = NULL;
-	const char *connect_path = lp_pathname(snum);
-	const char *msdfs_proxy = lp_msdfs_proxy(snum);
+	const char *connect_path = lp_pathname(talloc_tos(), snum);
+	const char *msdfs_proxy = lp_msdfs_proxy(talloc_tos(), snum);
 	connection_struct *conn;
 	NTSTATUS status;
 	char *cwd;
@@ -1379,9 +1380,9 @@ static int form_junctions(TALLOC_CTX *ctx,
 	DIR *dirp = NULL;
 	const char *dname = NULL;
 	char *talloced = NULL;
-	const char *connect_path = lp_pathname(snum);
-	char *service_name = lp_servicename(snum);
-	const char *msdfs_proxy = lp_msdfs_proxy(snum);
+	const char *connect_path = lp_pathname(talloc_tos(), snum);
+	char *service_name = lp_servicename(talloc_tos(), snum);
+	const char *msdfs_proxy = lp_msdfs_proxy(talloc_tos(), snum);
 	connection_struct *conn;
 	struct referral *ref = NULL;
 	char *cwd;
diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index 0cac3a14ec..a0a3f59e08 100644
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -2225,7 +2225,7 @@ static void call_nt_transact_get_user_quota(connection_struct *conn,
 	/* access check */
 	if (get_current_uid(conn) != 0) {
 		DEBUG(1,("get_user_quota: access_denied service [%s] user "
-			 "[%s]\n", lp_servicename(SNUM(conn)),
+			 "[%s]\n", lp_servicename(talloc_tos(), SNUM(conn)),
 			 conn->session_info->unix_info->unix_name));
 		reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 		return;
@@ -2497,7 +2497,7 @@ static void call_nt_transact_set_user_quota(connection_struct *conn,
 	/* access check */
 	if (get_current_uid(conn) != 0) {
 		DEBUG(1,("set_user_quota: access_denied service [%s] user "
-			 "[%s]\n", lp_servicename(SNUM(conn)),
+			 "[%s]\n", lp_servicename(talloc_tos(), SNUM(conn)),
 			 conn->session_info->unix_info->unix_name));
 		reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 		return;
diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index a445524f16..15f588885e 100644
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -2742,7 +2742,7 @@ static NTSTATUS mkdir_internal(connection_struct *conn,
 
 	if(access_mask & ~(conn->share_access)) {
 		DEBUG(5,("mkdir_internal: failing share access "
-			 "%s\n", lp_servicename(SNUM(conn))));
+			 "%s\n", lp_servicename(talloc_tos(), SNUM(conn))));
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
diff --git a/source3/smbd/password.c b/source3/smbd/password.c
index c87f15805e..60ab045283 100644
--- a/source3/smbd/password.c
+++ b/source3/smbd/password.c
@@ -127,7 +127,7 @@ int register_homes_share(const char *username)
 	if (result != -1) {
 		DEBUG(3, ("Using static (or previously created) service for "
 			  "user '%s'; path = '%s'\n", username,
-			  lp_pathname(result)));
+			  lp_pathname(talloc_tos(), result)));
 		return result;
 	}
 
diff --git a/source3/smbd/perfcount.c b/source3/smbd/perfcount.c
index 1561893758..a7c268a2fe 100644
--- a/source3/smbd/perfcount.c
+++ b/source3/smbd/perfcount.c
@@ -176,7 +176,7 @@ bool smb_perfcount_init(void)
 {
 	char *perfcount_object;
 
-	perfcount_object = lp_perfcount_module();
+	perfcount_object = lp_perfcount_module(talloc_tos());
 
 	/* don't init */
 	if (!perfcount_object || !perfcount_object[0])
diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index 80b0c1d79b..adb773d749 100644
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -3456,16 +3456,17 @@ void smbd_process(struct tevent_context *ev_ctx,
 		exit_server("Could not open account policy tdb.\n");
 	}
 
-	if (*lp_rootdir()) {
-		if (chroot(lp_rootdir()) != 0) {
-			DEBUG(0,("Failed to change root to %s\n", lp_rootdir()));
+	if (*lp_rootdir(talloc_tos())) {
+		if (chroot(lp_rootdir(talloc_tos())) != 0) {
+			DEBUG(0,("Failed to change root to %s\n",
+				 lp_rootdir(talloc_tos())));
 			exit_server("Failed to chroot()");
 		}
 		if (chdir("/") == -1) {
-			DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir()));
+			DEBUG(0,("Failed to chdir to / on chroot to %s\n", lp_rootdir(talloc_tos())));
 			exit_server("Failed to chroot()");
 		}
-		DEBUG(0,("Changed root to %s\n", lp_rootdir()));
+		DEBUG(0,("Changed root to %s\n", lp_rootdir(talloc_tos())));
 	}
 
 	if (!srv_init_signing(sconn)) {
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 080be5cc94..03af4ac403 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -838,7 +838,7 @@ void reply_tcon_and_X(struct smb_request *req)
 		}
 	} else {
 		/* NT sets the fstype of IPC$ to the null string */
-		const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
+		const char *fstype = IS_IPC(conn) ? "" : lp_fstype(ctx, SNUM(conn));
 
 		if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 			/* Return permissions. */
@@ -876,7 +876,7 @@ void reply_tcon_and_X(struct smb_request *req)
 
 		if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
 			DEBUG(2,("Serving %s as a Dfs root\n",
-				 lp_servicename(SNUM(conn)) ));
+				 lp_servicename(ctx, SNUM(conn)) ));
 			SSVAL(req->outbuf, smb_vwv2,
 			      SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
 		}
@@ -973,7 +973,9 @@ void reply_ioctl(struct smb_request *req)
 				    STR_TERMINATE|STR_ASCII);
 			if (conn) {
 				srvstr_push((char *)req->outbuf, req->flags2,
-					    p+18, lp_servicename(SNUM(conn)),
+					    p+18,
+					    lp_servicename(talloc_tos(),
+							   SNUM(conn)),
 					    13, STR_TERMINATE|STR_ASCII);
 			} else {
 				memset(p+18, 0, 13);
@@ -1542,7 +1544,7 @@ void reply_search(struct smb_request *req)
 	if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
 		char buf[DIR_STRUCT_SIZE];
 		memcpy(buf,status,21);
-		if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
+		if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
 				0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
 			reply_nterror(req, NT_STATUS_NO_MEMORY);
 			goto out;
@@ -1568,8 +1570,8 @@ void reply_search(struct smb_request *req)
 			 /DIR_STRUCT_SIZE));
 
 		DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
-			directory,lp_dontdescend(SNUM(conn))));
-		if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
+			 directory,lp_dontdescend(ctx, SNUM(conn))));
+		if (in_list(directory, lp_dontdescend(ctx, SNUM(conn)),True)) {
 			check_descend = True;
 		}
 
@@ -5349,7 +5351,7 @@ void reply_printqueue(struct smb_request *req)
 		TALLOC_CTX *mem_ctx = talloc_tos();
 		NTSTATUS status;
 		WERROR werr;
-		const char *sharename = lp_servicename(SNUM(conn));
+		const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
 		struct rpc_pipe_client *cli = NULL;
 		struct dcerpc_binding_handle *b = NULL;
 		struct policy_handle handle;
diff --git a/source3/smbd/server.c b/source3/smbd/server.c
index 94a25109fb..28374fa985 100644
--- a/source3/smbd/server.c
+++ b/source3/smbd/server.c
@@ -1158,7 +1158,7 @@ extern void build_options(bool screen);
 	gain_root_group_privilege();
 
 	fault_setup();
-	dump_core_setup("smbd", lp_logfile());
+	dump_core_setup("smbd", lp_logfile(talloc_tos()));
 
 	/* we are never interested in SIGPIPE */
 	BlockSignals(True,SIGPIPE);
diff --git a/source3/smbd/server_reload.c b/source3/smbd/server_reload.c
index bab622d11f..e5d7102744 100644
--- a/source3/smbd/server_reload.c
+++ b/source3/smbd/server_reload.c
@@ -95,7 +95,7 @@ void delete_and_reload_printers(struct tevent_context *ev,
 		}
 
 		sname = lp_const_servicename(snum);
-		pname = lp_printername(snum);
+		pname = lp_printername(session_info, snum);
 
