r19832: better prototypes for the linearization functions:

- ldb_dn_get_linearized
  returns a const string

- ldb_dn_alloc_linearized
  allocs astring with the linearized dn
(This used to be commit 3929c086d5d0b3f08b1c4f2f3f9602c3f4a9a4bd)

51 files changed, 170 insertions, 188 deletions

diff --git a/source4/auth/auth_sam.c b/source4/auth/auth_sam.c
index 08ba75e4f6..0f5763a068 100644
--- a/source4/auth/auth_sam.c
+++ b/source4/auth/auth_sam.c
@@ -89,7 +89,7 @@ static NTSTATUS authsam_search_account(TALLOC_CTX *mem_ctx, struct ldb_context *
 
 	if (ret == 0) {
 		DEBUG(3,("sam_search_user: Couldn't find user [%s\\%s] in samdb, under %s\n", 
-			 domain_name, account_name, ldb_dn_linearize(mem_ctx, domain_dn)));
+			 domain_name, account_name, ldb_dn_get_linearized(domain_dn)));
 		return NT_STATUS_NO_SUCH_USER;
 	}
 
@@ -127,7 +127,7 @@ static NTSTATUS authsam_search_account(TALLOC_CTX *mem_ctx, struct ldb_context *
 		}
 
 		ret_domain = gendb_search(sam_ctx, mem_ctx, partitions_basedn, &msgs_domain_ref, domain_ref_attrs,
-					  "(nCName=%s)", ldb_dn_linearize(msgs_tmp, msgs_tmp[0]->dn));
+					  "(nCName=%s)", ldb_dn_alloc_linearized(msgs_tmp, msgs_tmp[0]->dn));
 
 		if (ret_domain == -1) {
 			return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -135,13 +135,13 @@ static NTSTATUS authsam_search_account(TALLOC_CTX *mem_ctx, struct ldb_context *
 		
 		if (ret_domain == 0) {
 			DEBUG(3,("check_sam_security: Couldn't find domain [%s] in passdb file.\n",
-				 ldb_dn_linearize(msgs_tmp, msgs_tmp[0]->dn)));
+				 ldb_dn_get_linearized(msgs_tmp[0]->dn)));
 			return NT_STATUS_NO_SUCH_USER;
 		}
 		
 		if (ret_domain > 1) {
 			DEBUG(0,("Found %d records matching domain [%s]\n", 
-				 ret_domain, ldb_dn_linearize(msgs_tmp, msgs_tmp[0]->dn)));
+				 ret_domain, ldb_dn_get_linearized(msgs_tmp[0]->dn)));
 			return NT_STATUS_INTERNAL_DB_CORRUPTION;
 		}
 
diff --git a/source4/auth/credentials/credentials_files.c b/source4/auth/credentials/credentials_files.c
index 1cbc9d9c15..a0ce4a2fd1 100644
--- a/source4/auth/credentials/credentials_files.c
+++ b/source4/auth/credentials/credentials_files.c
@@ -434,7 +434,7 @@ NTSTATUS cli_credentials_update_all_keytabs(TALLOC_CTX *parent_ctx)
 			return NT_STATUS_NO_MEMORY;
 		}
 		cli_credentials_set_conf(creds);
-		filter = talloc_asprintf(mem_ctx, "dn=%s", ldb_dn_linearize(mem_ctx, msgs[i]->dn));
+		filter = talloc_asprintf(mem_ctx, "dn=%s", ldb_dn_get_linearized(msgs[i]->dn));
 		status = cli_credentials_set_secrets(creds, NULL, filter);
 		if (!NT_STATUS_IS_OK(status)) {
 			DEBUG(1, ("Failed to read secrets for keytab update for %s\n", 
diff --git a/source4/auth/gensec/schannel_state.c b/source4/auth/gensec/schannel_state.c
index 7ba35abd19..4969e9aeaa 100644
--- a/source4/auth/gensec/schannel_state.c
+++ b/source4/auth/gensec/schannel_state.c
@@ -127,7 +127,7 @@ NTSTATUS schannel_store_session_key_ldb(TALLOC_CTX *mem_ctx,
 
 	if (ret != 0) {
 		DEBUG(0,("Unable to add %s to session key db - %s\n", 
-			 ldb_dn_linearize(msg, msg->dn), ldb_errstring(ldb)));
+			 ldb_dn_get_linearized(msg->dn), ldb_errstring(ldb)));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
 
diff --git a/source4/auth/sam.c b/source4/auth/sam.c
index 34ce34540a..a44eb9017e 100644
--- a/source4/auth/sam.c
+++ b/source4/auth/sam.c
@@ -209,7 +209,7 @@ _PUBLIC_ NTSTATUS authsam_make_server_info(TALLOC_CTX *mem_ctx, struct ldb_conte
 	group_ret = gendb_search(sam_ctx,
 				 tmp_ctx, NULL, &group_msgs, group_attrs,
 				 "(&(member=%s)(sAMAccountType=*))", 
-				 ldb_dn_linearize(tmp_ctx, msg->dn));
+				 ldb_dn_get_linearized(msg->dn));
 	if (group_ret == -1) {
 		talloc_free(tmp_ctx);
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -336,7 +336,7 @@ _PUBLIC_ NTSTATUS sam_get_results_principal(struct ldb_context *sam_ctx,
 	
 	/* grab domain info from the reference */
 	ret = gendb_search(sam_ctx, tmp_ctx, partitions_basedn, msgs_domain_ref, domain_ref_attrs,
-			   "(ncName=%s)", ldb_dn_linearize(tmp_ctx, domain_dn));
+			   "(ncName=%s)", ldb_dn_get_linearized(domain_dn));
 
 	if (ret != 1) {
 		talloc_free(tmp_ctx);
diff --git a/source4/cldap_server/netlogon.c b/source4/cldap_server/netlogon.c
index 6de505659f..2ee1391ebd 100644
--- a/source4/cldap_server/netlogon.c
+++ b/source4/cldap_server/netlogon.c
@@ -87,12 +87,12 @@ static NTSTATUS cldapd_netlogon_fill(struct cldapd_server *cldapd,
 					 LDB_SCOPE_BASE, "objectClass=domain", 
 					 dom_attrs, &dom_ldb_result);
 			if (ret != LDB_SUCCESS) {
-				DEBUG(2,("Error finding domain '%s'/'%s' in sam: %s\n", domain, ldb_dn_linearize(mem_ctx, dom_dn), ldb_errstring(cldapd->samctx)));
+				DEBUG(2,("Error finding domain '%s'/'%s' in sam: %s\n", domain, ldb_dn_get_linearized(dom_dn), ldb_errstring(cldapd->samctx)));
 				return NT_STATUS_NO_SUCH_DOMAIN;
 			}
 			talloc_steal(mem_ctx, dom_ldb_result);
 			if (dom_ldb_result->count != 1) {
-				DEBUG(2,("Error finding domain '%s'/'%s' in sam\n", domain, ldb_dn_linearize(mem_ctx, dom_dn)));
+				DEBUG(2,("Error finding domain '%s'/'%s' in sam\n", domain, ldb_dn_get_linearized(dom_dn)));
 				return NT_STATUS_NO_SUCH_DOMAIN;
 			}
 			dom_res = dom_ldb_result->msgs;
@@ -108,10 +108,10 @@ static NTSTATUS cldapd_netlogon_fill(struct cldapd_server *cldapd,
 			/* try and find the domain */
 			ret = gendb_search(cldapd->samctx, mem_ctx, partitions_basedn, &ref_res, ref_attrs, 
 					   "(&(objectClass=crossRef)(ncName=%s))", 
-					   ldb_dn_linearize(mem_ctx, dom_res[0]->dn));
+					   ldb_dn_get_linearized(dom_res[0]->dn));
 			if (ret != 1) {
 				DEBUG(2,("Unable to find referece to '%s' in sam\n",
-					 ldb_dn_linearize(mem_ctx, dom_res[0]->dn)));
+					 ldb_dn_get_linearized(dom_res[0]->dn)));
 				return NT_STATUS_NO_SUCH_DOMAIN;
 			}
 		}
diff --git a/source4/cldap_server/rootdse.c b/source4/cldap_server/rootdse.c
index 0690e8769a..e40f6e00a4 100644
--- a/source4/cldap_server/rootdse.c
+++ b/source4/cldap_server/rootdse.c
@@ -107,7 +107,7 @@ static void cldapd_rootdse_fill(struct cldapd_server *cldapd,
 		ent = talloc(mem_ctx, struct ldap_SearchResEntry);
 		if (ent == NULL) goto nomem;
 
-		ent->dn = ldb_dn_linearize(ent, res->msgs[0]->dn);
+		ent->dn = ldb_dn_alloc_linearized(ent, res->msgs[0]->dn);
 		if (ent->dn == NULL) goto nomem;
 		ent->num_attributes = 0;
 		ent->attributes = NULL;
diff --git a/source4/dsdb/samdb/cracknames.c b/source4/dsdb/samdb/cracknames.c
index 16aa616983..64bc812022 100644
--- a/source4/dsdb/samdb/cracknames.c
+++ b/source4/dsdb/samdb/cracknames.c
@@ -73,7 +73,7 @@ static enum drsuapi_DsNameStatus LDB_lookup_spn_alias(krb5_context context, stru
 	if ( ! ldb_dn_add_base(service_dn, samdb_base_dn(ldb_ctx))) {
 		return DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 	}
-	service_dn_str = ldb_dn_linearize(tmp_ctx, service_dn);
+	service_dn_str = ldb_dn_alloc_linearized(tmp_ctx, service_dn);
 	if ( ! service_dn_str) {
 		return DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 	}
@@ -637,7 +637,7 @@ static WERROR DsCrackNameOneFilter(struct ldb_context *sam_ctx, TALLOC_CTX *mem_
 				       "%s", domain_filter);
 	} else {
 		ldb_ret = gendb_search(sam_ctx, mem_ctx, partitions_basedn, &domain_res, domain_attrs,
-				       "(ncName=%s)", ldb_dn_linearize(mem_ctx, samdb_base_dn(sam_ctx)));
+				       "(ncName=%s)", ldb_dn_get_linearized(samdb_base_dn(sam_ctx)));
 	} 
 
 	switch (ldb_ret) {
@@ -701,7 +701,7 @@ static WERROR DsCrackNameOneFilter(struct ldb_context *sam_ctx, TALLOC_CTX *mem_
 	/* here we can use result_res[0] and domain_res[0] */
 	switch (format_desired) {
 	case DRSUAPI_DS_NAME_FORMAT_FQDN_1779: {
-		info1->result_name	= ldb_dn_linearize(mem_ctx, result_res[0]->dn);
+		info1->result_name	= ldb_dn_alloc_linearized(mem_ctx, result_res[0]->dn);
 		W_ERROR_HAVE_NO_MEMORY(info1->result_name);
 
 		info1->status		= DRSUAPI_DS_NAME_STATUS_OK;
@@ -730,7 +730,7 @@ static WERROR DsCrackNameOneFilter(struct ldb_context *sam_ctx, TALLOC_CTX *mem_
 
 		if (sid->num_auths == 4) {
 			ldb_ret = gendb_search(sam_ctx, mem_ctx, partitions_basedn, &domain_res, domain_attrs,
-					       "(ncName=%s)", ldb_dn_linearize(mem_ctx, result_res[0]->dn));
+					       "(ncName=%s)", ldb_dn_get_linearized(result_res[0]->dn));
 			if (ldb_ret != 1) {
 				info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 				return WERR_OK;
@@ -753,7 +753,7 @@ static WERROR DsCrackNameOneFilter(struct ldb_context *sam_ctx, TALLOC_CTX *mem_
 				return WERR_OK;
 			}
 			ldb_ret = gendb_search(sam_ctx, mem_ctx, partitions_basedn, &domain_res2, domain_attrs,
-					       "(ncName=%s)", ldb_dn_linearize(mem_ctx, domain_res[0]->dn));
+					       "(ncName=%s)", ldb_dn_get_linearized(domain_res[0]->dn));
 			if (ldb_ret != 1) {
 				info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 				return WERR_OK;
diff --git a/source4/dsdb/samdb/ldb_modules/entryUUID.c b/source4/dsdb/samdb/ldb_modules/entryUUID.c
index 2bc97f2040..42aa53ca64 100644
--- a/source4/dsdb/samdb/ldb_modules/entryUUID.c
+++ b/source4/dsdb/samdb/ldb_modules/entryUUID.c
@@ -122,7 +122,7 @@ static struct ldb_val objectCategory_always_dn(struct ldb_module *module, TALLOC
 
 	for (i=0; list && (i < list->count); i++) {
 		if (ldb_attr_cmp((const char *)val->data, ldb_msg_find_attr_as_string(list->msgs[i], "lDAPDisplayName", NULL)) == 0) {
-			char *dn = ldb_dn_linearize(ctx, list->msgs[i]->dn);
+			char *dn = ldb_dn_alloc_linearized(ctx, list->msgs[i]->dn);
 			return data_blob_string_const(dn);
 		}
 	}
diff --git a/source4/dsdb/samdb/ldb_modules/extended_dn.c b/source4/dsdb/samdb/ldb_modules/extended_dn.c
index 012ac74514..a571857bbb 100644
--- a/source4/dsdb/samdb/ldb_modules/extended_dn.c
+++ b/source4/dsdb/samdb/ldb_modules/extended_dn.c
@@ -107,11 +107,7 @@ static BOOL inject_extended_dn(struct ldb_message *msg,
 	struct dom_sid *sid;
 	char *object_guid;
 	char *object_sid;
-	char *new_dn, *dn;
-
-	dn = ldb_dn_linearize(msg, msg->dn);
-	if (!dn)
-		return False;
+	char *new_dn;
 
