non-root add/delete of entries rooted at '' checks children write permission (forward...

diff --git a/servers/slapd/back-bdb/add.c b/servers/slapd/back-bdb/add.c
index a2e55d0180b6c1474d102356864d964117059333..c0469f78a84e196292e207c4e400af02e7dfe2e4 100644 (file)
--- a/servers/slapd/back-bdb/add.c
+++ b/servers/slapd/back-bdb/add.c
@@ -148,7 +148,7 @@ retry:      rc = txn_abort( ltid );
                        Debug( LDAP_DEBUG_TRACE, "bdb_add: no write access to parent\n",
                                0, 0, 0 );
                        rc = LDAP_INSUFFICIENT_ACCESS;
-                       text = "no write access to parent", NULL, NULL;
+                       text = "no write access to parent";
                        goto return_results;;
                }
 
@@ -195,11 +195,31 @@ retry:    rc = txn_abort( ltid );
                 *  or with parent ""
                 */
                if ( !be_isroot( be, op->o_ndn )) {
-                       Debug( LDAP_DEBUG_TRACE, "bdb_add: %s denied\n",
-                               pdn == NULL ? "suffix" : "entry at root",
-                               0, 0 );
-                       rc = LDAP_INSUFFICIENT_ACCESS;
-                       goto return_results;
+                       if ( be_issuffix( be, "" ) ) {
+                               static const Entry rootp = { NOID, "", "", NULL, NULL };
+
+                               p = (Entry *)&rootp;
+
+                               /* check parent for "children" acl */
+                               rc = access_allowed( be, conn, op, p,
+                                       children, NULL, ACL_WRITE );
+                               p = NULL;
+
+                               if ( ! rc ) {
+                                       Debug( LDAP_DEBUG_TRACE, "bdb_add: no write access to parent\n",
+                                               0, 0, 0 );
+                                       rc = LDAP_INSUFFICIENT_ACCESS;
+                                       text = "no write access to parent";
+                                       goto return_results;;
+                               }
+
+                       } else {
+                               Debug( LDAP_DEBUG_TRACE, "bdb_add: %s denied\n",
+                                       pdn == NULL ? "suffix" : "entry at root",
+                                       0, 0 );
+                               rc = LDAP_INSUFFICIENT_ACCESS;
+                               goto return_results;
+                       }
                }
        }
 

diff --git a/servers/slapd/back-bdb/delete.c b/servers/slapd/back-bdb/delete.c
index 1aa089e66cabd8d9be984b07e38061cb4f039535..4dff6517e727d0f6f10178a86ce6eb33f2c4a154 100644 (file)
--- a/servers/slapd/back-bdb/delete.c
+++ b/servers/slapd/back-bdb/delete.c
@@ -162,12 +162,32 @@ retry:    /* transaction retry */
                ch_free( pdn );
 
                /* no parent, must be root to delete */
-               if( ! be_isroot( be, op->o_ndn ) && ! be_issuffix( be, "" ) ) {
-                       Debug( LDAP_DEBUG_TRACE,
-                               "<=- bdb_delete: no parent and not root\n",
-                               0, 0, 0);
-                       rc = LDAP_INSUFFICIENT_ACCESS;
-                       goto return_results;
+               if( ! be_isroot( be, op->o_ndn ) ) {
+                       if ( be_issuffix( be, "" ) ) {
+                               static const Entry rootp = { NOID, "", "", NULL, NULL };
+
+                               p = (Entry *)&rootp;
+
+                               /* check parent for "children" acl */
+                               rc = access_allowed( be, conn, op, p,
+                                       children, NULL, ACL_WRITE );
+                               p = NULL;
+
+                               if ( !rc  ) {
+                                       Debug( LDAP_DEBUG_TRACE,
+                                               "<=- bdb_delete: no access "
+                                               "to parent\n", 0, 0, 0 );
+                                       rc = LDAP_INSUFFICIENT_ACCESS;
+                                       goto return_results;
+                               }
+
+                       } else {
+                               Debug( LDAP_DEBUG_TRACE,
+                                       "<=- bdb_delete: no parent "
+                                       "and not root\n", 0, 0, 0);
+                               rc = LDAP_INSUFFICIENT_ACCESS;
+                               goto return_results;
+                       }
                }
        }