 		/* check printer, but avoid removing non-autoloaded printers */
 		if (!pcap_printername_ok(pname) && lp_autoloaded(snum)) {
@@ -103,7 +103,9 @@ void delete_and_reload_printers(struct tevent_context *ev,
 
 			if (is_printer_published(session_info, session_info,
 						 msg_ctx,
-						 NULL, lp_servicename(snum),
+						 NULL,
+						 lp_servicename(session_info,
+								snum),
 						 NULL, &pinfo2)) {
 				nt_printer_publish(session_info,
 						   session_info,
@@ -140,7 +142,7 @@ bool reload_services(struct smbd_server_connection *sconn,
 	bool ret;
 
 	if (lp_loaded()) {
-		char *fname = lp_configfile();
+		char *fname = lp_configfile(talloc_tos());
 		if (file_exist(fname) &&
 		    !strcsequal(fname, get_dyn_CONFIGFILE())) {
 			set_dyn_CONFIGFILE(fname);
diff --git a/source3/smbd/service.c b/source3/smbd/service.c
index da5d763ad8..a1d009cb44 100644
--- a/source3/smbd/service.c
+++ b/source3/smbd/service.c
@@ -160,7 +160,7 @@ bool set_conn_connectpath(connection_struct *conn, const char *connectpath)
 	}
 
 	DEBUG(10,("set_conn_connectpath: service %s, connectpath = %s\n",
-		lp_servicename(SNUM(conn)), destname ));
+		lp_servicename(talloc_tos(), SNUM(conn)), destname ));
 
 	string_set(&conn->connectpath, destname);
 	SAFE_FREE(destname);
@@ -250,7 +250,7 @@ static NTSTATUS share_sanity_checks(const struct tsocket_address *remote_address
 	if (dev[0] == '?' || !dev[0]) {
 		if (lp_print_ok(snum)) {
 			fstrcpy(dev,"LPT1:");
-		} else if (strequal(lp_fstype(snum), "IPC")) {
+		} else if (strequal(lp_fstype(talloc_tos(), snum), "IPC")) {
 			fstrcpy(dev, "IPC");
 		} else {
 			fstrcpy(dev,"A:");
@@ -263,7 +263,7 @@ static NTSTATUS share_sanity_checks(const struct tsocket_address *remote_address
 		if (!strequal(dev, "LPT1:")) {
 			return NT_STATUS_BAD_DEVICE_TYPE;
 		}
-	} else if (strequal(lp_fstype(snum), "IPC")) {
+	} else if (strequal(lp_fstype(talloc_tos(), snum), "IPC")) {
 		if (!strequal(dev, "IPC")) {
 			return NT_STATUS_BAD_DEVICE_TYPE;
 		}
@@ -299,7 +299,7 @@ static NTSTATUS find_forced_group(bool force_user,
 	bool user_must_be_member = False;
 	gid_t gid;
 
-	groupname = talloc_strdup(talloc_tos(), lp_force_group(snum));
+	groupname = lp_force_group(talloc_tos(), snum);
 	if (groupname == NULL) {
 		DEBUG(1, ("talloc_strdup failed\n"));
 		result = NT_STATUS_NO_MEMORY;
@@ -312,7 +312,7 @@ static NTSTATUS find_forced_group(bool force_user,
 	}
 
 	groupname = talloc_string_sub(talloc_tos(), groupname,
-				      "%S", lp_servicename(snum));
+				      "%S", lp_servicename(talloc_tos(), snum));
 	if (groupname == NULL) {
 		DEBUG(1, ("talloc_string_sub failed\n"));
 		result = NT_STATUS_NO_MEMORY;
@@ -395,7 +395,7 @@ static NTSTATUS create_connection_session_info(struct smbd_server_connection *sc
 		if (!lp_guest_ok(snum)) {
 			DEBUG(2, ("guest user (from session setup) "
 				  "not permitted to access this share "
-				  "(%s)\n", lp_servicename(snum)));
+				  "(%s)\n", lp_servicename(talloc_tos(), snum)));
 			return NT_STATUS_ACCESS_DENIED;
 		}
 	} else {
@@ -406,7 +406,7 @@ static NTSTATUS create_connection_session_info(struct smbd_server_connection *sc
 				  "permitted to access this share "
 				  "(%s)\n",
 				  session_info->unix_info->unix_name,
-				  lp_servicename(snum)));
+				  lp_servicename(talloc_tos(), snum)));
 			return NT_STATUS_ACCESS_DENIED;
 		}
 	}
@@ -429,7 +429,7 @@ NTSTATUS set_conn_force_user_group(connection_struct *conn, int snum)
 {
 	NTSTATUS status;
 
-	if (*lp_force_user(snum)) {
+	if (*lp_force_user(talloc_tos(), snum)) {
 
 		/*
 		 * Replace conn->session_info with a completely faked up one
@@ -441,7 +441,7 @@ NTSTATUS set_conn_force_user_group(connection_struct *conn, int snum)
 		struct auth_session_info *forced_serverinfo;
 		bool guest;
 
-		fuser = talloc_string_sub(conn, lp_force_user(snum), "%S",
+		fuser = talloc_string_sub(conn, lp_force_user(talloc_tos(), snum), "%S",
 					  lp_const_servicename(snum));
 		if (fuser == NULL) {
 			return NT_STATUS_NO_MEMORY;
@@ -479,7 +479,7 @@ NTSTATUS set_conn_force_user_group(connection_struct *conn, int snum)
 	 * any groupid stored for the connecting user.
 	 */
 
-	if (*lp_force_group(snum)) {
+	if (*lp_force_group(talloc_tos(), snum)) {
 
 		status = find_forced_group(
 			conn->force_user, snum, conn->session_info->unix_info->unix_name,
@@ -511,7 +511,7 @@ static void create_share_access_mask(connection_struct *conn, int snum)
 	const struct security_token *token = conn->session_info->security_token;
 
 	share_access_check(token,
-			lp_servicename(snum),
+			lp_servicename(talloc_tos(), snum),
 			MAXIMUM_ALLOWED_ACCESS,
 			&conn->share_access);
 
@@ -610,13 +610,13 @@ static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 
 	{
 		char *s = talloc_sub_advanced(talloc_tos(),
-					lp_servicename(SNUM(conn)),
+					lp_servicename(talloc_tos(), SNUM(conn)),
 					conn->session_info->unix_info->unix_name,
 					conn->connectpath,
 					conn->session_info->unix_token->gid,
 					conn->session_info->unix_info->sanitized_username,
 					conn->session_info->info->domain_name,
-					lp_pathname(snum));
+					lp_pathname(talloc_tos(), snum));
 		if (!s) {
 			status = NT_STATUS_NO_MEMORY;
 			goto err_root_exit;
@@ -628,7 +628,7 @@ static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 			goto err_root_exit;
 		}
 		DEBUG(3,("Connect path is '%s' for service [%s]\n",s,
-			 lp_servicename(snum)));
+			 lp_servicename(talloc_tos(), snum)));
 		TALLOC_FREE(s);
 	}
 
@@ -647,7 +647,7 @@ static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 			DEBUG(0,("make_connection: connection to %s "
 				 "denied due to security "
 				 "descriptor.\n",
-				 lp_servicename(snum)));
+				 lp_servicename(talloc_tos(), snum)));
 			status = NT_STATUS_ACCESS_DENIED;
 			goto err_root_exit;
 		} else {
@@ -658,7 +658,7 @@ static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 
 	if (!smbd_vfs_init(conn)) {
 		DEBUG(0, ("vfs_init failed for service %s\n",
-			  lp_servicename(snum)));
+			  lp_servicename(talloc_tos(), snum)));
 		status = NT_STATUS_BAD_NETWORK_NAME;
 		goto err_root_exit;
 	}
@@ -673,11 +673,12 @@ static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 	 */
 
 	if ((lp_max_connections(snum) > 0)
-	    && (count_current_connections(lp_servicename(SNUM(conn)), True) >=
+	    && (count_current_connections(lp_servicename(talloc_tos(), SNUM(conn)), True) >=
 		lp_max_connections(snum))) {
 