 	/* retrieve object_guid */
 	guid = samdb_result_guid(msg, "objectGUID");
@@ -140,10 +136,12 @@ static BOOL inject_extended_dn(struct ldb_message *msg,
 		case 1:
 			if (object_sid) {
 				new_dn = talloc_asprintf(msg, "<GUID=%s>;<SID=%s>;%s",
-							 object_guid, object_sid, dn);
+							 object_guid, object_sid,
+							 ldb_dn_get_linearized(msg->dn));
 			} else {
 				new_dn = talloc_asprintf(msg, "<GUID=%s>;%s",
-							 object_guid, dn);
+							 object_guid,
+							 ldb_dn_get_linearized(msg->dn));
 			}
 			break;
 		default:
diff --git a/source4/dsdb/samdb/ldb_modules/local_password.c b/source4/dsdb/samdb/ldb_modules/local_password.c
index 57323d859f..9e1cdd32b3 100644
--- a/source4/dsdb/samdb/ldb_modules/local_password.c
+++ b/source4/dsdb/samdb/ldb_modules/local_password.c
@@ -160,7 +160,7 @@ static int local_password_add(struct ldb_module *module, struct ldb_request *req
 	if (!ldb_msg_check_string_attribute(req->op.add.message, "objectClass", "person")) {
 		ldb_asprintf_errstring(module->ldb,
 					"Cannot relocate a password on entry: %s, does not have objectClass 'person'",
-					ldb_dn_linearize(req, req->op.add.message->dn));
+					ldb_dn_get_linearized(req->op.add.message->dn));
 		return LDB_ERR_OBJECT_CLASS_VIOLATION;
 	}
 
@@ -428,7 +428,7 @@ static int local_password_mod_local(struct ldb_handle *h) {
 	if (!ac->search_res) {
 		ldb_asprintf_errstring(ac->module->ldb, 
 					"entry just modified (%s) not found!",
-					ldb_dn_linearize(ac, ac->remote_req->op.mod.message->dn));
+					ldb_dn_get_linearized(ac->remote_req->op.mod.message->dn));
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 	if (!ldb_msg_check_string_attribute(ac->search_res->message, "objectClass", "person")) {
diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c
index b25beb7a8f..38a44bdae2 100644
--- a/source4/dsdb/samdb/ldb_modules/password_hash.c
+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c
@@ -160,7 +160,7 @@ static int add_krb5_keys_from_password(struct ldb_module *module, struct ldb_mes
 			ldb_asprintf_errstring(module->ldb,
 						"password_hash_handle: "
 						"generation of new kerberos keys failed: %s is a computer without a samAccountName",
-						ldb_dn_linearize(msg, msg->dn));
+						ldb_dn_get_linearized(msg->dn));
 			return LDB_ERR_OPERATIONS_ERROR;
 		}
 		if (name[strlen(name)-1] == '$') {
@@ -191,7 +191,7 @@ static int add_krb5_keys_from_password(struct ldb_module *module, struct ldb_mes
 			ldb_asprintf_errstring(module->ldb,
 						"password_hash_handle: "
 						"generation of new kerberos keys failed: %s has no samAccountName",
-						ldb_dn_linearize(msg, msg->dn));
+						ldb_dn_get_linearized(msg->dn));
 			return LDB_ERR_OPERATIONS_ERROR;
 		}
 		krb5_ret = krb5_make_principal(smb_krb5_context->krb5_context,
diff --git a/source4/dsdb/samdb/ldb_modules/proxy.c b/source4/dsdb/samdb/ldb_modules/proxy.c
index 41fe8b68c9..0dd5ee1e3d 100644
--- a/source4/dsdb/samdb/ldb_modules/proxy.c
+++ b/source4/dsdb/samdb/ldb_modules/proxy.c
@@ -285,7 +285,7 @@ static int proxy_search_bytree(struct ldb_module *module, struct ldb_request *re
 	ldb_dn_add_base(base, proxy->olddn);
 
 	ldb_debug(module->ldb, LDB_DEBUG_FATAL, "proxying: '%s' with dn '%s' \n", 
-		  ldb_filter_from_tree(proxy, newreq->op.search.tree), ldb_dn_linearize(proxy, newreq->op.search.base));
+		  ldb_filter_from_tree(proxy, newreq->op.search.tree), ldb_dn_get_linearized(newreq->op.search.base));
 	for (i = 0; req->op.search.attrs && req->op.search.attrs[i]; i++) {
 		ldb_debug(module->ldb, LDB_DEBUG_FATAL, "attr: '%s'\n", req->op.search.attrs[i]);
 	}
@@ -313,7 +313,7 @@ static int proxy_search_bytree(struct ldb_module *module, struct ldb_request *re
 
 failed:
 	ldb_debug(module->ldb, LDB_DEBUG_TRACE, "proxy failed for %s\n", 
-		  ldb_dn_linearize(proxy, req->op.search.base));
+		  ldb_dn_get_linearized(req->op.search.base));
 
 passthru:
 	return ldb_next_request(module, req); 
diff --git a/source4/dsdb/samdb/ldb_modules/rootdse.c b/source4/dsdb/samdb/ldb_modules/rootdse.c
index e073c8f89b..86e97f9cfb 100644
--- a/source4/dsdb/samdb/ldb_modules/rootdse.c
+++ b/source4/dsdb/samdb/ldb_modules/rootdse.c
@@ -86,7 +86,7 @@ static int rootdse_add_dynamic(struct ldb_module *module, struct ldb_message *ms
 		for (i = 0; i < priv->num_partitions; i++) {
 			struct ldb_dn *dn = priv->partitions[i];
 			if (ldb_msg_add_steal_string(msg, "namingContexts",
-						     ldb_dn_linearize(msg, dn)) != 0) {
+						     ldb_dn_alloc_linearized(msg, dn)) != 0) {
 				goto failed;
  			}
  		}
diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index 667b0d5ca8..c62c7dcf71 100644
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -139,7 +139,7 @@ static int samldb_find_next_rid(struct ldb_module *module, TALLOC_CTX *mem_ctx,
 	if (str == NULL) {
 		ldb_asprintf_errstring(module->ldb,
 					"attribute nextRid not found in %s\n",
-					ldb_dn_linearize(res, dn));
+					ldb_dn_get_linearized(dn));
 		talloc_free(res);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
@@ -239,7 +239,7 @@ static int samldb_get_new_sid(struct ldb_module *module,
 	if (dom_dn == NULL) {
 		ldb_asprintf_errstring(module->ldb,
 					"Invalid dn (%s) not child of a domain object!\n",
-					ldb_dn_linearize(mem_ctx, obj_dn));
+					ldb_dn_get_linearized(obj_dn));
 		return LDB_ERR_CONSTRAINT_VIOLATION;
 	}
 
@@ -249,7 +249,7 @@ static int samldb_get_new_sid(struct ldb_module *module,
 	if (ret != LDB_SUCCESS) {
 		ldb_asprintf_errstring(module->ldb,
 					"samldb_get_new_sid: error retrieving domain sid from %s: %s!\n",
-					ldb_dn_linearize(mem_ctx, dom_dn),
+					ldb_dn_get_linearized(dom_dn),
 					ldb_errstring(module->ldb));
 		talloc_free(res);
 		return ret;
@@ -258,7 +258,7 @@ static int samldb_get_new_sid(struct ldb_module *module,
 	if (res->count != 1) {
 		ldb_asprintf_errstring(module->ldb,
 					"samldb_get_new_sid: error retrieving domain sid from %s: not found!\n",
-					ldb_dn_linearize(mem_ctx, dom_dn));
+					ldb_dn_get_linearized(dom_dn));
 		talloc_free(res);
 		return LDB_ERR_CONSTRAINT_VIOLATION;
 	}
@@ -273,7 +273,7 @@ static int samldb_get_new_sid(struct ldb_module *module,
 	/* allocate a new Rid for the domain */
 	ret = samldb_allocate_next_rid(module, mem_ctx, dom_dn, dom_sid, sid);
 	if (ret != 0) {
-		ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Failed to increment nextRid of %s: %s\n", ldb_dn_linearize(mem_ctx, dom_dn), ldb_errstring(module->ldb));
+		ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Failed to increment nextRid of %s: %s\n", ldb_dn_get_linearized(dom_dn), ldb_errstring(module->ldb));
 		talloc_free(res);
 		return ret;
 	}
diff --git a/source4/dsdb/samdb/samdb.c b/source4/dsdb/samdb/samdb.c
index 4439335ca5..da04be1dbb 100644
--- a/source4/dsdb/samdb/samdb.c
+++ b/source4/dsdb/samdb/samdb.c
@@ -1194,8 +1194,8 @@ _PUBLIC_ NTSTATUS samdb_set_password(struct ldb_context *ctx, TALLOC_CTX *mem_ct
 		count = gendb_search_dn(ctx, mem_ctx, domain_dn, &res, domain_attrs);
 		if (count != 1) {
 			DEBUG(2, ("samdb_set_password: Domain DN %s is invalid, for user %s\n", 
-				  ldb_dn_linearize(mem_ctx, domain_dn),
-				  ldb_dn_linearize(mem_ctx, user_dn)));
+				  ldb_dn_get_linearized(domain_dn),
+				  ldb_dn_get_linearized(user_dn)));
 			return NT_STATUS_NO_SUCH_DOMAIN;
 		}
 	} else {
@@ -1211,7 +1211,7 @@ _PUBLIC_ NTSTATUS samdb_set_password(struct ldb_context *ctx, TALLOC_CTX *mem_ct
 		if (count != 1) {
 			DEBUG(2, ("samdb_set_password: Could not find domain to match SID: %s, for user %s\n", 
 				  dom_sid_string(mem_ctx, domain_sid),
-				  ldb_dn_linearize(mem_ctx, user_dn)));
+				  ldb_dn_get_linearized(user_dn)));
 			return NT_STATUS_NO_SUCH_DOMAIN;
 		}
 	}
@@ -1435,7 +1435,7 @@ _PUBLIC_ NTSTATUS samdb_set_password_sid(struct ldb_context *ctx, TALLOC_CTX *me
 	ret = ldb_transaction_commit(ctx);
 	if (ret != 0) {
 		DEBUG(0,("Failed to commit transaction to change password on %s: %s\n",
-			 ldb_dn_linearize(mem_ctx, msg->dn),
+			 ldb_dn_get_linearized(msg->dn),
 			 ldb_errstring(ctx)));
 		return NT_STATUS_TRANSACTION_ABORTED;
 	}
@@ -1565,7 +1565,7 @@ NTSTATUS samdb_create_foreign_security_principal(struct ldb_context *sam_ctx, TA
 	if (ret != 0) {
 		DEBUG(0,("Failed to create foreignSecurityPrincipal "
 			 "record %s: %s\n", 
-			 ldb_dn_linearize(mem_ctx, msg->dn),
+			 ldb_dn_get_linearized(msg->dn),
 			 ldb_errstring(sam_ctx)));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
diff --git a/source4/kdc/hdb-ldb.c b/source4/kdc/hdb-ldb.c
index fd6ebfbe1b..7ba9a4692e 100644
--- a/source4/kdc/hdb-ldb.c
+++ b/source4/kdc/hdb-ldb.c
@@ -719,7 +719,7 @@ static krb5_error_code LDB_fetch_server(krb5_context context, HDB *db,
 		
