4 files changed, 59 insertions, 1 deletions

diff --git a/lib/talloc/talloc.c b/lib/talloc/talloc.c
index f103a9b941..7beda4b0f5 100644
--- a/lib/talloc/talloc.c
+++ b/lib/talloc/talloc.c
@@ -1477,10 +1477,37 @@ void talloc_enable_null_tracking(void)
 }
 
 /*
+  enable tracking of the NULL context, not moving the autofree context
+  into the NULL context. This is needed for the talloc testsuite
+*/
+void talloc_enable_null_tracking_no_autofree(void)
+{
+	if (null_context == NULL) {
+		null_context = _talloc_named_const(NULL, 0, "null_context");
+	}
+}
+
+/*
   disable tracking of the NULL context
 */
 void talloc_disable_null_tracking(void)
 {
+	if (null_context != NULL) {
+		/* we have to move any children onto the real NULL
+		   context */
+		struct talloc_chunk *tc, *tc2;
+		tc = talloc_chunk_from_ptr(null_context);
+		for (tc2 = tc->child; tc2; tc2=tc2->next) {
+			if (tc2->parent == tc) tc2->parent = NULL;
+			if (tc2->prev == tc) tc2->prev = NULL;
+		}
+		for (tc2 = tc->next; tc2; tc2=tc2->next) {
+			if (tc2->parent == tc) tc2->parent = NULL;
+			if (tc2->prev == tc) tc2->prev = NULL;
+		}
+		tc->child = NULL;
+		tc->next = NULL;
+	}
 	talloc_free(null_context);
 	null_context = NULL;
 }
diff --git a/lib/talloc/talloc.h b/lib/talloc/talloc.h
index 8241eeb306..f549a17fba 100644
--- a/lib/talloc/talloc.h
+++ b/lib/talloc/talloc.h
@@ -163,6 +163,7 @@ void talloc_report_depth_file(const void *ptr, int depth, int max_depth, FILE *f
 void talloc_report_full(const void *ptr, FILE *f);
 void talloc_report(const void *ptr, FILE *f);
 void talloc_enable_null_tracking(void);
+void talloc_enable_null_tracking_no_autofree(void);
 void talloc_disable_null_tracking(void);
 void talloc_enable_leak_report(void);
 void talloc_enable_leak_report_full(void);
diff --git a/lib/talloc/testsuite.c b/lib/talloc/testsuite.c
index 8845d960c1..08aa20863a 100644
--- a/lib/talloc/testsuite.c
+++ b/lib/talloc/testsuite.c
@@ -518,6 +518,7 @@ static bool test_misc(void)
 
 	CHECK_SIZE("misc", NULL, 0);
 
+	talloc_enable_null_tracking_no_autofree();
 	talloc_enable_leak_report();
 	talloc_enable_leak_report_full();
 
@@ -1136,7 +1137,7 @@ static void test_reset(void)
 	talloc_set_log_fn(test_log_stdout);
 	test_abort_stop();
 	talloc_disable_null_tracking();
-	talloc_enable_null_tracking();
+	talloc_enable_null_tracking_no_autofree();
 }
 
 struct torture_context;
diff --git a/source4/dsdb/samdb/ldb_modules/descriptor.c b/source4/dsdb/samdb/ldb_modules/descriptor.c
index e74a93c279..7b5b700916 100644
--- a/source4/dsdb/samdb/ldb_modules/descriptor.c
+++ b/source4/dsdb/samdb/ldb_modules/descriptor.c
@@ -42,6 +42,10 @@
 #include "auth/auth.h"
 #include "param/param.h"
 
+struct descriptor_data {
+	bool inherit;
+};
+
 struct descriptor_context {
 		struct ldb_module *module;
 		struct ldb_request *req;
@@ -395,10 +399,15 @@ static int descriptor_add(struct ldb_module *module, struct ldb_request *req)
 	struct descriptor_context *ac;
 	struct ldb_dn *parent_dn;
 	int ret;
+	struct descriptor_data *data;
 	static const char * const descr_attrs[] = { "nTSecurityDescriptor", NULL };
 
+	data = talloc_get_type(ldb_module_get_private(module), struct descriptor_data);
 	ldb = ldb_module_get_ctx(module);
 
+	if (!data->inherit)
+		return ldb_next_request(module, req);
+
 	ldb_debug(ldb, LDB_DEBUG_TRACE, "descriptor_add\n");
 
 	if (ldb_dn_is_special(req->op.add.message->dn)) {
@@ -452,11 +461,31 @@ static int descriptor_rename(struct ldb_module *module, struct ldb_request *req)
 	return ldb_next_request(module, req);
 }
 
+static int descriptor_init(struct ldb_module *module)
+{
+	struct ldb_context *ldb;
+	struct descriptor_data *data;
+
+	ldb = ldb_module_get_ctx(module);
+	data = talloc(module, struct descriptor_data);
+	if (data == NULL) {
+		ldb_oom(ldb);
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
+	data->inherit = lp_parm_bool(ldb_get_opaque(ldb, "loadparm"),
+				  NULL, "acl", "inheritance", false);
+	ldb_module_set_private(module, data);
+	return ldb_next_init(module);
+}
+
+
 _PUBLIC_ const struct ldb_module_ops ldb_descriptor_module_ops = {
 	.name		   = "descriptor",
 	.add           = descriptor_add,
 	.modify        = descriptor_modify,
 	.rename        = descriptor_rename,
+	.init_context  = descriptor_init
 };