 		DEBUG(1, ("Max connections (%d) exceeded for %s\n",
-			  lp_max_connections(snum), lp_servicename(snum)));
+			  lp_max_connections(snum),
+			  lp_servicename(talloc_tos(), snum)));
 		status = NT_STATUS_INSUFFICIENT_RESOURCES;
 		goto err_root_exit;
 	}
@@ -685,7 +686,7 @@ static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 	/*
 	 * Get us an entry in the connections db
 	 */
-	if (!claim_connection(conn, lp_servicename(snum))) {
+	if (!claim_connection(conn, lp_servicename(talloc_tos(), snum))) {
 		DEBUG(1, ("Could not store connections entry\n"));
 		status = NT_STATUS_INTERNAL_DB_ERROR;
 		goto err_root_exit;
@@ -695,7 +696,7 @@ static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 	/* Invoke VFS make connection hook - this must be the first
 	   filesystem operation that we do. */
 
-	if (SMB_VFS_CONNECT(conn, lp_servicename(snum),
+	if (SMB_VFS_CONNECT(conn, lp_servicename(talloc_tos(), snum),
 			    conn->session_info->unix_info->unix_name) < 0) {
 		DEBUG(0,("make_connection: VFS make connection failed!\n"));
 		status = NT_STATUS_UNSUCCESSFUL;
@@ -736,15 +737,15 @@ static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 	/* Preexecs are done here as they might make the dir we are to ChDir
 	 * to below */
 	/* execute any "root preexec = " line */
-	if (*lp_rootpreexec(snum)) {
+	if (*lp_rootpreexec(talloc_tos(), snum)) {
 		char *cmd = talloc_sub_advanced(talloc_tos(),
-					lp_servicename(SNUM(conn)),
+					lp_servicename(talloc_tos(), SNUM(conn)),
 					conn->session_info->unix_info->unix_name,
 					conn->connectpath,
 					conn->session_info->unix_token->gid,
 					conn->session_info->unix_info->sanitized_username,
 					conn->session_info->info->domain_name,
-					lp_rootpreexec(snum));
+					lp_rootpreexec(talloc_tos(), snum));
 		DEBUG(5,("cmd=%s\n",cmd));
 		ret = smbrun(cmd,NULL);
 		TALLOC_FREE(cmd);
@@ -774,15 +775,15 @@ static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 	 * to below */
 
 	/* execute any "preexec = " line */
-	if (*lp_preexec(snum)) {
+	if (*lp_preexec(talloc_tos(), snum)) {
 		char *cmd = talloc_sub_advanced(talloc_tos(),
-					lp_servicename(SNUM(conn)),
+					lp_servicename(talloc_tos(), SNUM(conn)),
 					conn->session_info->unix_info->unix_name,
 					conn->connectpath,
 					conn->session_info->unix_token->gid,
 					conn->session_info->unix_info->sanitized_username,
 					conn->session_info->info->domain_name,
-					lp_preexec(snum));
+					lp_preexec(talloc_tos(), snum));
 		ret = smbrun(cmd,NULL);
 		TALLOC_FREE(cmd);
 		if (ret != 0 && lp_preexec_close(snum)) {
@@ -818,7 +819,7 @@ static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 		if (!canonicalize_connect_path(conn)) {
 			DEBUG(0, ("canonicalize_connect_path failed "
 			"for service %s, path %s\n",
-				lp_servicename(snum),
+				lp_servicename(talloc_tos(), snum),
 				conn->connectpath));
 			status = NT_STATUS_BAD_NETWORK_NAME;
 			goto err_root_exit;
@@ -827,11 +828,14 @@ static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 
 	/* Add veto/hide lists */
 	if (!IS_IPC(conn) && !IS_PRINT(conn)) {
-		set_namearray( &conn->veto_list, lp_veto_files(snum));
-		set_namearray( &conn->hide_list, lp_hide_files(snum));
-		set_namearray( &conn->veto_oplock_list, lp_veto_oplocks(snum));
+		set_namearray( &conn->veto_list,
+			       lp_veto_files(talloc_tos(), snum));
+		set_namearray( &conn->hide_list,
+			       lp_hide_files(talloc_tos(), snum));
+		set_namearray( &conn->veto_oplock_list,
+			       lp_veto_oplocks(talloc_tos(), snum));
 		set_namearray( &conn->aio_write_behind_list,
-				lp_aio_write_behind(snum));
+				lp_aio_write_behind(talloc_tos(), snum));
 	}
 	status = create_synthetic_smb_fname(talloc_tos(), conn->connectpath,
 					    NULL, NULL, &smb_fname_cpath);
@@ -850,11 +854,12 @@ static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 		if (ret == 0 && !S_ISDIR(smb_fname_cpath->st.st_ex_mode)) {
 			DEBUG(0,("'%s' is not a directory, when connecting to "
 				 "[%s]\n", conn->connectpath,
-				 lp_servicename(snum)));
+				 lp_servicename(talloc_tos(), snum)));
 		} else {
 			DEBUG(0,("'%s' does not exist or permission denied "
 				 "when connecting to [%s] Error was %s\n",
-				 conn->connectpath, lp_servicename(snum),
+				 conn->connectpath,
+				 lp_servicename(talloc_tos(), snum),
 				 strerror(errno) ));
 		}
 		status = NT_STATUS_BAD_NETWORK_NAME;
@@ -882,7 +887,8 @@ static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 			 tsocket_address_string(conn->sconn->remote_address,
 						talloc_tos()) );
 		dbgtext( "%s", srv_is_signing_active(sconn) ? "signed " : "");
-		dbgtext( "connect to service %s ", lp_servicename(snum) );
+		dbgtext( "connect to service %s ",
+			 lp_servicename(talloc_tos(), snum) );
 		dbgtext( "initially as user %s ",
 			 conn->session_info->unix_info->unix_name );
 		dbgtext( "(uid=%d, gid=%d) ", (int)effuid, (int)effgid );
@@ -903,7 +909,7 @@ static NTSTATUS make_connection_snum(struct smbd_server_connection *sconn,
 		SMB_VFS_DISCONNECT(conn);
 	}
 	if (claimed_connection) {
-		yield_connection(conn, lp_servicename(snum));
+		yield_connection(conn, lp_servicename(talloc_tos(), snum));
 	}
 	return status;
 }
@@ -921,7 +927,6 @@ static connection_struct *make_connection_smb1(struct smbd_server_connection *sc
 	NTSTATUS status;
 	NTTIME now = 0;
 	struct connection_struct *conn;
-	const char *share_name;
 
 	status = smb1srv_tcon_create(sconn->conn, now, &tcon);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -954,8 +959,7 @@ static connection_struct *make_connection_smb1(struct smbd_server_connection *sc
 		return NULL;
 	}
 
-	share_name = lp_servicename(SNUM(conn));
-	tcon->global->share_name = talloc_strdup(tcon->global, share_name);
+	tcon->global->share_name = lp_servicename(tcon->global, SNUM(conn));
 	if (tcon->global->share_name == NULL) {
 		conn_free(conn);
 		TALLOC_FREE(tcon);
@@ -1075,7 +1079,7 @@ connection_struct *make_connection(struct smbd_server_connection *sconn,
 					    dev, status);
 	} else if ((vuser->homes_snum != -1)
 		   && strequal(service_in,
-			       lp_servicename(vuser->homes_snum))) {
+			       lp_servicename(talloc_tos(), vuser->homes_snum))) {
 		DEBUG(5, ("making a connection to 'homes' service [%s] "
 			  "created at session setup time\n", service_in));
 		return make_connection_smb1(sconn,
@@ -1116,10 +1120,10 @@ connection_struct *make_connection(struct smbd_server_connection *sconn,
 	}
 