 		ldb_ret = gendb_search((struct ldb_context *)db->hdb_db,
 				       mem_ctx, partitions_basedn, &realm_ref_msg, realm_ref_attrs, 
-				       "ncName=%s", ldb_dn_linearize(mem_ctx, domain_dn));
+				       "ncName=%s", ldb_dn_get_linearized(domain_dn));
 		
 		if (ldb_ret != 1) {
 			return HDB_ERR_NOENTRY;
diff --git a/source4/kdc/kpasswdd.c b/source4/kdc/kpasswdd.c
index 6bc10cdced..d6ced4587a 100644
--- a/source4/kdc/kpasswdd.c
+++ b/source4/kdc/kpasswdd.c
@@ -372,7 +372,7 @@ static BOOL kpasswd_process_request(struct kdc_server *kdc,
 			ret = samdb_replace(samdb, mem_ctx, msg);
 			if (ret != 0) {
 				DEBUG(2,("Failed to modify record to set password on %s: %s\n",
-					 ldb_dn_linearize(mem_ctx, msg->dn),
+					 ldb_dn_get_linearized(msg->dn),
 					 ldb_errstring(samdb)));
 				status = NT_STATUS_ACCESS_DENIED;
 			}
@@ -381,7 +381,7 @@ static BOOL kpasswd_process_request(struct kdc_server *kdc,
 			ret = ldb_transaction_commit(samdb);
 			if (ret != 0) {
 				DEBUG(1,("Failed to commit transaction to set password on %s: %s\n",
-					 ldb_dn_linearize(mem_ctx, msg->dn),
+					 ldb_dn_get_linearized(msg->dn),
 					 ldb_errstring(samdb)));
 				status = NT_STATUS_TRANSACTION_ABORTED;
 			}
diff --git a/source4/ldap_server/ldap_backend.c b/source4/ldap_server/ldap_backend.c
index de99280ded..aaa8e453ca 100644
--- a/source4/ldap_server/ldap_backend.c
+++ b/source4/ldap_server/ldap_backend.c
@@ -249,7 +249,7 @@ static NTSTATUS ldapsrv_SearchRequest(struct ldapsrv_call *call)
 			NT_STATUS_HAVE_NO_MEMORY(ent_r);
 
 			ent = &ent_r->msg->r.SearchResultEntry;
-			ent->dn = ldb_dn_linearize(ent_r, res->msgs[i]->dn);
+			ent->dn = ldb_dn_alloc_linearized(ent_r, res->msgs[i]->dn);
 			ent->num_attributes = 0;
 			ent->attributes = NULL;
 			if (res->msgs[i]->num_elements == 0) {
diff --git a/source4/lib/gendb.c b/source4/lib/gendb.c
index 035ef01a8f..aa2130bb07 100644
--- a/source4/lib/gendb.c
+++ b/source4/lib/gendb.c
@@ -58,7 +58,7 @@ int gendb_search_v(struct ldb_context *ldb,
 		talloc_steal(mem_ctx, res->msgs);
 
 		DEBUG(6,("gendb_search_v: %s %s -> %d\n", 
-			 basedn?ldb_dn_linearize(mem_ctx,basedn):"NULL",
+			 basedn?ldb_dn_get_linearized(basedn):"NULL",
 			 expr?expr:"NULL", res->count));
 
 		ret = res->count;
diff --git a/source4/lib/ldb/common/attrib_handlers.c b/source4/lib/ldb/common/attrib_handlers.c
index 372793a103..c50f7ed7b1 100644
--- a/source4/lib/ldb/common/attrib_handlers.c
+++ b/source4/lib/ldb/common/attrib_handlers.c
@@ -239,7 +239,7 @@ static int ldb_canonicalise_dn(struct ldb_context *ldb, void *mem_ctx,
 		return -1;
 	}
 
-	out->data = (uint8_t *)ldb_dn_linearize(mem_ctx, dn);
+	out->data = (uint8_t *)ldb_dn_alloc_linearized(mem_ctx, dn);
 	if (out->data == NULL) {
 		goto done;
 	}
diff --git a/source4/lib/ldb/common/ldb_dn.c b/source4/lib/ldb/common/ldb_dn.c
index 0a10ed6f2e..8ee78ca06a 100644
--- a/source4/lib/ldb/common/ldb_dn.c
+++ b/source4/lib/ldb/common/ldb_dn.c
@@ -561,7 +561,7 @@ const char *ldb_dn_get_linearized(struct ldb_dn *dn)
 	return dn->linearized;
 }
 
-char *ldb_dn_linearize(void *mem_ctx, struct ldb_dn *dn)
+char *ldb_dn_alloc_linearized(void *mem_ctx, struct ldb_dn *dn)
 {
 	return talloc_strdup(mem_ctx, ldb_dn_get_linearized(dn));
 }
@@ -664,7 +664,7 @@ const char *ldb_dn_get_casefold(struct ldb_dn *dn)
 	return dn->casefold;
 }
 
-char *ldb_dn_casefold(void *mem_ctx, struct ldb_dn *dn)
+char *ldb_dn_alloc_casefold(void *mem_ctx, struct ldb_dn *dn)
 {
 	return talloc_strdup(mem_ctx, ldb_dn_get_casefold(dn));
 }
diff --git a/source4/lib/ldb/common/ldb_ldif.c b/source4/lib/ldb/common/ldb_ldif.c
index 50e9f5e590..86041a8b78 100644
--- a/source4/lib/ldb/common/ldb_ldif.c
+++ b/source4/lib/ldb/common/ldb_ldif.c
@@ -286,7 +286,7 @@ int ldb_ldif_write(struct ldb_context *ldb,
 
 	msg = ldif->msg;
 
-	ret = fprintf_fn(private_data, "dn: %s\n", ldb_dn_linearize(msg->dn, msg->dn));
+	ret = fprintf_fn(private_data, "dn: %s\n", ldb_dn_get_linearized(msg->dn));
 	CHECK_RET;
 
 	if (ldif->changetype != LDB_CHANGETYPE_NONE) {
diff --git a/source4/lib/ldb/common/ldb_msg.c b/source4/lib/ldb/common/ldb_msg.c
index 2768786b83..e9ba66aff5 100644
--- a/source4/lib/ldb/common/ldb_msg.c
+++ b/source4/lib/ldb/common/ldb_msg.c
@@ -626,7 +626,7 @@ int ldb_msg_sanity_check(struct ldb_context *ldb,
 				/* TODO: return also an error string */
 				ldb_asprintf_errstring(ldb, "Element %s has empty attribute in ldb message (%s)!",
 							    msg->elements[i].name, 
-							    ldb_dn_linearize(mem_ctx, msg->dn));
+							    ldb_dn_get_linearized(msg->dn));
 				talloc_free(mem_ctx);
 				return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
 			}
diff --git a/source4/lib/ldb/include/ldb.h b/source4/lib/ldb/include/ldb.h
index 46894cd3c0..c44c1d6ee7 100644
--- a/source4/lib/ldb/include/ldb.h
+++ b/source4/lib/ldb/include/ldb.h
@@ -1274,10 +1274,10 @@ struct ldb_dn *ldb_dn_new_fmt(void *mem_ctx, struct ldb_context *ldb, const char
 bool ldb_dn_validate(struct ldb_dn *dn);
 
 char *ldb_dn_escape_value(void *mem_ctx, struct ldb_val value);
-char *ldb_dn_linearize(void *mem_ctx, struct ldb_dn *dn);
-char *ldb_dn_casefold(void *mem_ctx, struct ldb_dn *dn);
 const char *ldb_dn_get_linearized(struct ldb_dn *dn);
 const char *ldb_dn_get_casefold(struct ldb_dn *dn);
+char *ldb_dn_alloc_linearized(void *mem_ctx, struct ldb_dn *dn);
+char *ldb_dn_alloc_casefold(void *mem_ctx, struct ldb_dn *dn);
 
 int ldb_dn_compare_base(struct ldb_dn *base, struct ldb_dn *dn);
 int ldb_dn_compare(struct ldb_dn *edn0, struct ldb_dn *edn1);
diff --git a/source4/lib/ldb/ldb_ildap/ldb_ildap.c b/source4/lib/ldb/ldb_ildap/ldb_ildap.c
index a4abd4d151..567fe4bd5f 100644
--- a/source4/lib/ldb/ldb_ildap/ldb_ildap.c
+++ b/source4/lib/ldb/ldb_ildap/ldb_ildap.c
@@ -452,7 +452,7 @@ static int ildb_search(struct ldb_module *module, struct ldb_request *req)
 	if (req->op.search.base == NULL) {
 		msg->r.SearchRequest.basedn = talloc_strdup(msg, "");
 	} else {
-		msg->r.SearchRequest.basedn  = ldb_dn_linearize(msg, req->op.search.base);
+		msg->r.SearchRequest.basedn  = ldb_dn_alloc_linearized(msg, req->op.search.base);
 	}
 	if (msg->r.SearchRequest.basedn == NULL) {
 		ldb_set_errstring(module->ldb, "Unable to determine baseDN");
@@ -504,7 +504,7 @@ static int ildb_add(struct ldb_module *module, struct ldb_request *req)
 
 	msg->type = LDAP_TAG_AddRequest;
 
-	msg->r.AddRequest.dn = ldb_dn_linearize(msg, req->op.add.message->dn);
+	msg->r.AddRequest.dn = ldb_dn_alloc_linearized(msg, req->op.add.message->dn);
 	if (msg->r.AddRequest.dn == NULL) {
 		talloc_free(msg);
 		return LDB_ERR_INVALID_DN_SYNTAX;
@@ -554,7 +554,7 @@ static int ildb_modify(struct ldb_module *module, struct ldb_request *req)
 
 	msg->type = LDAP_TAG_ModifyRequest;
 
-	msg->r.ModifyRequest.dn = ldb_dn_linearize(msg, req->op.mod.message->dn);
+	msg->r.ModifyRequest.dn = ldb_dn_alloc_linearized(msg, req->op.mod.message->dn);
 	if (msg->r.ModifyRequest.dn == NULL) {
 		talloc_free(msg);
 		return LDB_ERR_INVALID_DN_SYNTAX;
@@ -602,7 +602,7 @@ static int ildb_delete(struct ldb_module *module, struct ldb_request *req)
 
 	msg->type = LDAP_TAG_DelRequest;
 	
-	msg->r.DelRequest.dn = ldb_dn_linearize(msg, req->op.del.dn);
+	msg->r.DelRequest.dn = ldb_dn_alloc_linearized(msg, req->op.del.dn);
 	if (msg->r.DelRequest.dn == NULL) {
 		talloc_free(msg);
 		return LDB_ERR_INVALID_DN_SYNTAX;
@@ -632,7 +632,7 @@ static int ildb_rename(struct ldb_module *module, struct ldb_request *req)
 	}
 
 	msg->type = LDAP_TAG_ModifyDNRequest;
-	msg->r.ModifyDNRequest.dn = ldb_dn_linearize(msg, req->op.rename.olddn);
+	msg->r.ModifyDNRequest.dn = ldb_dn_alloc_linearized(msg, req->op.rename.olddn);
 	if (msg->r.ModifyDNRequest.dn == NULL) {
 		talloc_free(msg);
 		return LDB_ERR_INVALID_DN_SYNTAX;
@@ -648,8 +648,7 @@ static int ildb_rename(struct ldb_module *module, struct ldb_request *req)
 	}
 
 	msg->r.ModifyDNRequest.newsuperior =
-		ldb_dn_linearize(msg,
-				 ldb_dn_get_parent(msg, req->op.rename.newdn));
+		ldb_dn_alloc_linearized(msg, ldb_dn_get_parent(msg, req->op.rename.newdn));
 	if (msg->r.ModifyDNRequest.newsuperior == NULL) {
 		talloc_free(msg);
 		return LDB_ERR_INVALID_DN_SYNTAX;
diff --git a/source4/lib/ldb/ldb_ldap/ldb_ldap.c b/source4/lib/ldb/ldb_ldap/ldb_ldap.c
index ee2d818935..bfae566e3e 100644
--- a/source4/lib/ldb/ldb_ldap/ldb_ldap.c
+++ b/source4/lib/ldb/ldb_ldap/ldb_ldap.c
@@ -262,7 +262,7 @@ static int lldb_search(struct ldb_module *module, struct ldb_request *req)
 
 	lldb_ac = talloc_get_type(req->handle->private_data, struct lldb_context);
 
