[Pkg-openldap-devel] Bug#741248: slapd: slapacl corrupts database

[Ferenc Wágner]

Package: slapd
Version: 2.4.31-1+nmu2
Severity: normal

Hi,

After a default install of slapd, check the permissions of the admin DN
on the base suffix:

$ sudo -u openldap slapacl -b dc=ki,dc=iif,dc=hu -D cn=admin,dc=ki,dc=iif,dc=hu entry
authcDN: "cn=admin,dc=ki,dc=iif,dc=hu"
entry: manage(=mwrscxd)

Now stop slapd, just to get it out of the picture (this changes nothing):

$ sudo service slapd stop
[ ok ] Stopping OpenLDAP: slapd.

and introduce a typo (hu -> huu) into the base suffix:

$ sudo -u openldap slapacl -b dc=ki,dc=iif,dc=huu -D cn=admin,dc=ki,dc=iif,dc=hu entry
531d8fa7 hdb_db_open: database "dc=ki,dc=iif,dc=hu": unclean shutdown detected; attempting recovery.
531d8fa7 hdb_db_open: database "dc=ki,dc=iif,dc=hu": recovery skipped in read-only mode. Run manual recovery if errors are encountered.
authcDN: "cn=admin,dc=ki,dc=iif,dc=hu"
dc=ki,dc=iif,dc=huu: no target database has been found for baseDN="slapacl"; you may try with "-u" (dry run).

Doing it correctly again does not get rid of the warnings:

$ sudo -u openldap slapacl -b dc=ki,dc=iif,dc=hu -D cn=admin,dc=ki,dc=iif,dc=hu entry
531d8fb1 hdb_db_open: database "dc=ki,dc=iif,dc=hu": unclean shutdown detected; attempting recovery.
531d8fb1 hdb_db_open: database "dc=ki,dc=iif,dc=hu": recovery skipped in read-only mode. Run manual recovery if errors are encountered.
authcDN: "cn=admin,dc=ki,dc=iif,dc=hu"
entry: manage(=mwrscxd)

Starting slapd fixes the corruption, though.

I think there's at least one bug here:

1. slapacl should be a read only operation, which may not be possible
   with the underlying DB libraries.
2. Even if it was documented to corrupt the checked database, it should not
   find it with a mistyped base DN.
3. Its man page does not warn against its use while slapd is running, so I
   suppose it's allowed (as I'd expect).

Please help be better assess the situation!

Thanks,
Feri.

-- System Information:
Debian Release: 7.4
  APT prefers stable
  APT policy: (500, 'stable'), (30, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 3.13-trunk-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages slapd depends on:
ii  adduser                     3.113+nmu3
ii  coreutils                   8.13-3.5
ii  debconf [debconf-2.0]       1.5.49
ii  libc6                       2.13-38+deb7u1
ii  libdb5.1                    5.1.29-5
ii  libgcrypt11                 1.5.0-5+deb7u1
ii  libgnutls26                 2.12.20-8+deb7u1
ii  libldap-2.4-2               2.4.31-1+nmu2
ii  libltdl7                    2.4.2-1.1
ii  libodbc1                    2.2.14p2-5
ii  libperl5.14                 5.14.2-21+deb7u1
ii  libsasl2-2                  2.1.25.dfsg1-6+deb7u1
ii  libslp1                     1.2.1-9
ii  libwrap0                    7.6.q-24
ii  lsb-base                    4.1+Debian8+deb7u1
ii  multiarch-support           2.13-38+deb7u1
ii  perl [libmime-base64-perl]  5.14.2-21+deb7u1
ii  psmisc                      22.19-1+deb7u1

Versions of packages slapd recommends:
ii  libsasl2-modules  2.1.25.dfsg1-6+deb7u1

Versions of packages slapd suggests:
ii  ldap-utils  2.4.31-1+nmu2

-- debconf information:
  slapd/allow_ldap_v2: false
  slapd/password_mismatch:
  slapd/invalid_config: true
  shared/organization: ki.iif.hu
  slapd/upgrade_slapcat_failure:
  slapd/no_configuration: false
  slapd/move_old_database: true
  slapd/dump_database_destdir: /var/backups/slapd-VERSION
  slapd/purge_database: false
  slapd/domain: ki.iif.hu
  slapd/backend: HDB
  slapd/dump_database: when needed