 	/* Handle non-Dfs clients attempting connections to msdfs proxy */
-	if (lp_host_msdfs() && (*lp_msdfs_proxy(snum) != '\0'))  {
+	if (lp_host_msdfs() && (*lp_msdfs_proxy(talloc_tos(), snum) != '\0'))  {
 		DEBUG(3, ("refusing connection to dfs proxy share '%s' "
 			  "(pointing to %s)\n", 
-			service, lp_msdfs_proxy(snum)));
+			service, lp_msdfs_proxy(talloc_tos(), snum)));
 		*status = NT_STATUS_BAD_NETWORK_NAME;
 		return NULL;
 	}
@@ -1148,27 +1152,27 @@ void close_cnum(connection_struct *conn, uint64_t vuid)
 				 get_remote_machine_name(),
 				 tsocket_address_string(conn->sconn->remote_address,
 							talloc_tos()),
-				 lp_servicename(SNUM(conn))));
+				 lp_servicename(talloc_tos(), SNUM(conn))));
 
 	/* Call VFS disconnect hook */    
 	SMB_VFS_DISCONNECT(conn);
 
-	yield_connection(conn, lp_servicename(SNUM(conn)));
+	yield_connection(conn, lp_servicename(talloc_tos(), SNUM(conn)));
 
 	/* make sure we leave the directory available for unmount */
 	vfs_ChDir(conn, "/");
 
 	/* execute any "postexec = " line */
-	if (*lp_postexec(SNUM(conn)) && 
+	if (*lp_postexec(talloc_tos(), SNUM(conn)) &&
 	    change_to_user(conn, vuid))  {
 		char *cmd = talloc_sub_advanced(talloc_tos(),
-					lp_servicename(SNUM(conn)),
+					lp_servicename(talloc_tos(), SNUM(conn)),
 					conn->session_info->unix_info->unix_name,
 					conn->connectpath,
 					conn->session_info->unix_token->gid,
 					conn->session_info->unix_info->sanitized_username,
 					conn->session_info->info->domain_name,
-					lp_postexec(SNUM(conn)));
+					lp_postexec(talloc_tos(), SNUM(conn)));
 		smbrun(cmd,NULL);
 		TALLOC_FREE(cmd);
 		change_to_root_user();
@@ -1176,15 +1180,15 @@ void close_cnum(connection_struct *conn, uint64_t vuid)
 
 	change_to_root_user();
 	/* execute any "root postexec = " line */
-	if (*lp_rootpostexec(SNUM(conn)))  {
+	if (*lp_rootpostexec(talloc_tos(), SNUM(conn)))  {
 		char *cmd = talloc_sub_advanced(talloc_tos(),
-					lp_servicename(SNUM(conn)),
+					lp_servicename(talloc_tos(), SNUM(conn)),
 					conn->session_info->unix_info->unix_name,
 					conn->connectpath,
 					conn->session_info->unix_token->gid,
 					conn->session_info->unix_info->sanitized_username,
 					conn->session_info->info->domain_name,
-					lp_rootpostexec(SNUM(conn)));
+					lp_rootpostexec(talloc_tos(), SNUM(conn)));
 		smbrun(cmd,NULL);
 		TALLOC_FREE(cmd);
 	}
diff --git a/source3/smbd/share_access.c b/source3/smbd/share_access.c
index 2a4775d2dd..7087a985a9 100644
--- a/source3/smbd/share_access.c
+++ b/source3/smbd/share_access.c
@@ -203,7 +203,7 @@ bool user_ok_token(const char *username, const char *domain,
 {
 	if (lp_invalid_users(snum) != NULL) {
 		if (token_contains_name_in_list(username, domain,
-						lp_servicename(snum),
+						lp_servicename(talloc_tos(), snum),
 						token,
 						lp_invalid_users(snum))) {
 			DEBUG(10, ("User %s in 'invalid users'\n", username));
@@ -213,7 +213,8 @@ bool user_ok_token(const char *username, const char *domain,
 
 	if (lp_valid_users(snum) != NULL) {
 		if (!token_contains_name_in_list(username, domain,
-						 lp_servicename(snum), token,
+						 lp_servicename(talloc_tos(), snum),
+						 token,
 						 lp_valid_users(snum))) {
 			DEBUG(10, ("User %s not in 'valid users'\n",
 				   username));
@@ -223,14 +224,14 @@ bool user_ok_token(const char *username, const char *domain,
 
 	if (lp_onlyuser(snum)) {
 		const char *list[2];
-		list[0] = lp_username(snum);
+		list[0] = lp_username(talloc_tos(), snum);
 		list[1] = NULL;
 		if ((list[0] == NULL) || (*list[0] == '\0')) {
 			DEBUG(0, ("'only user = yes' and no 'username ='\n"));
 			return False;
 		}
 		if (!token_contains_name_in_list(NULL, domain,
-						 lp_servicename(snum),
+						 lp_servicename(talloc_tos(), snum),
 						 token, list)) {
 			DEBUG(10, ("%s != 'username'\n", username));
 			return False;
@@ -238,7 +239,7 @@ bool user_ok_token(const char *username, const char *domain,
 	}
 
 	DEBUG(10, ("user_ok_token: share %s is ok for unix user %s\n",
-		   lp_servicename(snum), username));
+		   lp_servicename(talloc_tos(), snum), username));
 
 	return True;
 }
@@ -267,7 +268,8 @@ bool is_share_read_only_for_token(const char *username,
 
 	if (lp_readlist(snum) != NULL) {
 		if (token_contains_name_in_list(username, domain,
-						lp_servicename(snum), token,
+						lp_servicename(talloc_tos(), snum),
+						token,
 						lp_readlist(snum))) {
 			result = True;
 		}
@@ -275,14 +277,15 @@ bool is_share_read_only_for_token(const char *username,
 
 	if (lp_writelist(snum) != NULL) {
 		if (token_contains_name_in_list(username, domain,
-						lp_servicename(snum), token,
+						lp_servicename(talloc_tos(), snum),
+						token,
 						lp_writelist(snum))) {
 			result = False;
 		}
 	}
 
 	DEBUG(10,("is_share_read_only_for_user: share %s is %s for unix user "
-		  "%s\n", lp_servicename(snum),
+		  "%s\n", lp_servicename(talloc_tos(), snum),
 		  result ? "read-only" : "read-write", username));
 
 	return result;
diff --git a/source3/smbd/smb2_find.c b/source3/smbd/smb2_find.c
index ef6887d3b7..bb5e934a87 100644
--- a/source3/smbd/smb2_find.c
+++ b/source3/smbd/smb2_find.c
@@ -369,9 +369,9 @@ static struct tevent_req *smbd_smb2_find_send(TALLOC_CTX *mem_ctx,
 
 	DEBUG(8,("smbd_smb2_find_send: dirpath=<%s> dontdescend=<%s>, "
 		"in_output_buffer_length = %u\n",
-		fsp->fsp_name->base_name, lp_dontdescend(SNUM(conn)),
+		fsp->fsp_name->base_name, lp_dontdescend(talloc_tos(), SNUM(conn)),
 		(unsigned int)in_output_buffer_length ));
-	if (in_list(fsp->fsp_name->base_name,lp_dontdescend(SNUM(conn)),
+	if (in_list(fsp->fsp_name->base_name,lp_dontdescend(talloc_tos(), SNUM(conn)),
 			conn->case_sensitive)) {
 		dont_descend = true;
 	}
diff --git a/source3/smbd/smb2_tcon.c b/source3/smbd/smb2_tcon.c
index ceb145ff63..4549d3aa84 100644
--- a/source3/smbd/smb2_tcon.c
+++ b/source3/smbd/smb2_tcon.c
@@ -185,7 +185,6 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req,
 	connection_struct *compat_conn = NULL;
 	struct user_struct *compat_vuser = req->session->compat;
 	NTSTATUS status;
-	const char *share_name = NULL;
 
 	if (strncmp(share, "\\\\", 2) == 0) {
 		const char *p = strchr(share+2, '\\');
@@ -217,7 +216,7 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req,
 		snum = compat_vuser->homes_snum;
 	} else if ((compat_vuser->homes_snum != -1)
                    && strequal(service,
-			lp_servicename(compat_vuser->homes_snum))) {
+			lp_servicename(talloc_tos(), compat_vuser->homes_snum))) {
 		snum = compat_vuser->homes_snum;
 	} else {
 		snum = find_service(talloc_tos(), service, &service);
@@ -248,8 +247,8 @@ static NTSTATUS smbd_smb2_tree_connect(struct smbd_smb2_request *req,
 		return status;
 	}
 