-	search_base = ldb_dn_linearize(lldb_ac, req->op.search.base);
+	search_base = ldb_dn_alloc_linearized(lldb_ac, req->op.search.base);
 	if (req->op.search.base == NULL) {
 		search_base = talloc_strdup(lldb_ac, "");
 	}
@@ -335,7 +335,7 @@ static int lldb_add(struct ldb_module *module, struct ldb_request *req)
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	dn = ldb_dn_linearize(lldb_ac, req->op.add.message->dn);
+	dn = ldb_dn_alloc_linearized(lldb_ac, req->op.add.message->dn);
 	if (dn == NULL) {
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
@@ -380,7 +380,7 @@ static int lldb_modify(struct ldb_module *module, struct ldb_request *req)
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	dn = ldb_dn_linearize(lldb_ac, req->op.mod.message->dn);
+	dn = ldb_dn_alloc_linearized(lldb_ac, req->op.mod.message->dn);
 	if (dn == NULL) {
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
@@ -419,7 +419,7 @@ static int lldb_delete(struct ldb_module *module, struct ldb_request *req)
 
 	lldb_ac = talloc_get_type(req->handle->private_data, struct lldb_context);
 
-	dnstr = ldb_dn_linearize(lldb_ac, req->op.del.dn);
+	dnstr = ldb_dn_alloc_linearized(lldb_ac, req->op.del.dn);
 
 	ret = ldap_delete_ext(lldb->ldap, dnstr,
 			      NULL,
@@ -457,7 +457,7 @@ static int lldb_rename(struct ldb_module *module, struct ldb_request *req)
 
 	lldb_ac = talloc_get_type(req->handle->private_data, struct lldb_context);
 
-	old_dn = ldb_dn_linearize(lldb_ac, req->op.rename.olddn);
+	old_dn = ldb_dn_alloc_linearized(lldb_ac, req->op.rename.olddn);
 	if (old_dn == NULL) {
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
@@ -469,7 +469,7 @@ static int lldb_rename(struct ldb_module *module, struct ldb_request *req)
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
 
-	parentdn = ldb_dn_linearize(lldb_ac, ldb_dn_get_parent(lldb_ac, req->op.rename.newdn));
+	parentdn = ldb_dn_alloc_linearized(lldb_ac, ldb_dn_get_parent(lldb_ac, req->op.rename.newdn));
 	if (!parentdn) {
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
diff --git a/source4/lib/ldb/ldb_sqlite3/ldb_sqlite3.c b/source4/lib/ldb/ldb_sqlite3/ldb_sqlite3.c
index 7671b0d954..4ea2eccded 100644
--- a/source4/lib/ldb/ldb_sqlite3/ldb_sqlite3.c
+++ b/source4/lib/ldb/ldb_sqlite3/ldb_sqlite3.c
@@ -369,8 +369,8 @@ static char *parsetree_to_sql(struct ldb_module *module,
 
 		} else if (strcasecmp(t->u.equality.attr, "dn") == 0) {
 			/* DN query is a special ldb case */
-		 	char *cdn = ldb_dn_casefold(mem_ctx,
-							ldb_dn_new(mem_ctx, module->ldb,
+		 	const char *cdn = ldb_dn_get_casefold(
+						ldb_dn_new(mem_ctx, module->ldb,
 							      (const char *)value.data));
 
 			return lsqlite3_tprintf(mem_ctx,
@@ -828,7 +828,7 @@ static long long lsqlite3_get_eid(struct ldb_module *module, struct ldb_dn *dn)
 		return -1;
 	}
 
-	cdn = ldb_dn_linearize(local_ctx, ldb_dn_casefold(module->ldb, local_ctx, dn));
+	cdn = ldb_dn_alloc_casefold(local_ctx, dn);
 	if (!cdn) goto done;
 
 	eid = lsqlite3_get_eid_ndn(lsqlite3->sqlite, local_ctx, cdn);
@@ -865,7 +865,7 @@ int lsql_search(struct ldb_module *module, struct ldb_request *req)
 		return LDB_ERR_OPERATIONS_ERROR;
 
 	if (req->op.search.base) {
-		norm_basedn = ldb_dn_linearize(lsql_ac, ldb_dn_casefold(module->ldb, lsql_ac, req->op.search.base));
+		norm_basedn = ldb_dn_alloc_casefold(lsql_ac, req->op.search.base);
 		if (norm_basedn == NULL) {
 			ret = LDB_ERR_INVALID_DN_SYNTAX;
 			goto failed;
@@ -1064,8 +1064,8 @@ static int lsql_add(struct ldb_module *module, struct ldb_request *req)
 	}
 
 	/* create linearized and normalized dns */
-	dn = ldb_dn_linearize(lsql_ac, msg->dn);
-	ndn = ldb_dn_linearize(lsql_ac, ldb_dn_casefold(module->ldb, lsql_ac, msg->dn));
+	dn = ldb_dn_alloc_linearized(lsql_ac, msg->dn);
+	ndn = ldb_dn_alloc_casefold(lsql_ac, msg->dn);
 	if (dn == NULL || ndn == NULL) {
 		ret = LDB_ERR_OTHER;
 		goto done;
@@ -1426,9 +1426,9 @@ static int lsql_rename(struct ldb_module *module, struct ldb_request *req)
 	req->handle->status = LDB_SUCCESS;
 
 	/* create linearized and normalized dns */
-	old_cdn = ldb_dn_linearize(lsql_ac, ldb_dn_casefold(module->ldb, lsql_ac, req->op.rename.olddn));
-	new_cdn = ldb_dn_linearize(lsql_ac, ldb_dn_casefold(module->ldb, lsql_ac, req->op.rename.newdn));
-	new_dn = ldb_dn_linearize(lsql_ac, req->op.rename.newdn);
+	old_cdn = ldb_dn_alloc_casefold(lsql_ac, req->op.rename.olddn);
+	new_cdn = ldb_dn_alloc_casefold(lsql_ac, req->op.rename.newdn);
+	new_dn = ldb_dn_alloc_linearized(lsql_ac, req->op.rename.newdn);
 	if (old_cdn == NULL || new_cdn == NULL || new_dn == NULL) {
 		goto done;
 	}
diff --git a/source4/lib/ldb/ldb_tdb/ldb_index.c b/source4/lib/ldb/ldb_tdb/ldb_index.c
index 874d047186..8b90604902 100644
--- a/source4/lib/ldb/ldb_tdb/ldb_index.c
+++ b/source4/lib/ldb/ldb_tdb/ldb_index.c
@@ -740,7 +740,7 @@ int ltdb_search_indexed(struct ldb_handle *handle)
 			ldb_oom(ac->module->ldb);
 			return -1;
 		}
-		dn_list->dn[0] = ldb_dn_linearize(dn_list, ac->base);
+		dn_list->dn[0] = ldb_dn_alloc_linearized(dn_list, ac->base);
 		if (dn_list->dn[0] == NULL) {
 			ldb_oom(ac->module->ldb);
 			return -1;
@@ -933,19 +933,16 @@ static int ltdb_index_add0(struct ldb_module *module, const char *dn,
 */
 int ltdb_index_add(struct ldb_module *module, const struct ldb_message *msg)
 {
-	struct ltdb_private *ltdb = module->private_data;
-	char *dn;
+	const char *dn;
 	int ret;
 
-	dn = ldb_dn_linearize(ltdb, msg->dn);
+	dn = ldb_dn_get_linearized(msg->dn);
 	if (dn == NULL) {
 		return -1;
 	}
 
 	ret = ltdb_index_add0(module, dn, msg->elements, msg->num_elements);
 
-	talloc_free(dn);
-
 	return ret;
 }
 
@@ -994,7 +991,7 @@ int ltdb_index_del_value(struct ldb_module *module, const char *dn,
 	if (i == -1) {
 		ldb_debug(ldb, LDB_DEBUG_ERROR,
 				"ERROR: dn %s not found in %s\n", dn,
-				ldb_dn_linearize(dn_key, dn_key));
+				ldb_dn_get_linearized(dn_key));
 		/* it ain't there. hmmm */
 		talloc_free(dn_key);
 		return 0;
@@ -1027,7 +1024,7 @@ int ltdb_index_del(struct ldb_module *module, const struct ldb_message *msg)
 {
 	struct ltdb_private *ltdb = module->private_data;
 	int ret;
-	char *dn;
+	const char *dn;
 	unsigned int i, j;
 
 	/* find the list of indexed fields */	
@@ -1040,7 +1037,7 @@ int ltdb_index_del(struct ldb_module *module, const struct ldb_message *msg)
 		return 0;
 	}
 
-	dn = ldb_dn_linearize(ltdb, msg->dn);
+	dn = ldb_dn_get_linearized(msg->dn);
 	if (dn == NULL) {
 		return -1;
 	}
@@ -1054,13 +1051,11 @@ int ltdb_index_del(struct ldb_module *module, const struct ldb_message *msg)
 		for (j = 0; j < msg->elements[i].num_values; j++) {
 			ret = ltdb_index_del_value(module, dn, &msg->elements[i], j);
 			if (ret == -1) {
-				talloc_free(dn);
 				return -1;
 			}
 		}
 	}
 
-	talloc_free(dn);
 	return 0;
 }
 
@@ -1084,7 +1079,7 @@ static int re_index(struct tdb_context *tdb, TDB_DATA key, TDB_DATA data, void *
 {
 	struct ldb_module *module = state;
 	struct ldb_message *msg;
-	char *dn = NULL;
+	const char *dn = NULL;
 	int ret;
 	TDB_DATA key2;
 
@@ -1110,7 +1105,7 @@ static int re_index(struct tdb_context *tdb, TDB_DATA key, TDB_DATA data, void *
 	if (key2.dptr == NULL) {
 		/* probably a corrupt record ... darn */
 		ldb_debug(module->ldb, LDB_DEBUG_ERROR, "Invalid DN in re_index: %s\n",
-							ldb_dn_linearize(msg, msg->dn));
+							ldb_dn_get_linearized(msg->dn));
 		talloc_free(msg);
 		return 0;
 	}
@@ -1123,7 +1118,7 @@ static int re_index(struct tdb_context *tdb, TDB_DATA key, TDB_DATA data, void *
 	if (msg->dn == NULL) {
 		dn = (char *)key.dptr + 3;
 	} else {
-		dn = ldb_dn_linearize(msg->dn, msg->dn);
+		dn = ldb_dn_get_linearized(msg->dn);
 	}
 
 	ret = ltdb_index_add0(module, dn, msg->elements, msg->num_elements);
diff --git a/source4/lib/ldb/ldb_tdb/ldb_pack.c b/source4/lib/ldb/ldb_tdb/ldb_pack.c
index 258c54356c..6a00fb13c7 100644
--- a/source4/lib/ldb/ldb_tdb/ldb_pack.c
+++ b/source4/lib/ldb/ldb_tdb/ldb_pack.c
@@ -85,11 +85,11 @@ int ltdb_pack_data(struct ldb_module *module,
 	struct ldb_context *ldb = module->ldb;
 	unsigned int i, j, real_elements=0;
 	size_t size;
-	char *dn;
+	const char *dn;
 	uint8_t *p;
 	size_t len;
 
-	dn = ldb_dn_linearize(ldb, message->dn);
+	dn = ldb_dn_get_linearized(message->dn);
 	if (dn == NULL) {
 		errno = ENOMEM;
 		return -1;
@@ -116,7 +116,6 @@ int ltdb_pack_data(struct ldb_module *module,
 	/* allocate it */
 	data->dptr = talloc_array(ldb, uint8_t, size);
 	if (!data->dptr) {
-		talloc_free(dn);
 		errno = ENOMEM;
 		return -1;
 	}
@@ -151,7 +150,6 @@ int ltdb_pack_data(struct ldb_module *module,
 		}
 	}
 
