- if ( !be_isroot( be, op->o_ndn ) && !be_issuffix( be, "" ) ) {
- ldap_pvt_thread_mutex_unlock(&li->li_add_mutex);
-
- Debug( LDAP_DEBUG_TRACE, "%s add denied\n",
- pdn == NULL ? "suffix" : "entry at root",
- 0, 0 );
+ if ( !be_isroot( be, &op->o_ndn ) ) {
+ if ( be_issuffix( be, (struct berval *)&slap_empty_bv ) || be_isupdate( be, &op->o_ndn ) ) {
+ p = (Entry *)&slap_entry_root;
+
+ rc = access_allowed( be, conn, op, p,
+ children, NULL, ACL_WRITE, NULL );
+ p = NULL;
+
+ if ( ! rc ) {
+ ldap_pvt_thread_rdwr_wunlock(&li->li_giant_rwlock);
+
+#ifdef NEW_LOGGING
+ LDAP_LOG( BACK_LDBM, ERR,
+ "ldbm_back_add: No write "
+ "access to parent (\"\").\n", 0, 0, 0 );
+#else
+ Debug( LDAP_DEBUG_TRACE,
+ "no write access to parent\n",
+ 0, 0, 0 );
+#endif
+
+ send_ldap_result( conn, op,
+ LDAP_INSUFFICIENT_ACCESS,
+ NULL,
+ "no write access to parent",
+ NULL, NULL );
+
+ return -1;
+ }