-	share_name = lp_servicename(SNUM(compat_conn));
-	tcon->global->share_name = talloc_strdup(tcon->global, share_name);
+	tcon->global->share_name = lp_servicename(tcon->global,
+						  SNUM(compat_conn));
 	if (tcon->global->share_name == NULL) {
 		conn_free(compat_conn);
 		TALLOC_FREE(tcon);
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index 682b3c4e4f..73feaf8798 100644
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -2495,8 +2495,8 @@ total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pd
 		a different TRANS2 call. */
 
 	DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
-		directory,lp_dontdescend(SNUM(conn))));
-	if (in_list(directory,lp_dontdescend(SNUM(conn)),conn->case_sensitive))
+		 directory,lp_dontdescend(ctx, SNUM(conn))));
+	if (in_list(directory,lp_dontdescend(ctx, SNUM(conn)),conn->case_sensitive))
 		dont_descend = True;
 
 	p = pdata;
@@ -2824,8 +2824,8 @@ total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pd
 		a different TRANS2 call. */
 
 	DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
-		 directory,lp_dontdescend(SNUM(conn))));
-	if (in_list(directory,lp_dontdescend(SNUM(conn)),conn->case_sensitive))
+		 directory,lp_dontdescend(ctx, SNUM(conn))));
+	if (in_list(directory,lp_dontdescend(ctx, SNUM(conn)),conn->case_sensitive))
 		dont_descend = True;
 
 	p = pdata;
@@ -2943,7 +2943,7 @@ total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pd
 
 unsigned char *create_volume_objectid(connection_struct *conn, unsigned char objid[16])
 {
-	E_md4hash(lp_servicename(SNUM(conn)),objid);
+	E_md4hash(lp_servicename(talloc_tos(), SNUM(conn)),objid);
 	return objid;
 }
 
@@ -2992,9 +2992,9 @@ NTSTATUS smbd_do_qfsinfo(connection_struct *conn,
 {
 	char *pdata, *end_data;
 	int data_len = 0, len;
-	const char *vname = volume_label(SNUM(conn));
+	const char *vname = volume_label(talloc_tos(), SNUM(conn));
 	int snum = SNUM(conn);
-	char *fstype = lp_fstype(SNUM(conn));
+	char *fstype = lp_fstype(talloc_tos(), SNUM(conn));
 	uint32 additional_flags = 0;
 	struct smb_filename smb_fname_dot;
 	SMB_STRUCT_STAT st;
@@ -3073,7 +3073,7 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)st.st_ex_dev, (u
 			 * Add volume serial number - hash of a combination of
 			 * the called hostname and the service name.
 			 */
-			SIVAL(pdata,0,str_checksum(lp_servicename(snum)) ^ (str_checksum(get_local_machine_name())<<16) );
+			SIVAL(pdata,0,str_checksum(lp_servicename(talloc_tos(), snum)) ^ (str_checksum(get_local_machine_name())<<16) );
 			/*
 			 * Win2k3 and previous mess this up by sending a name length
 			 * one byte short. I believe only older clients (OS/2 Win9x) use
@@ -3139,7 +3139,7 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)st.st_ex_dev, (u
 			 * Add volume serial number - hash of a combination of
 			 * the called hostname and the service name.
 			 */
-			SIVAL(pdata,8,str_checksum(lp_servicename(snum)) ^ 
+			SIVAL(pdata,8,str_checksum(lp_servicename(talloc_tos(), snum)) ^
 				(str_checksum(get_local_machine_name())<<16));
 
 			/* Max label len is 32 characters. */
@@ -3150,7 +3150,8 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)st.st_ex_dev, (u
 			data_len = 18+len;
 
 			DEBUG(5,("smbd_do_qfsinfo : SMB_QUERY_FS_VOLUME_INFO namelen = %d, vol=%s serv=%s\n",
-				(int)strlen(vname),vname, lp_servicename(snum)));
+				(int)strlen(vname),vname,
+				lp_servicename(talloc_tos(), snum)));
 			break;
 
 		case SMB_QUERY_FS_SIZE_INFO:
@@ -3271,20 +3272,20 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned
 			if (get_current_uid(conn) != 0) {
 				DEBUG(0,("set_user_quota: access_denied "
 					 "service [%s] user [%s]\n",
-					 lp_servicename(SNUM(conn)),
+					 lp_servicename(talloc_tos(), SNUM(conn)),
 					 conn->session_info->unix_info->unix_name));
 				return NT_STATUS_ACCESS_DENIED;
 			}
 
 			if (vfs_get_ntquota(&fsp, SMB_USER_FS_QUOTA_TYPE, NULL, &quotas)!=0) {
-				DEBUG(0,("vfs_get_ntquota() failed for service [%s]\n",lp_servicename(SNUM(conn))));
+				DEBUG(0,("vfs_get_ntquota() failed for service [%s]\n",lp_servicename(talloc_tos(), SNUM(conn))));
 				return map_nt_error_from_unix(errno);
 			}
 
 			data_len = 48;
 
 			DEBUG(10,("SMB_FS_QUOTA_INFORMATION: for service [%s]\n",
-				  lp_servicename(SNUM(conn))));
+				  lp_servicename(talloc_tos(), SNUM(conn))));
 
 			/* Unknown1 24 NULL bytes*/
 			SBIG_UINT(pdata,0,(uint64_t)0);
@@ -3401,7 +3402,7 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned
 				return NT_STATUS_INVALID_LEVEL;
 #endif /* EOPNOTSUPP */
 			} else {
-				DEBUG(0,("vfs_statvfs() failed for service [%s]\n",lp_servicename(SNUM(conn))));
+				DEBUG(0,("vfs_statvfs() failed for service [%s]\n",lp_servicename(talloc_tos(), SNUM(conn))));
 				return NT_STATUS_DOS(ERRSRV, ERRerror);
 			}
 			break;
@@ -3511,7 +3512,7 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned
 			 * Thursby MAC extension... ONLY on NTFS filesystems
 			 * once we do streams then we don't need this
 			 */
-			if (strequal(lp_fstype(SNUM(conn)),"NTFS")) {
+			if (strequal(lp_fstype(talloc_tos(), SNUM(conn)),"NTFS")) {
 				data_len = 88;
 				SIVAL(pdata,84,0x100); /* Don't support mac... */
 				break;
@@ -3594,7 +3595,8 @@ static void call_trans2setfsinfo(connection_struct *conn,
 	char *params = *pparams;
 	uint16 info_level;
 
-	DEBUG(10,("call_trans2setfsinfo: for service [%s]\n",lp_servicename(SNUM(conn))));
+	DEBUG(10,("call_trans2setfsinfo: for service [%s]\n",
+		  lp_servicename(talloc_tos(), SNUM(conn))));
 
 	/*  */
 	if (total_params < 4) {
@@ -3757,7 +3759,7 @@ static void call_trans2setfsinfo(connection_struct *conn,
 				/* access check */
 				if ((get_current_uid(conn) != 0) || !CAN_WRITE(conn)) {
 					DEBUG(0,("set_user_quota: access_denied service [%s] user [%s]\n",
-						 lp_servicename(SNUM(conn)),
+						 lp_servicename(talloc_tos(), SNUM(conn)),
 						 conn->session_info->unix_info->unix_name));
 					reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 					return;
@@ -3801,7 +3803,7 @@ static void call_trans2setfsinfo(connection_struct *conn,
 