-	talloc_free(dn);
 	return 0;
 }
 
diff --git a/source4/lib/ldb/ldb_tdb/ldb_search.c b/source4/lib/ldb/ldb_tdb/ldb_search.c
index 3f04994ce4..5736b7684b 100644
--- a/source4/lib/ldb/ldb_tdb/ldb_search.c
+++ b/source4/lib/ldb/ldb_tdb/ldb_search.c
@@ -101,7 +101,7 @@ static int msg_add_distinguished_name(struct ldb_message *msg)
 	el.name = "distinguishedName";
 	el.num_values = 1;
 	el.values = &val;
-	val.data = (uint8_t *)ldb_dn_linearize(msg, msg->dn);
+	val.data = (uint8_t *)ldb_dn_alloc_linearized(msg, msg->dn);
 	val.length = strlen((char *)val.data);
 	
 	ret = msg_add_element(msg, &el, 1);
diff --git a/source4/lib/ldb/ldb_tdb/ldb_tdb.c b/source4/lib/ldb/ldb_tdb/ldb_tdb.c
index d950ab9cf0..9b05d98a66 100644
--- a/source4/lib/ldb/ldb_tdb/ldb_tdb.c
+++ b/source4/lib/ldb/ldb_tdb/ldb_tdb.c
@@ -123,7 +123,7 @@ struct TDB_DATA ltdb_key(struct ldb_module *module, struct ldb_dn *dn)
 	struct ldb_context *ldb = module->ldb;
 	TDB_DATA key;
 	char *key_str = NULL;
-	char *dn_folded = NULL;
+	const char *dn_folded = NULL;
 
 	/*
 	  most DNs are case insensitive. The exception is index DNs for
@@ -267,14 +267,7 @@ static int ltdb_add_internal(struct ldb_module *module, const struct ldb_message
 	ret = ltdb_store(module, msg, TDB_INSERT);
 
 	if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {
-		char *dn;
-
-		dn = ldb_dn_linearize(module, msg->dn);
-		if (!dn) {
-			return ret;
-		}
-		ldb_asprintf_errstring(module->ldb, "Entry %s already exists", dn);
-		talloc_free(dn);
+		ldb_asprintf_errstring(module->ldb, "Entry %s already exists", ldb_dn_get_linearized(msg->dn));
 		return ret;
 	}
 	
@@ -504,10 +497,10 @@ static int msg_delete_attribute(struct ldb_module *module,
 				struct ldb_context *ldb,
 				struct ldb_message *msg, const char *name)
 {
-	char *dn;
+	const char *dn;
 	unsigned int i, j;
 
-	dn = ldb_dn_linearize(ldb, msg->dn);
+	dn = ldb_dn_get_linearized(msg->dn);
 	if (dn == NULL) {
 		return -1;
 	}
@@ -532,7 +525,6 @@ static int msg_delete_attribute(struct ldb_module *module,
 		}
 	}
 
-	talloc_free(dn);
 	return 0;
 }
 
@@ -627,7 +619,7 @@ int ltdb_modify_internal(struct ldb_module *module, const struct ldb_message *ms
 		struct ldb_message_element *el = &msg->elements[i];
 		struct ldb_message_element *el2;
 		struct ldb_val *vals;
-		char *dn;
+		const char *dn;
 
 		switch (msg->elements[i].flags & LDB_FLAG_MOD_MASK) {
 
@@ -690,7 +682,7 @@ int ltdb_modify_internal(struct ldb_module *module, const struct ldb_message *ms
 
 		case LDB_FLAG_MOD_DELETE:
 
-			dn = ldb_dn_linearize(msg2, msg->dn);
+			dn = ldb_dn_get_linearized(msg->dn);
 			if (dn == NULL) {
 				ret = LDB_ERR_OTHER;
 				goto failed;
diff --git a/source4/lib/ldb/modules/ldb_map.c b/source4/lib/ldb/modules/ldb_map.c
index 05a0459b4a..6387ffc5b7 100644
--- a/source4/lib/ldb/modules/ldb_map.c
+++ b/source4/lib/ldb/modules/ldb_map.c
@@ -679,7 +679,7 @@ static struct ldb_val ldb_dn_convert_local(struct ldb_module *module, void *mem_
 	talloc_free(dn);
 
 	newval.length = 0;
-	newval.data = (uint8_t *)ldb_dn_linearize(mem_ctx, newdn);
+	newval.data = (uint8_t *)ldb_dn_alloc_linearized(mem_ctx, newdn);
 	if (newval.data) {
 		newval.length = strlen((char *)newval.data);
 	}
@@ -705,7 +705,7 @@ static struct ldb_val ldb_dn_convert_remote(struct ldb_module *module, void *mem
 	talloc_free(dn);
 
 	newval.length = 0;
-	newval.data = (uint8_t *)ldb_dn_linearize(mem_ctx, newdn);
+	newval.data = (uint8_t *)ldb_dn_alloc_linearized(mem_ctx, newdn);
 	if (newval.data) {
 		newval.length = strlen((char *)newval.data);
 	}
@@ -992,9 +992,9 @@ struct ldb_request *map_build_fixup_req(struct map_context *ac, struct ldb_dn *o
 	}
 
 	/* Update local 'IS_MAPPED' to the new remote DN */
-	msg->dn = discard_const_p(struct ldb_dn, olddn);
-	dn = ldb_dn_linearize(msg, newdn);
-	if (dn == NULL) {
+	msg->dn = ldb_dn_copy(msg, olddn);
+	dn = ldb_dn_alloc_linearized(msg, newdn);
+	if ( ! dn || ! ldb_dn_validate(msg->dn)) {
 		goto failed;
 	}
 	if (ldb_msg_add_empty(msg, IS_MAPPED, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
diff --git a/source4/lib/ldb/modules/ldb_map_inbound.c b/source4/lib/ldb/modules/ldb_map_inbound.c
index 38454b2b11..7e5583c9e2 100644
--- a/source4/lib/ldb/modules/ldb_map_inbound.c
+++ b/source4/lib/ldb/modules/ldb_map_inbound.c
@@ -297,7 +297,7 @@ int map_add(struct ldb_module *module, struct ldb_request *req)
 
 	/* Store remote DN in 'IS_MAPPED' */
 	/* TODO: use GUIDs here instead */
-	dn = ldb_dn_linearize(local, remote->dn);
+	dn = ldb_dn_alloc_linearized(local, remote->dn);
 	if (ldb_msg_add_string(local, IS_MAPPED, dn) != 0) {
 		goto failed;
 	}
@@ -344,10 +344,10 @@ int map_modify_do_local(struct ldb_handle *handle)
 
 		/* Add local 'IS_MAPPED' */
 		/* TODO: use GUIDs here instead */
-		dn = ldb_dn_linearize(msg, ac->remote_req->op.mod.message->dn);
 		if (ldb_msg_add_empty(msg, IS_MAPPED, LDB_FLAG_MOD_ADD, NULL) != 0) {
 			return LDB_ERR_OPERATIONS_ERROR;
 		}
+		dn = ldb_dn_alloc_linearized(msg, ac->remote_req->op.mod.message->dn);
 		if (ldb_msg_add_string(msg, IS_MAPPED, dn) != 0) {
 			return LDB_ERR_OPERATIONS_ERROR;
 		}
diff --git a/source4/lib/ldb/modules/ldb_map_outbound.c b/source4/lib/ldb/modules/ldb_map_outbound.c
index 6305e6666f..b1eb313060 100644
--- a/source4/lib/ldb/modules/ldb_map_outbound.c
+++ b/source4/lib/ldb/modules/ldb_map_outbound.c
@@ -1028,7 +1028,7 @@ int map_up_callback(struct ldb_context *ldb, const struct ldb_request *req, stru
 		ldb_debug(ldb, LDB_DEBUG_TRACE, "ldb_map: "
 			  "Skipping record '%s': "
 			  "doesn't match original search\n",
-			  ldb_dn_linearize(ldb, ares->message->dn));
+			  ldb_dn_get_linearized(ares->message->dn));
 		return LDB_SUCCESS;
 	}
 
diff --git a/source4/lib/ldb/modules/rdn_name.c b/source4/lib/ldb/modules/rdn_name.c
index bab5f6a014..0da8b8f573 100644
--- a/source4/lib/ldb/modules/rdn_name.c
+++ b/source4/lib/ldb/modules/rdn_name.c
@@ -119,7 +119,7 @@ static int rdn_name_add(struct ldb_module *module, struct ldb_request *req)
 		if (i == attribute->num_values) {
 			ldb_debug_set(module->ldb, LDB_DEBUG_FATAL, 
 				      "RDN mismatch on %s: %s (%s)", 
-				      ldb_dn_linearize(msg, msg->dn), rdn_name, rdn_val.data);
+				      ldb_dn_get_linearized(msg->dn), rdn_name, rdn_val.data);
 			talloc_free(down_req);
 			return LDB_ERR_OPERATIONS_ERROR;
 		}
diff --git a/source4/lib/ldb/tools/ldbadd.c b/source4/lib/ldb/tools/ldbadd.c
index 9595703e92..8e75bccacc 100644
--- a/source4/lib/ldb/tools/ldbadd.c
+++ b/source4/lib/ldb/tools/ldbadd.c
@@ -71,7 +71,7 @@ static int process_file(struct ldb_context *ldb, FILE *f, int *count)
 		ret = ldb_add(ldb, ldif->msg);
 		if (ret != LDB_SUCCESS) {
 			fprintf(stderr, "ERR: \"%s\" on DN %s\n", 
-				ldb_errstring(ldb), ldb_dn_linearize(ldb, ldif->msg->dn));
+				ldb_errstring(ldb), ldb_dn_get_linearized(ldif->msg->dn));
 			failures++;
 		} else {
 			(*count)++;
diff --git a/source4/lib/ldb/tools/ldbdel.c b/source4/lib/ldb/tools/ldbdel.c
index b4da806b51..c6c691d875 100644
--- a/source4/lib/ldb/tools/ldbdel.c
+++ b/source4/lib/ldb/tools/ldbdel.c
@@ -108,7 +108,7 @@ int main(int argc, const char **argv)
 		}
 		if (ret != 0) {
 			printf("delete of '%s' failed - %s\n",
-				ldb_dn_linearize(ldb, dn),
+				ldb_dn_get_linearized(dn),
 				ldb_errstring(ldb));
 		}
 	}
diff --git a/source4/lib/ldb/tools/ldbedit.c b/source4/lib/ldb/tools/ldbedit.c
index 429febb75b..2edbe34b6f 100644
--- a/source4/lib/ldb/tools/ldbedit.c
+++ b/source4/lib/ldb/tools/ldbedit.c
@@ -78,7 +78,7 @@ static int modify_record(struct ldb_context *ldb,
 
 	if (ldb_modify(ldb, mod) != 0) {
 		fprintf(stderr, "failed to modify %s - %s\n", 
-			ldb_dn_linearize(ldb, msg1->dn), ldb_errstring(ldb));
+			ldb_dn_get_linearized(msg1->dn), ldb_errstring(ldb));
 		return -1;
 	}
 
@@ -123,7 +123,7 @@ static int merge_edits(struct ldb_context *ldb,
 			}
 			if (ldb_add(ldb, msgs2[i]) != 0) {
 				fprintf(stderr, "failed to add %s - %s\n",
-					ldb_dn_linearize(ldb, msgs2[i]->dn),
+					ldb_dn_get_linearized(msgs2[i]->dn),
 					ldb_errstring(ldb));
 				return -1;
 			}
@@ -144,7 +144,7 @@ static int merge_edits(struct ldb_context *ldb,
 			}
 			if (ldb_delete(ldb, msgs1[i]->dn) != 0) {
 				fprintf(stderr, "failed to delete %s - %s\n",
-					ldb_dn_linearize(ldb, msgs1[i]->dn),
+					ldb_dn_get_linearized(msgs1[i]->dn),
 					ldb_errstring(ldb));
 				return -1;
 			}
diff --git a/source4/lib/ldb/tools/ldbmodify.c b/source4/lib/ldb/tools/ldbmodify.c
index 962045ef7d..cc7219a156 100644
--- a/source4/lib/ldb/tools/ldbmodify.c
+++ b/source4/lib/ldb/tools/ldbmodify.c
@@ -73,7 +73,7 @@ static int process_file(struct ldb_context *ldb, FILE *f, int *count)
 		}
 		if (ret != LDB_SUCCESS) {
 			fprintf(stderr, "ERR: \"%s\" on DN %s\n", 
-				ldb_errstring(ldb), ldb_dn_linearize(ldb, ldif->msg->dn));
+				ldb_errstring(ldb), ldb_dn_get_linearized(ldif->msg->dn));
 			failures++;
 		} else {
 			(*count)++;
diff --git a/source4/lib/ldb/tools/ldbtest.c b/source4/lib/ldb/tools/ldbtest.c
index 70b2b0148a..fbabd56878 100644
--- a/source4/lib/ldb/tools/ldbtest.c
+++ b/source4/lib/ldb/tools/ldbtest.c
@@ -322,7 +322,7 @@ static void start_test_index(struct ldb_context **ldb)
 	ldb_msg_add_string(msg, "@IDXATTR", strdup("uid"));
 
 	if (ldb_add(*ldb, msg) != 0) {
-		printf("Add of %s failed - %s\n", ldb_dn_linearize(*ldb, msg->dn), ldb_errstring(*ldb));
+		printf("Add of %s failed - %s\n", ldb_dn_get_linearized(msg->dn), ldb_errstring(*ldb));
 		exit(1);
 	}
 
