fix listener mod handling

diff --git a/doc/man/man8/slapd.8 b/doc/man/man8/slapd.8
index 63b457e4961cebfe7e3fa6a9e7d2d90df117b5a4..072e7072c95da78671109f473a37c5d50da140b4 100644 (file)
--- a/doc/man/man8/slapd.8
+++ b/doc/man/man8/slapd.8
@@ -128,13 +128,21 @@ extension to indicate the permissions of the underlying socket, on those
 OSes that honor them.  Support for the
 latter two schemes depends on selected configuration options.  Hosts
 may be specified by name or IPv4 and IPv6 address formats.
-Ports, if specfied, must be numeric.  The default ldap:// port is 389
+Ports, if specified, must be numeric.  The default ldap:// port is 389
 and the default ldaps:// port is 636.
 The socket permissions for LDAP over IPC are indicated by
 "x-mod=-rwxrwxrwx", "x-mod=0777" or "x-mod=777", where any 
 of the "rwx" can be "-" to suppress the related permission (note, 
 however, that sockets only honor the "w" permission), while any 
 of the "7" can be any legal octal digit, according to chmod(1).
+The usage is a bit awkward: since on some systems write permission
+("w") is required to be able to operate on the socket, it must always
+be set to allow operations on the socket.  As a consequence,
+the meaning of the "r" field is to negate write access if present;
+e.g., "x-mod=--wx---rw-" means "owner" can access read/write even
+without binding (and subject to regular ACLs), while for "others"
+bind is required, and the listener is read-only.  "Group" permissions
+are not considered at present.
 .TP
 .BI \-r " directory"
 Specifies a chroot "jail" directory.  slapd will

diff --git a/servers/slapd/backend.c b/servers/slapd/backend.c
index 7634429d03eef5968849624a651b632699191393..a6370cbf71c236e0c968bcf8453eb3d511dc4b15 100644 (file)
--- a/servers/slapd/backend.c
+++ b/servers/slapd/backend.c
@@ -957,8 +957,9 @@ backend_check_restrictions(
                        }
 
 #ifdef SLAP_X_LISTENER_MOD
-                       if ( op->o_conn->c_listener && ! ( op->o_conn->c_listener->sl_perms & S_IWUSR ) ) {
-                               /* no "w" mode means readonly */
+                       if ( op->o_conn->c_listener && ( op->o_conn->c_listener->sl_perms & S_IRUSR ) ) {
+                               /* "r" mode means readonly ( "w" is required
+                                * to operate on a socket ...) */
                                rs->sr_text = "modifications not allowed on this listener";
                                rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
                                return rs->sr_err;
@@ -1029,15 +1030,6 @@ backend_check_restrictions(
                                return rs->sr_err;
                        }
                }
-
-               if ( !starttls && !updateop ) {
-                       if ( op->o_conn->c_listener && ! ( op->o_conn->c_listener->sl_perms & S_IRUSR ) ) {
-                               /* no "r" mode means no read */
-                               rs->sr_text = "read not allowed on this listener";
-                               rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
-                               return rs->sr_err;
-                       }
-               }
 #endif /* SLAP_X_LISTENER_MOD */
 
        }

diff --git a/servers/slapd/daemon.c b/servers/slapd/daemon.c
index e61feceb12ae2c7505a29cc5d29c38ffeb6cb7bf..a12a166819784cb7fcfe2d01df9858e32c2ce7c7 100644 (file)
--- a/servers/slapd/daemon.c
+++ b/servers/slapd/daemon.c
@@ -679,7 +679,7 @@ static int slap_open_listener(
        if ( lud->lud_exts ) {
                err = get_url_perms( lud->lud_exts, &l.sl_perms, &crit );
        } else {
-               l.sl_perms = S_IRWXU;
+               l.sl_perms = S_IWUSR | S_IXUSR; /* "r" means readonly ... */
        }
 #endif /* LDAP_PF_LOCAL || SLAP_X_LISTENER_MOD */