 				/* now set the quotas */
 				if (vfs_set_ntquota(fsp, SMB_USER_FS_QUOTA_TYPE, NULL, &quotas)!=0) {
-					DEBUG(0,("vfs_set_ntquota() failed for service [%s]\n",lp_servicename(SNUM(conn))));
+					DEBUG(0,("vfs_set_ntquota() failed for service [%s]\n",lp_servicename(talloc_tos(), SNUM(conn))));
 					reply_nterror(req, map_nt_error_from_unix(errno));
 					return;
 				}
@@ -8424,7 +8426,7 @@ static void call_trans2ioctl(connection_struct *conn,
 			    lp_netbios_name(), 15,
 			    STR_ASCII|STR_TERMINATE); /* Our NetBIOS name */
 		srvstr_push(pdata, req->flags2, pdata+18,
-			    lp_servicename(SNUM(conn)), 13,
+			    lp_servicename(talloc_tos(), SNUM(conn)), 13,
 			    STR_ASCII|STR_TERMINATE); /* Service name */
 		send_trans2_replies(conn, req, *pparams, 0, *ppdata, 32,
 				    max_data_bytes);
diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c
index 27d7d1a413..eac5d9d97e 100644
--- a/source3/smbd/uid.c
+++ b/source3/smbd/uid.c
@@ -122,7 +122,8 @@ static bool check_user_ok(connection_struct *conn,
 
 	if (!readonly_share &&
 	    !share_access_check(session_info->security_token,
-				lp_servicename(snum), FILE_WRITE_DATA,
+				lp_servicename(talloc_tos(), snum),
+				FILE_WRITE_DATA,
 				NULL)) {
 		/* smb.conf allows r/w, but the security descriptor denies
 		 * write. Fall back to looking at readonly. */
@@ -132,7 +133,7 @@ static bool check_user_ok(connection_struct *conn,
 	}
 
 	if (!share_access_check(session_info->security_token,
-				lp_servicename(snum),
+				lp_servicename(talloc_tos(), snum),
 				readonly_share ?
 				FILE_READ_DATA : FILE_WRITE_DATA,
 				NULL)) {
@@ -209,7 +210,7 @@ static bool change_to_user_internal(connection_struct *conn,
 			 "not permitted access to share %s.\n",
 			 session_info->unix_info->sanitized_username,
 			 session_info->unix_info->unix_name,
-			 lp_servicename(snum)));
+			 lp_servicename(talloc_tos(), snum)));
 		return false;
 	}
 
@@ -222,7 +223,7 @@ static bool change_to_user_internal(connection_struct *conn,
 	 * See if we should force group for this service. If so this overrides
 	 * any group set in the force user code.
 	 */
-	if((group_c = *lp_force_group(snum))) {
+	if((group_c = *lp_force_group(talloc_tos(), snum))) {
 
 		SMB_ASSERT(conn->force_group_gid != (gid_t)-1);
 
@@ -299,7 +300,8 @@ bool change_to_user(connection_struct *conn, uint64_t vuid)
 	if (vuser == NULL) {
 		/* Invalid vuid sent */
 		DEBUG(2,("Invalid vuid %llu used on share %s.\n",
-			 (unsigned long long)vuid, lp_servicename(snum)));
+			 (unsigned long long)vuid, lp_servicename(talloc_tos(),
+								  snum)));
 		return false;
 	}
 
@@ -307,7 +309,8 @@ bool change_to_user(connection_struct *conn, uint64_t vuid)
 
 	if (!conn->force_user && vuser == NULL) {
 		DEBUG(2,("Invalid vuid used %llu in accessing share %s.\n",
-			 (unsigned long long)vuid, lp_servicename(snum)));
+			 (unsigned long long)vuid,
+			 lp_servicename(talloc_tos(), snum)));
 		return False;
 	}
 
diff --git a/source3/torture/cmd_vfs.c b/source3/torture/cmd_vfs.c
index b6cc716a61..0869e0b066 100644
--- a/source3/torture/cmd_vfs.c
+++ b/source3/torture/cmd_vfs.c
@@ -97,7 +97,7 @@ static NTSTATUS cmd_show_data(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int ar
 
 static NTSTATUS cmd_connect(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv)
 {
-	SMB_VFS_CONNECT(vfs->conn, lp_servicename(SNUM(vfs->conn)), "vfstest");
+	SMB_VFS_CONNECT(vfs->conn, lp_servicename(talloc_tos(), SNUM(vfs->conn)), "vfstest");
 	return NT_STATUS_OK;
 }
 
diff --git a/source3/utils/net_idmap.c b/source3/utils/net_idmap.c
index 28f9ed938e..f067071de1 100644
--- a/source3/utils/net_idmap.c
+++ b/source3/utils/net_idmap.c
@@ -79,7 +79,8 @@ static const char* net_idmap_dbfile(struct net_context *c)
 			d_fprintf(stderr, _("Out of memory!\n"));
 		}
 	} else if (strequal(lp_idmap_backend(), "tdb2")) {
-		dbfile = lp_parm_talloc_string(-1, "tdb", "idmap2.tdb", NULL);
+		dbfile = lp_parm_talloc_string(talloc_tos(),
+					       -1, "tdb", "idmap2.tdb", NULL);
 		if (dbfile == NULL) {
 			dbfile = talloc_asprintf(talloc_tos(), "%s/idmap2.tdb",
 						 lp_private_dir());
diff --git a/source3/utils/net_sam.c b/source3/utils/net_sam.c
index 7163e663f8..c21d9daec1 100644
--- a/source3/utils/net_sam.c
+++ b/source3/utils/net_sam.c
@@ -1699,7 +1699,8 @@ static int net_sam_provision(struct net_context *c, int argc, const char **argv)
 
 		uname = talloc_strdup(tc, "domusers");
 		wname = talloc_strdup(tc, "Domain Users");
-		dn = talloc_asprintf(tc, "cn=%s,%s", "domusers", lp_ldap_group_suffix());
+		dn = talloc_asprintf(tc, "cn=%s,%s", "domusers",
+				     lp_ldap_group_suffix(talloc_tos()));
 		gidstr = talloc_asprintf(tc, "%u", (unsigned int)domusers_gid);
 		gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
 
@@ -1775,7 +1776,8 @@ domu_done:
 
 		uname = talloc_strdup(tc, "domadmins");
 		wname = talloc_strdup(tc, "Domain Admins");
-		dn = talloc_asprintf(tc, "cn=%s,%s", "domadmins", lp_ldap_group_suffix());
+		dn = talloc_asprintf(tc, "cn=%s,%s", "domadmins",
+				     lp_ldap_group_suffix(talloc_tos()));
 		gidstr = talloc_asprintf(tc, "%u", (unsigned int)domadmins_gid);
 		gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
 
@@ -1865,7 +1867,8 @@ doma_done:
 		}
 
 		name = talloc_strdup(tc, "Administrator");
-		dn = talloc_asprintf(tc, "uid=Administrator,%s", lp_ldap_user_suffix());
+		dn = talloc_asprintf(tc, "uid=Administrator,%s",
+				     lp_ldap_user_suffix(talloc_tos()));
 		uidstr = talloc_asprintf(tc, "%u", (unsigned int)uid);
 		gidstr = talloc_asprintf(tc, "%u", (unsigned int)domadmins_gid);
 		dir = talloc_sub_specified(tc, lp_template_homedir(),
@@ -1989,7 +1992,8 @@ doma_done:
 			}
 		}
 