@@ -337,7 +337,7 @@ static void start_test_index(struct ldb_context **ldb)
 	ldb_msg_add_string(msg, "objectClass", strdup("OpenLDAPperson"));
 
 	if (ldb_add(*ldb, msg) != 0) {
-		printf("Add of %s failed - %s\n", ldb_dn_linearize(*ldb, msg->dn), ldb_errstring(*ldb));
+		printf("Add of %s failed - %s\n", ldb_dn_get_linearized(msg->dn), ldb_errstring(*ldb));
 		exit(1);
 	}
 
diff --git a/source4/lib/registry/reg_backend_ldb.c b/source4/lib/registry/reg_backend_ldb.c
index 5f9481fa67..5d72eabfdd 100644
--- a/source4/lib/registry/reg_backend_ldb.c
+++ b/source4/lib/registry/reg_backend_ldb.c
@@ -176,7 +176,7 @@ static WERROR ldb_get_subkey_by_id(TALLOC_CTX *mem_ctx, const struct registry_ke
 		ret = ldb_search(c, kd->dn, LDB_SCOPE_ONELEVEL, "(key=*)", NULL, &res);
 
 		if (ret != LDB_SUCCESS) {
-			DEBUG(0, ("Error getting subkeys for '%s': %s\n", ldb_dn_linearize(mem_ctx, kd->dn), ldb_errstring(c)));
+			DEBUG(0, ("Error getting subkeys for '%s': %s\n", ldb_dn_get_linearized(kd->dn), ldb_errstring(c)));
 			return WERR_FOOBAR;
 		}
 
@@ -213,7 +213,7 @@ static WERROR ldb_get_value_by_id(TALLOC_CTX *mem_ctx, const struct registry_key
 		ret = ldb_search(c, kd->dn, LDB_SCOPE_ONELEVEL, "(value=*)", NULL, &res);
 
 		if (ret != LDB_SUCCESS) {
-			DEBUG(0, ("Error getting values for '%s': %s\n", ldb_dn_linearize(mem_ctx, kd->dn), ldb_errstring(c)));
+			DEBUG(0, ("Error getting values for '%s': %s\n", ldb_dn_get_linearized(kd->dn), ldb_errstring(c)));
 			return WERR_FOOBAR;
 		}
 		kd->value_count = res->count;
@@ -243,7 +243,7 @@ static WERROR ldb_open_key(TALLOC_CTX *mem_ctx, const struct registry_key *h, co
 	ret = ldb_search(c, ldap_path, LDB_SCOPE_BASE, "(key=*)", NULL, &res);
 
 	if (ret != LDB_SUCCESS) {
-		DEBUG(0, ("Error opening key '%s': %s\n", ldb_dn_linearize(ldap_path, ldap_path), ldb_errstring(c)));
+		DEBUG(0, ("Error opening key '%s': %s\n", ldb_dn_get_linearized(ldap_path), ldb_errstring(c)));
 		return WERR_FOOBAR;
 	} else if (res->count == 0) {
 		talloc_free(res);
diff --git a/source4/libnet/libnet_join.c b/source4/libnet/libnet_join.c
index e68b0d6235..ed98699804 100644
--- a/source4/libnet/libnet_join.c
+++ b/source4/libnet/libnet_join.c
@@ -324,7 +324,7 @@ static NTSTATUS libnet_JoinADSDomain(struct libnet_context *ctx, struct libnet_J
 			r->out.error_string
 				= talloc_asprintf(r, 
 						  "Failed to replace entries on %s", 
-						  ldb_dn_linearize(tmp_ctx, msg->dn));
+						  ldb_dn_get_linearized(msg->dn));
 			talloc_free(tmp_ctx);
 			return NT_STATUS_INTERNAL_DB_CORRUPTION;
 		}
@@ -1148,7 +1148,7 @@ static NTSTATUS libnet_Join_primary_domain(struct libnet_context *ctx,
 	ret = samdb_add(ldb, tmp_mem, msg);
 	if (ret != 0) {
 		r->out.error_string = talloc_asprintf(mem_ctx, "Failed to create secret record %s", 
-						      ldb_dn_linearize(ldb, msg->dn));
+						      ldb_dn_get_linearized(msg->dn));
 		talloc_free(tmp_mem);
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
@@ -1163,7 +1163,7 @@ static NTSTATUS libnet_Join_primary_domain(struct libnet_context *ctx,
 			return NT_STATUS_NO_MEMORY;
 		}
 		cli_credentials_set_conf(creds);
-		filter = talloc_asprintf(mem_ctx, "dn=%s", ldb_dn_linearize(mem_ctx, msg->dn));
+		filter = talloc_asprintf(mem_ctx, "dn=%s", ldb_dn_get_linearized(msg->dn));
 		status = cli_credentials_set_secrets(creds, NULL, filter);
 		if (!NT_STATUS_IS_OK(status)) {
 			r->out.error_string = talloc_asprintf(mem_ctx, "Failed to read secrets for keytab update for %s", 
diff --git a/source4/libnet/libnet_samsync_ldb.c b/source4/libnet/libnet_samsync_ldb.c
index 3c34aca944..3b4ba304e4 100644
--- a/source4/libnet/libnet_samsync_ldb.c
+++ b/source4/libnet/libnet_samsync_ldb.c
@@ -79,7 +79,7 @@ static NTSTATUS samsync_ldb_add_foreignSecurityPrincipal(TALLOC_CTX *mem_ctx,
 		*error_string = talloc_asprintf(mem_ctx, 
 						"Failed to find DN for "
 						"ForeignSecurityPrincipal container under %s",
-						ldb_dn_linearize(mem_ctx, state->base_dn[SAM_DATABASE_DOMAIN]));
+						ldb_dn_get_linearized(state->base_dn[SAM_DATABASE_DOMAIN]));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
 	
@@ -104,7 +104,7 @@ static NTSTATUS samsync_ldb_add_foreignSecurityPrincipal(TALLOC_CTX *mem_ctx,
 	if (ret != 0) {
 		*error_string = talloc_asprintf(mem_ctx, "Failed to create foreignSecurityPrincipal "
 						"record %s: %s",
-						ldb_dn_linearize(mem_ctx, msg->dn),
+						ldb_dn_get_linearized(msg->dn),
 						ldb_errstring(state->sam_ldb));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
@@ -298,7 +298,7 @@ static NTSTATUS samsync_ldb_handle_user(TALLOC_CTX *mem_ctx,
 			return NT_STATUS_INTERNAL_DB_CORRUPTION;
 		} else if (ret == 0) {
 			*error_string = talloc_asprintf(mem_ctx, "User exists in samsync but not in remote LDAP domain! (base: %s, SID: %s)", 
-							ldb_dn_linearize(mem_ctx, state->base_dn[database]),
+							ldb_dn_get_linearized(state->base_dn[database]),
 							dom_sid_string(mem_ctx, user_sid));
 			return NT_STATUS_NO_SUCH_USER;
 		} else if (ret > 1) {
@@ -436,8 +436,8 @@ static NTSTATUS samsync_ldb_handle_user(TALLOC_CTX *mem_ctx,
 			ret = samdb_add(state->sam_ldb, mem_ctx, msg);
 			if (ret != 0) {
 				*error_string = talloc_asprintf(mem_ctx, "Failed to create user record.  Tried both %s and %s: %s",
-								ldb_dn_linearize(mem_ctx, first_try_dn),
-								ldb_dn_linearize(mem_ctx, msg->dn),
+								ldb_dn_get_linearized(first_try_dn),
+								ldb_dn_get_linearized(msg->dn),
 								ldb_errstring(state->sam_ldb));
 				return NT_STATUS_INTERNAL_DB_CORRUPTION;
 			}
@@ -446,7 +446,7 @@ static NTSTATUS samsync_ldb_handle_user(TALLOC_CTX *mem_ctx,
 		ret = samdb_replace(state->sam_ldb, mem_ctx, msg);
 		if (ret != 0) {
 			*error_string = talloc_asprintf(mem_ctx, "Failed to modify user record %s: %s",
-							ldb_dn_linearize(mem_ctx, msg->dn),
+							ldb_dn_get_linearized(msg->dn),
 							ldb_errstring(state->sam_ldb));
 			return NT_STATUS_INTERNAL_DB_CORRUPTION;
 		}
@@ -488,7 +488,7 @@ static NTSTATUS samsync_ldb_delete_user(TALLOC_CTX *mem_ctx,
 	ret = samdb_delete(state->sam_ldb, mem_ctx, msgs[0]->dn);
 	if (ret != 0) {
 		*error_string = talloc_asprintf(mem_ctx, "Failed to delete user record %s: %s",
-						ldb_dn_linearize(mem_ctx, msgs[0]->dn),
+						ldb_dn_get_linearized(msgs[0]->dn),
 						ldb_errstring(state->sam_ldb));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
@@ -577,7 +577,7 @@ static NTSTATUS samsync_ldb_handle_group(TALLOC_CTX *mem_ctx,
 		ret = samdb_add(state->sam_ldb, mem_ctx, msg);
 		if (ret != 0) {
 			*error_string = talloc_asprintf(mem_ctx, "Failed to create group record %s: %s",
-							ldb_dn_linearize(mem_ctx, msg->dn),
+							ldb_dn_get_linearized(msg->dn),
 							ldb_errstring(state->sam_ldb));
 			return NT_STATUS_INTERNAL_DB_CORRUPTION;
 		}
@@ -585,7 +585,7 @@ static NTSTATUS samsync_ldb_handle_group(TALLOC_CTX *mem_ctx,
 		ret = samdb_replace(state->sam_ldb, mem_ctx, msg);
 		if (ret != 0) {
 			*error_string = talloc_asprintf(mem_ctx, "Failed to modify group record %s: %s",
-							ldb_dn_linearize(mem_ctx, msg->dn),
+							ldb_dn_get_linearized(msg->dn),
 							ldb_errstring(state->sam_ldb));
 			return NT_STATUS_INTERNAL_DB_CORRUPTION;
 		}
@@ -627,7 +627,7 @@ static NTSTATUS samsync_ldb_delete_group(TALLOC_CTX *mem_ctx,
 	ret = samdb_delete(state->sam_ldb, mem_ctx, msgs[0]->dn);
 	if (ret != 0) {
 		*error_string = talloc_asprintf(mem_ctx, "Failed to delete group record %s: %s",
-						ldb_dn_linearize(mem_ctx, msgs[0]->dn),
+						ldb_dn_get_linearized(msgs[0]->dn),
 						ldb_errstring(state->sam_ldb));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
@@ -691,7 +691,7 @@ static NTSTATUS samsync_ldb_handle_group_member(TALLOC_CTX *mem_ctx,
 		} else if (ret > 1) {
 			return NT_STATUS_INTERNAL_DB_CORRUPTION;
 		} else {
-			samdb_msg_add_string(state->sam_ldb, mem_ctx, msg, "member", ldb_dn_linearize(mem_ctx, msgs[0]->dn));
+			samdb_msg_add_string(state->sam_ldb, mem_ctx, msg, "member", ldb_dn_alloc_linearized(mem_ctx, msgs[0]->dn));
 		}
 		
