s4: problems with DSDB_TRU

[Nadezhda Ivanova]

Hi Tridge,
It appears that this patch:
http://gitweb.samba.org/?p=samba.git;a=commitdiff;h=87f31510475c6debd56ff874130f4f5d48bef9a5#patch23
made it so all requests - internal and external - are now by default
untrusted, unless the DSDB_TRUSTED_FLAG is provided. I agree that it is best
to be paranoid, but the acl_read module counts on the trustedness of the
request to decide whether to apply access checks. Before it was only the
ldap server that marked the requests untrusted so we knew to only check and
filter out external requests based on this flag. Something like this:
http://gitweb.samba.org/?p=nivanova/samba.git;a=commit;h=ba06cdb413de29fe3e33ef9891dcf61c25cfbbbe

However, now the acl_read module is also checking and hiding attributes and
entries from internal requests, and that messes up tests when it is enabled.
I kind of fixed this my marking explicitly all internal requests as trusted
in the modules preceding acl_read, but it does not seem to be the right way.
For one thing, it will be very easy to forget to set that flag if a new
module is introduced or moved, and as most people write tests as the
Administrator, problems caused by this will not be noticed until too late.
Is there any particular reason for all requests to be untrusted? Can we
introduce some functions to be used always internally so that we always mark
internal requests as trusted?

Regards,
Nadya