-		dn = talloc_asprintf(tc, "uid=%s,%s", pwd->pw_name, lp_ldap_user_suffix ());
+		dn = talloc_asprintf(tc, "uid=%s,%s", pwd->pw_name,
+				     lp_ldap_user_suffix (talloc_tos()));
 		uidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_uid);
 		gidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_gid);
 		if (!dn || !uidstr || !gidstr) {
@@ -2074,7 +2078,8 @@ doma_done:
 
 		uname = talloc_strdup(tc, "domguests");
 		wname = talloc_strdup(tc, "Domain Guests");
-		dn = talloc_asprintf(tc, "cn=%s,%s", "domguests", lp_ldap_group_suffix());
+		dn = talloc_asprintf(tc, "cn=%s,%s", "domguests",
+				     lp_ldap_group_suffix(talloc_tos()));
 		gidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_gid);
 		gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
 
diff --git a/source3/utils/net_usershare.c b/source3/utils/net_usershare.c
index b11757a611..153b45e7f8 100644
--- a/source3/utils/net_usershare.c
+++ b/source3/utils/net_usershare.c
@@ -135,7 +135,7 @@ int net_usershare_usage(struct net_context *c, int argc, const char **argv)
 
 static char *get_basepath(TALLOC_CTX *ctx)
 {
-	char *basepath = talloc_strdup(ctx, lp_usershare_path());
+	char *basepath = lp_usershare_path(ctx);
 
 	if (!basepath) {
 		return NULL;
@@ -174,7 +174,7 @@ static int net_usershare_delete(struct net_context *c, int argc, const char **ar
 
 	us_path = talloc_asprintf(talloc_tos(),
 				"%s/%s",
-				lp_usershare_path(),
+				lp_usershare_path(talloc_tos()),
 				sharename);
 	if (!us_path) {
 		TALLOC_FREE(sharename);
@@ -1104,13 +1104,13 @@ int net_usershare(struct net_context *c, int argc, const char **argv)
 		return -1;
 	}
 
-	dp = opendir(lp_usershare_path());
+	dp = opendir(lp_usershare_path(talloc_tos()));
 	if (!dp) {
 		int err = errno;
 		d_fprintf(stderr,
 			_("net usershare: cannot open usershare directory %s. "
 			  "Error %s\n"),
-			lp_usershare_path(), strerror(err) );
+			lp_usershare_path(talloc_tos()), strerror(err) );
 		if (err == EACCES) {
 			d_fprintf(stderr,
 				_("You do not have permission to create a "
diff --git a/source3/utils/smbpasswd.c b/source3/utils/smbpasswd.c
index 3689983444..43edab24ee 100644
--- a/source3/utils/smbpasswd.c
+++ b/source3/utils/smbpasswd.c
@@ -286,7 +286,7 @@ static bool store_ldap_admin_pw (char* pw)
 	if (!secrets_init())
 		return False;
 
-	return secrets_store_ldap_pw(lp_ldap_admin_dn(), pw);
+	return secrets_store_ldap_pw(lp_ldap_admin_dn(talloc_tos()), pw);
 }
 
 
@@ -301,7 +301,7 @@ static int process_root(int local_flags)
 	char *old_passwd = NULL;
 
 	if (local_flags & LOCAL_SET_LDAP_ADMIN_PW) {
-		char *ldap_admin_dn = lp_ldap_admin_dn();
+		char *ldap_admin_dn = lp_ldap_admin_dn(talloc_tos());
 		if ( ! *ldap_admin_dn ) {
 			DEBUG(0,("ERROR: 'ldap admin dn' not defined! Please check your smb.conf\n"));
 			goto done;
diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c
index b75fc61b6e..105f1c5746 100644
--- a/source3/utils/testparm.c
+++ b/source3/utils/testparm.c
@@ -170,8 +170,8 @@ cannot be set in the smb.conf file. nmbd will abort with this setting.\n");
 		if (!lp_pam_password_change()) {
 #endif
 
-			if((lp_passwd_program() == NULL) ||
-			   (strlen(lp_passwd_program()) == 0))
+			if((lp_passwd_program(talloc_tos()) == NULL) ||
+			   (strlen(lp_passwd_program(talloc_tos())) == 0))
 			{
 				fprintf( stderr, "ERROR: the 'unix password sync' parameter is set and there is no valid 'passwd program' \
 parameter.\n" );
@@ -181,7 +181,7 @@ parameter.\n" );
 				char *truncated_prog = NULL;
 				const char *p;
 
-				passwd_prog = lp_passwd_program();
+				passwd_prog = lp_passwd_program(talloc_tos());
 				p = passwd_prog;
 				next_token_talloc(talloc_tos(),
 						&p,
@@ -197,18 +197,18 @@ cannot be executed (error was %s).\n", truncated_prog, strerror(errno) );
 		}
 #endif
 
-		if(lp_passwd_chat() == NULL) {
+		if(lp_passwd_chat(talloc_tos()) == NULL) {
 			fprintf(stderr, "ERROR: the 'unix password sync' parameter is set and there is no valid 'passwd chat' \
 parameter.\n");
 			ret = 1;
 		}
 
-		if ((lp_passwd_program() != NULL) &&
-		    (strlen(lp_passwd_program()) > 0))
+		if ((lp_passwd_program(talloc_tos()) != NULL) &&
+		    (strlen(lp_passwd_program(talloc_tos())) > 0))
 		{
 			/* check if there's a %u parameter present */
-			if(strstr_m(lp_passwd_program(), "%u") == NULL) {
-				fprintf(stderr, "ERROR: the 'passwd program' (%s) requires a '%%u' parameter.\n", lp_passwd_program());
+			if(strstr_m(lp_passwd_program(talloc_tos()), "%u") == NULL) {
+				fprintf(stderr, "ERROR: the 'passwd program' (%s) requires a '%%u' parameter.\n", lp_passwd_program(talloc_tos()));
 				ret = 1;
 			}
 		}
@@ -219,9 +219,9 @@ parameter.\n");
 		 */
 
 		if(lp_encrypted_passwords()) {
-			if(strstr_m( lp_passwd_chat(), "%o")!=NULL) {
+			if(strstr_m( lp_passwd_chat(talloc_tos()), "%o")!=NULL) {
 				fprintf(stderr, "ERROR: the 'passwd chat' script [%s] expects to use the old plaintext password \
-via the %%o substitution. With encrypted passwords this is not possible.\n", lp_passwd_chat() );
+via the %%o substitution. With encrypted passwords this is not possible.\n", lp_passwd_chat(talloc_tos()) );
 				ret = 1;
 			}
 		}
@@ -283,7 +283,7 @@ static void do_per_share_checks(int s)
 			char *hasquery = strchr_m(deny_list[i], '?');
 			if(hasstar || hasquery) {
 				fprintf(stderr,"Invalid character %c in hosts deny list (%s) for service %s.\n",
-					   hasstar ? *hasstar : *hasquery, deny_list[i], lp_servicename(s) );
+					hasstar ? *hasstar : *hasquery, deny_list[i], lp_servicename(talloc_tos(), s) );
 			}
 		}
 	}
@@ -294,7 +294,7 @@ static void do_per_share_checks(int s)
 			char *hasquery = strchr_m(allow_list[i], '?');
 			if(hasstar || hasquery) {
 				fprintf(stderr,"Invalid character %c in hosts allow list (%s) for service %s.\n",
-					   hasstar ? *hasstar : *hasquery, allow_list[i], lp_servicename(s) );
+					hasstar ? *hasstar : *hasquery, allow_list[i], lp_servicename(talloc_tos(), s) );
 			}
 		}
 	}
@@ -302,7 +302,7 @@ static void do_per_share_checks(int s)
 	if(lp_level2_oplocks(s) && !lp_oplocks(s)) {
 		fprintf(stderr,"Invalid combination of parameters for service %s. \
 			   Level II oplocks can only be set if oplocks are also set.\n",
-			   lp_servicename(s) );
+			lp_servicename(talloc_tos(), s) );
 	}
 