 		talloc_free(msgs);
@@ -700,7 +700,7 @@ static NTSTATUS samsync_ldb_handle_group_member(TALLOC_CTX *mem_ctx,
 	ret = samdb_replace(state->sam_ldb, mem_ctx, msg);
 	if (ret != 0) {
 		*error_string = talloc_asprintf(mem_ctx, "Failed to modify group record %s: %s",
-						ldb_dn_linearize(mem_ctx, msg->dn),
+						ldb_dn_get_linearized(msg->dn),
 						ldb_errstring(state->sam_ldb));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
@@ -791,7 +791,7 @@ static NTSTATUS samsync_ldb_handle_alias(TALLOC_CTX *mem_ctx,
 		ret = samdb_add(state->sam_ldb, mem_ctx, msg);
 		if (ret != 0) {
 			*error_string = talloc_asprintf(mem_ctx, "Failed to create alias record %s: %s",
-							ldb_dn_linearize(mem_ctx, msg->dn),
+							ldb_dn_get_linearized(msg->dn),
 							ldb_errstring(state->sam_ldb));
 			return NT_STATUS_INTERNAL_DB_CORRUPTION;
 		}
@@ -799,7 +799,7 @@ static NTSTATUS samsync_ldb_handle_alias(TALLOC_CTX *mem_ctx,
 		ret = samdb_replace(state->sam_ldb, mem_ctx, msg);
 		if (ret != 0) {
 			*error_string = talloc_asprintf(mem_ctx, "Failed to modify alias record %s: %s",
-							ldb_dn_linearize(mem_ctx, msg->dn),
+							ldb_dn_get_linearized(msg->dn),
 							ldb_errstring(state->sam_ldb));
 			return NT_STATUS_INTERNAL_DB_CORRUPTION;
 		}
@@ -836,7 +836,7 @@ static NTSTATUS samsync_ldb_delete_alias(TALLOC_CTX *mem_ctx,
 	ret = samdb_delete(state->sam_ldb, mem_ctx, msgs[0]->dn);
 	if (ret != 0) {
 		*error_string = talloc_asprintf(mem_ctx, "Failed to delete alias record %s: %s",
-						ldb_dn_linearize(mem_ctx, msgs[0]->dn),
+						ldb_dn_get_linearized(msgs[0]->dn),
 						ldb_errstring(state->sam_ldb));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
@@ -910,7 +910,7 @@ static NTSTATUS samsync_ldb_handle_alias_member(TALLOC_CTX *mem_ctx,
 		} else {
 			alias_member_dn = msgs[0]->dn;
 		}
-		samdb_msg_add_string(state->sam_ldb, mem_ctx, msg, "member", ldb_dn_linearize(mem_ctx, alias_member_dn));
+		samdb_msg_add_string(state->sam_ldb, mem_ctx, msg, "member", ldb_dn_alloc_linearized(mem_ctx, alias_member_dn));
 	
 		talloc_free(msgs);
 	}
@@ -918,7 +918,7 @@ static NTSTATUS samsync_ldb_handle_alias_member(TALLOC_CTX *mem_ctx,
 	ret = samdb_replace(state->sam_ldb, mem_ctx, msg);
 	if (ret != 0) {
 		*error_string = talloc_asprintf(mem_ctx, "Failed to modify group record %s: %s",
-						ldb_dn_linearize(mem_ctx, msg->dn),
+						ldb_dn_get_linearized(msg->dn),
 						ldb_errstring(state->sam_ldb));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
@@ -982,7 +982,7 @@ static NTSTATUS samsync_ldb_handle_account(TALLOC_CTX *mem_ctx,
 	ret = samdb_replace(state->sam_ldb, mem_ctx, msg);
 	if (ret != 0) {
 		*error_string = talloc_asprintf(mem_ctx, "Failed to modify privilege record %s",
-						ldb_dn_linearize(mem_ctx, msg->dn));
+						ldb_dn_get_linearized(msg->dn));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
 
@@ -1031,7 +1031,7 @@ static NTSTATUS samsync_ldb_delete_account(TALLOC_CTX *mem_ctx,
 	ret = samdb_replace(state->sam_ldb, mem_ctx, msg);
 	if (ret != 0) {
 		*error_string = talloc_asprintf(mem_ctx, "Failed to modify privilege record %s",
-						ldb_dn_linearize(mem_ctx, msg->dn));
+						ldb_dn_get_linearized(msg->dn));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
 
diff --git a/source4/nbt_server/dgram/netlogon.c b/source4/nbt_server/dgram/netlogon.c
index 3984d1f933..7b75426992 100644
--- a/source4/nbt_server/dgram/netlogon.c
+++ b/source4/nbt_server/dgram/netlogon.c
@@ -146,7 +146,7 @@ static void nbtd_netlogon_getdc2(struct dgram_mailslot_handler *dgmslot,
 			      &dom_res, dom_attrs);
 	if (ret != 1) {
 		DEBUG(2,("Unable to find domain from reference '%s' in sam\n",
-			 ldb_dn_linearize(samctx, ref_res[0]->dn)));
+			 ldb_dn_get_linearized(ref_res[0]->dn)));
 		return;
 	}
 
diff --git a/source4/nbt_server/wins/winsdb.c b/source4/nbt_server/wins/winsdb.c
index 7b0a0756c6..748b489c67 100644
--- a/source4/nbt_server/wins/winsdb.c
+++ b/source4/nbt_server/wins/winsdb.c
@@ -751,7 +751,7 @@ NTSTATUS winsdb_record(struct winsdb_handle *h, struct ldb_message *msg, TALLOC_
 	return NT_STATUS_OK;
 failed:
 	if (NT_STATUS_EQUAL(NT_STATUS_INTERNAL_DB_CORRUPTION, status)) {
-		DEBUG(1,("winsdb_record: corrupted record: %s\n", ldb_dn_linearize(rec, msg->dn)));
+		DEBUG(1,("winsdb_record: corrupted record: %s\n", ldb_dn_get_linearized(msg->dn)));
 	}
 	talloc_free(rec);
 	return status;
diff --git a/source4/rpc_server/drsuapi/dcesrv_drsuapi.c b/source4/rpc_server/drsuapi/dcesrv_drsuapi.c
index b7a5b2d242..1eb106066b 100644
--- a/source4/rpc_server/drsuapi/dcesrv_drsuapi.c
+++ b/source4/rpc_server/drsuapi/dcesrv_drsuapi.c
@@ -311,7 +311,7 @@ static WERROR drsuapi_DsWriteAccountSpn(struct dcesrv_call_state *dce_call, TALL
 			ret = samdb_modify(b_state->sam_ctx, mem_ctx, msg);
 			if (ret != 0) {
 				DEBUG(0,("Failed to modify SPNs on %s: %s\n",
-					 ldb_dn_linearize(mem_ctx, msg->dn), 
+					 ldb_dn_get_linearized(msg->dn), 
 					 ldb_errstring(b_state->sam_ctx)));
 				r->out.res.res1.status = WERR_ACCESS_DENIED;
 			} else {
diff --git a/source4/rpc_server/lsa/dcesrv_lsa.c b/source4/rpc_server/lsa/dcesrv_lsa.c
index af67835d03..beae1e340a 100644
--- a/source4/rpc_server/lsa/dcesrv_lsa.c
+++ b/source4/rpc_server/lsa/dcesrv_lsa.c
@@ -338,7 +338,7 @@ static NTSTATUS lsa_get_policy_state(struct dcesrv_call_state *dce_call, TALLOC_
 	talloc_free(dom_res);
 
 	ref_filter = talloc_asprintf(state, "(&(objectclass=crossRef)(ncName=%s))", 
-				     ldb_dn_linearize(mem_ctx, state->domain_dn)); 
+				     ldb_dn_get_linearized(state->domain_dn)); 
 	if (!ref_filter) {
 		return NT_STATUS_NO_MEMORY;
 	}
@@ -829,7 +829,7 @@ static NTSTATUS lsa_CreateTrustedDomain(struct dcesrv_call_state *dce_call, TALL
 	
 	if (ret < 0 || ret > 1) {
 		DEBUG(0,("Found %d records matching DN %s\n", ret,
-			 ldb_dn_linearize(mem_ctx, policy_state->system_dn)));
+			 ldb_dn_get_linearized(policy_state->system_dn)));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
 	
@@ -858,7 +858,7 @@ static NTSTATUS lsa_CreateTrustedDomain(struct dcesrv_call_state *dce_call, TALL
 	ret = ldb_add(trusted_domain_state->policy->sam_ldb, msg);
 	if (ret != LDB_SUCCESS) {
 		DEBUG(0,("Failed to create trusted_domain record %s: %s\n",
-			 ldb_dn_linearize(mem_ctx, msg->dn), ldb_errstring(trusted_domain_state->policy->sam_ldb)));
+			 ldb_dn_get_linearized(msg->dn), ldb_errstring(trusted_domain_state->policy->sam_ldb)));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
 
@@ -922,7 +922,7 @@ static NTSTATUS lsa_OpenTrustedDomain(struct dcesrv_call_state *dce_call, TALLOC
 	
 	if (ret != 1) {
 		DEBUG(0,("Found %d records matching DN %s\n", ret,
-			 ldb_dn_linearize(mem_ctx, policy_state->system_dn)));
+			 ldb_dn_get_linearized(policy_state->system_dn)));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
 
@@ -988,7 +988,7 @@ static NTSTATUS lsa_OpenTrustedDomainByName(struct dcesrv_call_state *dce_call,
 	
 	if (ret != 1) {
 		DEBUG(0,("Found %d records matching DN %s\n", ret,
-			 ldb_dn_linearize(mem_ctx, policy_state->system_dn)));
+			 ldb_dn_get_linearized(policy_state->system_dn)));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
 
@@ -2004,7 +2004,7 @@ static NTSTATUS lsa_AddRemoveAccountRights(struct dcesrv_call_state *dce_call,
 		}
 		DEBUG(3, ("Could not %s attributes from %s: %s", 
 			  ldb_flag == LDB_FLAG_MOD_DELETE ? "delete" : "add",
-			  ldb_dn_linearize(mem_ctx, msg->dn), ldb_errstring(state->sam_ldb)));
+			  ldb_dn_get_linearized(msg->dn), ldb_errstring(state->sam_ldb)));
 		return NT_STATUS_UNEXPECTED_IO_ERROR;
 	}
 
@@ -2269,7 +2269,7 @@ static NTSTATUS lsa_CreateSecret(struct dcesrv_call_state *dce_call, TALLOC_CTX
 	ret = samdb_add(secret_state->sam_ldb, mem_ctx, msg);
 	if (ret != 0) {
 		DEBUG(0,("Failed to create secret record %s: %s\n",
-			 ldb_dn_linearize(mem_ctx, msg->dn), 
+			 ldb_dn_get_linearized(msg->dn), 
 			 ldb_errstring(secret_state->sam_ldb)));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
@@ -2344,7 +2344,7 @@ static NTSTATUS lsa_OpenSecret(struct dcesrv_call_state *dce_call, TALLOC_CTX *m
 		
 		if (ret != 1) {
 			DEBUG(0,("Found %d records matching DN %s\n", ret,
-				 ldb_dn_linearize(mem_ctx, policy_state->system_dn)));
+				 ldb_dn_get_linearized(policy_state->system_dn)));
 			return NT_STATUS_INTERNAL_DB_CORRUPTION;
 		}
 	
@@ -2369,7 +2369,7 @@ static NTSTATUS lsa_OpenSecret(struct dcesrv_call_state *dce_call, TALLOC_CTX *m
 		
 		if (ret != 1) {
 			DEBUG(0,("Found %d records matching DN %s\n", ret,
-				 ldb_dn_linearize(mem_ctx, policy_state->system_dn)));
+				 ldb_dn_get_linearized(policy_state->system_dn)));
 			return NT_STATUS_INTERNAL_DB_CORRUPTION;
 		}
 	} 
@@ -2521,7 +2521,7 @@ static NTSTATUS lsa_SetSecret(struct dcesrv_call_state *dce_call, TALLOC_CTX *me
 			
 			if (ret != 1) {
 				DEBUG(0,("Found %d records matching dn=%s\n", ret,
-					 ldb_dn_linearize(mem_ctx, secret_state->secret_dn)));
+					 ldb_dn_get_linearized(secret_state->secret_dn)));
 				return NT_STATUS_INTERNAL_DB_CORRUPTION;
 			}
 
diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c
index 9b43d1c70f..f05551bf42 100644
--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c
+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c
@@ -905,7 +905,7 @@ static NTSTATUS netr_LogonGetDomainInfo(struct dcesrv_call_state *dce_call, TALL
 	ret = gendb_search(sam_ctx, mem_ctx, partitions_basedn, 
 			   &ref_res, ref_attrs, 
 			   "(&(objectClass=crossRef)(ncName=%s))", 
-			   ldb_dn_linearize(mem_ctx, res1[0]->dn));
+			   ldb_dn_get_linearized(res1[0]->dn));
 	if (ret != 1) {
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
@@ -1151,7 +1151,7 @@ static WERROR netr_DsrEnumerateDomainTrusts(struct dcesrv_call_state *dce_call,
 
