TODO: samba_upgradeprovision: do not overwrite changed nTSecurityDescriptor values

diff --git a/source4/scripting/bin/samba_upgradeprovision b/source4/scripting/bin/samba_upgradeprovision
index 8433b4ddd9c6edf208b34a6c6918e307201046cf..5f2c22716640d9f8eba5893c056042fb1c15951a 100755 (executable)
--- a/source4/scripting/bin/samba_upgradeprovision
+++ b/source4/scripting/bin/samba_upgradeprovision
@@ -907,6 +907,11 @@ def checkKeepAttributeWithMetadata(delta, att, message, reference, current,
                                     " cames from the modification or from a previous bug")
                     global dnNotToRecalculateFound
                     dnNotToRecalculateFound = True
+                elif not usn_in_range(int(attrUSN), usns.get(attInvId)):
+                    message(CHANGESD, "But the SD has been changed after the last "
+                                    "provision or upgradeprovision. Current "
+                                    "usn: %d. Doing nothing" % (attrUSN))
+                    dnNotToRecalculateFound = True
                 else:
                     dnToRecalculate.append(dn)
                 continue