headers
zhangweiwu | 24 Aug 05:52

/etc/ldap/slapd.conf: line 158: invalid path: Permission denied

Dear all

I've had this strange problem on a new openldap (2.4.9-0ubuntu0.8.04.2)
installation:

root <at> emerson # slapd -d 256 -h 'ldap://0.0.0.0:636/'  -f /etc/ldap/slapd.conf
@(#) $OpenLDAP: slapd 2.4.9 (Aug  5 2008 20:18:55) $
	buildd <at> palmer:/build/buildd/openldap2.3-2.4.9/debian/build/servers/slapd
/etc/ldap/slapd.conf: line 126: rootdn is always granted unlimited privileges.
/etc/ldap/slapd.conf: line 143: rootdn is always granted unlimited privileges.
/etc/ldap/slapd.conf: line 158: invalid path: Permission denied
slapd stopped.
connections_destroy: nothing to destroy.

Where:
root <at> emerson # sed -n 158p /etc/ldap/slapd.conf 
directory       "/var/lib/ldap_jxpado"

This is rather strange because as you can see I am running slapd as
root. I also verified I have full access to /var/lib/ldap_jxpado, in
fact, I just created this directory and successfully imported the ldap
backup from a productional server without any error message. It looks
simple but when I am told 'permission denied' when I actually have the
permission I am stuck not knowing where to start to look for solution.
I've attached my slapd.conf in case you can help (rootdn password not
removed due to they are just temporary testing installation. Thanks for
hints and point me to the right direction to solve the problem.

Best regards
Zhang Weiwu
(Continue reading)

Permalink | Reply |
headers
zhangweiwu | 25 Aug 04:04

Re: /etc/ldap/slapd.conf: line 158: invalid path: Permission denied

zhangweiwu <at> realss.com wrote:
> Dear all
>
> I've had this strange problem on a new openldap (2.4.9-0ubuntu0.8.04.2)
> installation:
>
> root <at> emerson # slapd -d 256 -h 'ldap://0.0.0.0:636/'  -f /etc/ldap/slapd.conf
> @(#) $OpenLDAP: slapd 2.4.9 (Aug  5 2008 20:18:55) $
> 	buildd <at> palmer:/build/buildd/openldap2.3-2.4.9/debian/build/servers/slapd
> /etc/ldap/slapd.conf: line 126: rootdn is always granted unlimited privileges.
> /etc/ldap/slapd.conf: line 143: rootdn is always granted unlimited privileges.
> /etc/ldap/slapd.conf: line 158: invalid path: Permission denied
> slapd stopped.
> connections_destroy: nothing to destroy.
>
> Where:
> root <at> emerson # sed -n 158p /etc/ldap/slapd.conf 
> directory       "/var/lib/ldap_jxpado"
>
>   
After a lot of experiment it seems anything other than '/var/lib/ldap',
when used for directory directive, would generate "invalid path:
Permission denied". I also tested /var/lib/ldap/jxpado in case slapd
runs in chroot by mistake (~openldap=/var/lib/ldap).

I checked the source code. I am a terrible C code reader, but I found
before this error message is printed slapd check permission by creating
/var/lib/ldap/jxpado/DUMMY and unlink it, if no error, go on, otherwise
pop up this error. I did exactly the same with commandline without error.
(Continue reading)

Permalink | Reply |
headers
Mathias Gug | 25 Aug 17:54

Re: /etc/ldap/slapd.conf: line 158: invalid path: Permission denied

On Mon, Aug 25, 2008 at 10:04:07AM +0800, zhangweiwu <at> realss.com wrote:
> zhangweiwu <at> realss.com wrote:
> > root <at> emerson # slapd -d 256 -h 'ldap://0.0.0.0:636/'  -f /etc/ldap/slapd.conf
> > @(#) $OpenLDAP: slapd 2.4.9 (Aug  5 2008 20:18:55) $
> > 	buildd <at> palmer:/build/buildd/openldap2.3-2.4.9/debian/build/servers/slapd
> > /etc/ldap/slapd.conf: line 126: rootdn is always granted unlimited privileges.
> > /etc/ldap/slapd.conf: line 143: rootdn is always granted unlimited privileges.
> > /etc/ldap/slapd.conf: line 158: invalid path: Permission denied
> > slapd stopped.
> > connections_destroy: nothing to destroy.
> >
> > Where:
> > root <at> emerson # sed -n 158p /etc/ldap/slapd.conf 
> > directory       "/var/lib/ldap_jxpado"
> >
> >   
> After a lot of experiment it seems anything other than '/var/lib/ldap',
> when used for directory directive, would generate "invalid path:
> Permission denied". I also tested /var/lib/ldap/jxpado in case slapd
> runs in chroot by mistake (~openldap=/var/lib/ldap).
> 
> This is rather strange to me, could it be the Ubuntu server edition of
> slapd was modified? I configured a dozen more slapd server where I
> altered directory, on Gentoo Linux, this is the first time I do it on
> Ubuntu server.

Starting from Ubuntu 8.04, slapd is protected by an apparmor profile.
Since you're using a non-standard directory for you database, you'll get
a permission error. You should see audit messages in /var/log/kern.log
related to slapd.
(Continue reading)

Permalink | Reply |

Gmane