 	if (!lp_store_dos_attributes(s) && lp_map_hidden(s)
@@ -310,34 +310,34 @@ static void do_per_share_checks(int s)
 	{
 		fprintf(stderr,"Invalid combination of parameters for service "
 			"%s. Map hidden can only work if create mask includes "
-			"octal 01 (S_IXOTH).\n", lp_servicename(s));
+			"octal 01 (S_IXOTH).\n", lp_servicename(talloc_tos(), s));
 	}
 	if (!lp_store_dos_attributes(s) && lp_map_hidden(s)
 	    && (lp_force_create_mode(s) & S_IXOTH))
 	{
 		fprintf(stderr,"Invalid combination of parameters for service "
 			"%s. Map hidden can only work if force create mode "
-			"excludes octal 01 (S_IXOTH).\n", lp_servicename(s));
+			"excludes octal 01 (S_IXOTH).\n", lp_servicename(talloc_tos(), s));
 	}
 	if (!lp_store_dos_attributes(s) && lp_map_system(s)
 	    && !(lp_create_mask(s) & S_IXGRP))
 	{
 		fprintf(stderr,"Invalid combination of parameters for service "
 			"%s. Map system can only work if create mask includes "
-			"octal 010 (S_IXGRP).\n", lp_servicename(s));
+			"octal 010 (S_IXGRP).\n", lp_servicename(talloc_tos(), s));
 	}
 	if (!lp_store_dos_attributes(s) && lp_map_system(s)
 	    && (lp_force_create_mode(s) & S_IXGRP))
 	{
 		fprintf(stderr,"Invalid combination of parameters for service "
 			"%s. Map system can only work if force create mode "
-			"excludes octal 010 (S_IXGRP).\n", lp_servicename(s));
+			"excludes octal 010 (S_IXGRP).\n", lp_servicename(talloc_tos(), s));
 	}
 #ifdef HAVE_CUPS
-	if (lp_printing(s) == PRINT_CUPS && *(lp_printcommand(s)) != '\0') {
+	if (lp_printing(s) == PRINT_CUPS && *(lp_printcommand(talloc_tos(), s)) != '\0') {
 		 fprintf(stderr,"Warning: Service %s defines a print command, but \
 rameter is ignored when using CUPS libraries.\n",
-			   lp_servicename(s) );
+			   lp_servicename(talloc_tos(), s) );
 	}
 #endif
 }
@@ -424,7 +424,7 @@ rameter is ignored when using CUPS libraries.\n",
 
 	for (s=0;s<1000;s++) {
 		if (VALID_SNUM(s))
-			if (strlen(lp_servicename(s)) > 12) {
+			if (strlen(lp_servicename(talloc_tos(), s)) > 12) {
 				fprintf(stderr, "WARNING: You have some share names that are longer than 12 characters.\n" );
 				fprintf(stderr, "These may not be accessible to some older clients.\n" );
 				fprintf(stderr, "(Eg. Windows9x, WindowsMe, and smbclient prior to Samba 3.0.)\n" );
@@ -489,10 +489,10 @@ rameter is ignored when using CUPS libraries.\n",
 				if (allow_access(lp_hostsdeny(-1), lp_hostsallow(-1), cname, caddr)
 				    && allow_access(lp_hostsdeny(s), lp_hostsallow(s), cname, caddr)) {
 					fprintf(stderr,"Allow connection from %s (%s) to %s\n",
-						   cname,caddr,lp_servicename(s));
+						   cname,caddr,lp_servicename(talloc_tos(), s));
 				} else {
 					fprintf(stderr,"Deny connection from %s (%s) to %s\n",
-						   cname,caddr,lp_servicename(s));
+						   cname,caddr,lp_servicename(talloc_tos(), s));
 				}
 			}
 		}
diff --git a/source3/web/swat.c b/source3/web/swat.c
index 1e676a5aec..90e4af9958 100644
--- a/source3/web/swat.c
+++ b/source3/web/swat.c
@@ -627,7 +627,7 @@ static void commit_parameter(int snum, struct parm_struct *parm, const char *v)
 		   variable globally. We need to change the parameter in 
 		   all shares where it is currently set to the default */
 		for (i=0;i<lp_numservices();i++) {
-			s = lp_servicename(i);
+			s = lp_servicename(talloc_tos(), i);
 			if (s && (*s) && lp_is_default(i, parm)) {
 				lp_do_parameter(i, parm->label, v);
 			}
@@ -1112,7 +1112,7 @@ output_page:
 	if (snum < 0)
 		printf("<option value=\" \"> \n");
 	for (i=0;i<lp_numservices();i++) {
-		s = lp_servicename(i);
+		s = lp_servicename(talloc_tos(), i);
 		if (s && (*s) && strcmp(s,"IPC$") && !lp_print_ok(i)) {
 			push_utf8_talloc(talloc_tos(), &utf8_s, s, &converted_size);
 			printf("<option %s value=\"%s\">%s\n", 
@@ -1469,7 +1469,7 @@ output_page:
 	if (snum < 0 || !lp_print_ok(snum))
 		printf("<option value=\" \"> \n");
 	for (i=0;i<lp_numservices();i++) {
-		s = lp_servicename(i);
+		s = lp_servicename(talloc_tos(), i);
 		if (s && (*s) && strcmp(s,"IPC$") && lp_print_ok(i)) {
                     if (i >= iNumNonAutoPrintServices)
                         printf("<option %s value=\"%s\">[*]%s\n",
diff --git a/source3/winbindd/idmap_ldap.c b/source3/winbindd/idmap_ldap.c
index 4f1dc8c7f4..aeeb2e87d0 100644
--- a/source3/winbindd/idmap_ldap.c
+++ b/source3/winbindd/idmap_ldap.c
@@ -471,7 +471,7 @@ static NTSTATUS idmap_ldap_db_init(struct idmap_domain *dom)
 
 	tmp = lp_parm_const_string(-1, config_option, "ldap_base_dn", NULL);
 	if ( ! tmp || ! *tmp) {
-		tmp = lp_ldap_idmap_suffix();
+		tmp = lp_ldap_idmap_suffix(talloc_tos());
 		if ( ! tmp) {
 			DEBUG(1, ("ERROR: missing idmap ldap suffix\n"));
 			ret = NT_STATUS_UNSUCCESSFUL;
diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c
index 1b6f4251b9..fe6e34b4b9 100644
--- a/source3/winbindd/winbindd.c
+++ b/source3/winbindd/winbindd.c
@@ -65,7 +65,7 @@ static bool reload_services_file(const char *lfile)
 	bool ret;
 
 	if (lp_loaded()) {
-		char *fname = lp_configfile();
+		char *fname = lp_configfile(talloc_tos());
 
 		if (file_exist(fname) && !strcsequal(fname,get_dyn_CONFIGFILE())) {
 			set_dyn_CONFIGFILE(fname);
@@ -1297,7 +1297,7 @@ int main(int argc, char **argv, char **envp)
  	CatchSignal(SIGUSR2, SIG_IGN);
 
 	fault_setup();
-	dump_core_setup("winbindd", lp_logfile());
+	dump_core_setup("winbindd", lp_logfile(talloc_tos()));
 
 	load_case_tables();
 
@@ -1357,7 +1357,7 @@ int main(int argc, char **argv, char **envp)
 	 * is often not related to the path where winbindd is actually run
 	 * in production.
 	 */
-	dump_core_setup("winbindd", lp_logfile());
+	dump_core_setup("winbindd", lp_logfile(talloc_tos()));
 	if (is_daemon && interactive) {
 		d_fprintf(stderr,"\nERROR: "
 			  "Option -i|--interactive is not allowed together with -D|--daemon\n\n");
@@ -1401,7 +1401,7 @@ int main(int argc, char **argv, char **envp)
 	 * as the log file might have been set in the configuration and cores's
 	 * path is by default basename(lp_logfile()).
 	 */
-	dump_core_setup("winbindd", lp_logfile());
+	dump_core_setup("winbindd", lp_logfile(talloc_tos()));
 
 	/* Initialise messaging system */
 
diff --git a/source3/winbindd/winbindd_dual.c b/source3/winbindd/winbindd_dual.c
index 4eef550b4b..0e9bea123e 100644
--- a/source3/winbindd/winbindd_dual.c
+++ b/source3/winbindd/winbindd_dual.c
@@ -455,10 +455,10 @@ void setup_child(struct winbindd_domain *domain, struct winbindd_child *child,
 	if (logprefix && logname) {
 		char *logbase = NULL;
 
-		if (*lp_logfile()) {
+		if (*lp_logfile(talloc_tos())) {
 			char *end = NULL;
 
-			if (asprintf(&logbase, "%s", lp_logfile()) < 0) {
+			if (asprintf(&logbase, "%s", lp_logfile(talloc_tos())) < 0) {
 				smb_panic("Internal error: asprintf failed");
 			}