 	ret = gendb_search(sam_ctx, mem_ctx, partitions_basedn, &ref_res, ref_attrs,
 			   "(&(objectClass=crossRef)(ncName=%s))",
-			   ldb_dn_linearize(mem_ctx, dom_res[0]->dn));
+			   ldb_dn_get_linearized(dom_res[0]->dn));
 	if (ret == -1) {
 		return WERR_GENERAL_FAILURE;
 	}
diff --git a/source4/rpc_server/samr/dcesrv_samr.c b/source4/rpc_server/samr/dcesrv_samr.c
index 3e8650eb55..ae8089b051 100644
--- a/source4/rpc_server/samr/dcesrv_samr.c
+++ b/source4/rpc_server/samr/dcesrv_samr.c
@@ -340,7 +340,7 @@ static NTSTATUS samr_EnumDomains(struct dcesrv_call_state *dce_call, TALLOC_CTX
 		ret = gendb_search(c_state->sam_ctx, mem_ctx, partitions_basedn,
 				   &ref_msgs, ref_attrs, 
 				   "(&(objectClass=crossRef)(ncName=%s))", 
-				   ldb_dn_linearize(mem_ctx, dom_msgs[i]->dn));
+				   ldb_dn_get_linearized(dom_msgs[i]->dn));
 		if (ret == 1) {
 			array->entries[i].name.string = samdb_result_string(ref_msgs[0], "nETBIOSName", NULL);
 		} else {
@@ -399,7 +399,7 @@ static NTSTATUS samr_OpenDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *
 		ret = gendb_search(c_state->sam_ctx,
 				   mem_ctx, partitions_basedn, &ref_msgs, ref_attrs,
 				   "(&(&(nETBIOSName=*)(objectclass=crossRef))(ncName=%s))", 
-				   ldb_dn_linearize(mem_ctx, dom_msgs[0]->dn));
+				   ldb_dn_get_linearized(dom_msgs[0]->dn));
 		if (ret == 0) {
 			domain_name = ldb_msg_find_attr_as_string(dom_msgs[0], "cn", NULL);
 			if (domain_name == NULL) {
@@ -880,7 +880,7 @@ static NTSTATUS samr_SetDomainInfo(struct dcesrv_call_state *dce_call, TALLOC_CT
 	ret = samdb_replace(sam_ctx, mem_ctx, msg);
 	if (ret != 0) {
 		DEBUG(1,("Failed to modify record %s: %s\n",
-			 ldb_dn_linearize(mem_ctx, d_state->domain_dn),
+			 ldb_dn_get_linearized(d_state->domain_dn),
 			 ldb_errstring(sam_ctx)));
 
 		/* we really need samdb.c to return NTSTATUS */
@@ -946,7 +946,7 @@ static NTSTATUS samr_CreateDomainGroup(struct dcesrv_call_state *dce_call, TALLO
 	ret = samdb_add(d_state->sam_ctx, mem_ctx, msg);
 	if (ret != 0) {
 		DEBUG(0,("Failed to create group record %s\n",
-			 ldb_dn_linearize(mem_ctx, msg->dn)));
+			 ldb_dn_get_linearized(msg->dn)));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
 
@@ -1244,7 +1244,7 @@ static NTSTATUS samr_CreateUser2(struct dcesrv_call_state *dce_call, TALLOC_CTX
 	if (ret != 1) {
 		ldb_transaction_cancel(d_state->sam_ctx);
 		DEBUG(0,("Apparently we failed to create an account record, as %s now doesn't exist\n",
-			 ldb_dn_linearize(mem_ctx, msg->dn)));
+			 ldb_dn_get_linearized(msg->dn)));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
 	sid = samdb_result_dom_sid(mem_ctx, msgs[0], "objectSid");
@@ -1283,7 +1283,7 @@ static NTSTATUS samr_CreateUser2(struct dcesrv_call_state *dce_call, TALLOC_CTX
 	ret = samdb_replace(a_state->sam_ctx, mem_ctx, msg);
 	if (ret != 0) {
 		DEBUG(0,("Failed to modify account record %s to set userAccountControl: %s\n",
-			 ldb_dn_linearize(mem_ctx, msg->dn),
+			 ldb_dn_get_linearized(msg->dn),
 			 ldb_errstring(d_state->sam_ctx)));
 		ldb_transaction_cancel(d_state->sam_ctx);
 
@@ -1294,7 +1294,7 @@ static NTSTATUS samr_CreateUser2(struct dcesrv_call_state *dce_call, TALLOC_CTX
 	ret = ldb_transaction_commit(d_state->sam_ctx);
 	if (ret != 0) {
 		DEBUG(0,("Failed to commit transaction to add and modify account record %s: %s\n",
-			 ldb_dn_linearize(mem_ctx, msg->dn),
+			 ldb_dn_get_linearized(msg->dn),
 			 ldb_errstring(d_state->sam_ctx)));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
@@ -1484,7 +1484,7 @@ static NTSTATUS samr_CreateDomAlias(struct dcesrv_call_state *dce_call, TALLOC_C
 		return NT_STATUS_ALIAS_EXISTS;
 	default:
 		DEBUG(0,("Failed to create alias record %s: %s\n",
-			 ldb_dn_linearize(mem_ctx, msg->dn),
+			 ldb_dn_get_linearized(msg->dn),
 			 ldb_errstring(d_state->sam_ctx)));
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
@@ -2102,7 +2102,7 @@ static NTSTATUS samr_AddGroupMember(struct dcesrv_call_state *dce_call, TALLOC_C
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
 
-	memberdn = ldb_dn_linearize(mem_ctx, res->msgs[0]->dn);
+	memberdn = ldb_dn_alloc_linearized(mem_ctx, res->msgs[0]->dn);
 
 	if (memberdn == NULL)
 		return NT_STATUS_NO_MEMORY;
@@ -2205,7 +2205,7 @@ static NTSTATUS samr_DeleteGroupMember(struct dcesrv_call_state *dce_call, TALLO
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
 	}
 
-	memberdn = ldb_dn_linearize(mem_ctx, res->msgs[0]->dn);
+	memberdn = ldb_dn_alloc_linearized(mem_ctx, res->msgs[0]->dn);
 
 	if (memberdn == NULL)
 		return NT_STATUS_NO_MEMORY;
@@ -2587,7 +2587,7 @@ static NTSTATUS samr_AddAliasMember(struct dcesrv_call_state *dce_call, TALLOC_C
 	mod->dn = talloc_reference(mem_ctx, a_state->account_dn);
 
 	if (samdb_msg_add_addval(d_state->sam_ctx, mem_ctx, mod, "member",
-				 ldb_dn_linearize(mem_ctx, memberdn)) != 0)
+				 ldb_dn_alloc_linearized(mem_ctx, memberdn)) != 0)
 		return NT_STATUS_UNSUCCESSFUL;
 
 	if (samdb_modify(a_state->sam_ctx, mem_ctx, mod) != 0)
@@ -3406,7 +3406,7 @@ static NTSTATUS samr_SetUserInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX
 	ret = samdb_replace(a_state->sam_ctx, mem_ctx, msg);
 	if (ret != 0) {
 		DEBUG(1,("Failed to modify record %s: %s\n",
-			 ldb_dn_linearize(mem_ctx, a_state->account_dn),
+			 ldb_dn_get_linearized(a_state->account_dn),
 			 ldb_errstring(a_state->sam_ctx)));
 
 		/* we really need samdb.c to return NTSTATUS */
@@ -3439,7 +3439,7 @@ static NTSTATUS samr_GetGroupsForUser(struct dcesrv_call_state *dce_call, TALLOC
 	count = samdb_search_domain(a_state->sam_ctx, mem_ctx, d_state->domain_dn, &res,
 				    attrs, d_state->domain_sid,
 				    "(&(member=%s)(grouptype=%d)(objectclass=group))",
-				    ldb_dn_linearize(mem_ctx, a_state->account_dn),
+				    ldb_dn_get_linearized(a_state->account_dn),
 				    GTYPE_SECURITY_GLOBAL_GROUP);
 	if (count < 0)
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c
index 3d15a29735..160f53742e 100644
--- a/source4/rpc_server/samr/samr_password.c
+++ b/source4/rpc_server/samr/samr_password.c
@@ -158,7 +158,7 @@ NTSTATUS samr_ChangePasswordUser(struct dcesrv_call_state *dce_call, TALLOC_CTX
 	ret = samdb_replace(sam_ctx, mem_ctx, msg);
 	if (ret != 0) {
 		DEBUG(2,("Failed to modify record to change password on %s: %s\n",
-			 ldb_dn_linearize(mem_ctx, a_state->account_dn),
+			 ldb_dn_get_linearized(a_state->account_dn),
 			 ldb_errstring(sam_ctx)));
 		ldb_transaction_cancel(sam_ctx);
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -168,7 +168,7 @@ NTSTATUS samr_ChangePasswordUser(struct dcesrv_call_state *dce_call, TALLOC_CTX
 	ret = ldb_transaction_commit(sam_ctx);
 	if (ret != 0) {
 		DEBUG(1,("Failed to commit transaction to change password on %s: %s\n",
-			 ldb_dn_linearize(mem_ctx, a_state->account_dn),
+			 ldb_dn_get_linearized(a_state->account_dn),
 			 ldb_errstring(sam_ctx)));
 		return NT_STATUS_TRANSACTION_ABORTED;
 	}
@@ -290,7 +290,7 @@ NTSTATUS samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, TALLOC_
 	ret = samdb_replace(sam_ctx, mem_ctx, mod);
 	if (ret != 0) {
 		DEBUG(2,("Failed to modify record to change password on %s: %s\n",
-			 ldb_dn_linearize(mem_ctx, user_dn),
+			 ldb_dn_get_linearized(user_dn),
 			 ldb_errstring(sam_ctx)));
 		ldb_transaction_cancel(sam_ctx);
 		return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -300,7 +300,7 @@ NTSTATUS samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, TALLOC_
 	ret = ldb_transaction_commit(sam_ctx);
 	if (ret != 0) {
 		DEBUG(1,("Failed to commit transaction to change password on %s: %s\n",
-			 ldb_dn_linearize(mem_ctx, user_dn),
+			 ldb_dn_get_linearized(user_dn),
 			 ldb_errstring(sam_ctx)));
 		return NT_STATUS_TRANSACTION_ABORTED;
 	}
@@ -443,7 +443,7 @@ NTSTATUS samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call,
 	ret = samdb_replace(sam_ctx, mem_ctx, mod);
 	if (ret != 0) {
 		DEBUG(2,("samdb_replace failed to change password for %s: %s\n",
-			 ldb_dn_linearize(mem_ctx, user_dn),
+			 ldb_dn_get_linearized(user_dn),
 			 ldb_errstring(sam_ctx)));
 		status = NT_STATUS_UNSUCCESSFUL;
 		goto failed;
@@ -453,7 +453,7 @@ NTSTATUS samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call,
 	ret = ldb_transaction_commit(sam_ctx);
 	if (ret != 0) {
 		DEBUG(1,("Failed to commit transaction to change password on %s: %s\n",
-			 ldb_dn_linearize(mem_ctx, user_dn),
+			 ldb_dn_get_linearized(user_dn),
 			 ldb_errstring(sam_ctx)));
 		status = NT_STATUS_TRANSACTION_ABORTED;
 		goto failed;
diff --git a/source4/scripting/ejs/mprutil.c b/source4/scripting/ejs/mprutil.c
index e921b11475..6c989807a6 100644
--- a/source4/scripting/ejs/mprutil.c
+++ b/source4/scripting/ejs/mprutil.c
@@ -166,7 +166,7 @@ static struct MprVar mprLdbMessage(struct ldb_context *ldb, struct ldb_message *
 	const char *multivalued[] = { "objectClass", "memberOf", "privilege", 
 					    "member", NULL };
 
-	var = mprObject(ldb_dn_linearize(msg, msg->dn));
+	var = mprObject(ldb_dn_alloc_linearized(msg, msg->dn));
 
 	for (i=0;i<msg->num_elements;i++) {
 		struct ldb_message_element *el = &msg->elements[i];
@@ -213,7 +213,7 @@ static struct MprVar mprLdbMessage(struct ldb_context *ldb, struct ldb_message *
 
 	/* add the dn if it is not already specified */
 	if (mprGetProperty(&var, "dn", 0) == 0) {
-		mprSetVar(&var, "dn", mprString(ldb_dn_linearize(msg, msg->dn)));
+		mprSetVar(&var, "dn", mprString(ldb_dn_alloc_linearized(msg, msg->dn)));
 	}
 	
 	return var;