Disallow addition of system schema via config files.

diff --git a/servers/slapd/config.c b/servers/slapd/config.c
index 23a4599f06db5cd63229b62a8b70530d4ba89b56..e5dcdbe1c76014fbd7a3ef4ac74f16e87dfc9abc 100644 (file)
--- a/servers/slapd/config.c
+++ b/servers/slapd/config.c
@@ -1651,7 +1651,6 @@ read_config( const char *fname )
                                       "%s: line %d: old objectclass format not supported.\n",
                                       fname, lineno, 0 );
 #endif
-
                        }
 
                /* specify an attribute type */

diff --git a/servers/slapd/oc.c b/servers/slapd/oc.c
index 4e0adde93aa24109668961f5ee61c7955f1e0f8d..ca7a0d45aa2cb8a7e3c913296ee9b07be807c608 100644 (file)
--- a/servers/slapd/oc.c
+++ b/servers/slapd/oc.c
@@ -163,6 +163,7 @@ static int
 oc_create_required(
     ObjectClass                *soc,
     char               **attrs,
+       int                     *op,
     const char         **err )
 {
        char            **attrs1;
@@ -178,6 +179,9 @@ oc_create_required(
                                *err = *attrs1;
                                return SLAP_SCHERR_ATTR_NOT_FOUND;
                        }
+
+                       if( is_at_operational( sat )) (*op)++;
+
                        if ( at_find_in_list(sat, soc->soc_required) < 0) {
                                if ( at_append_to_list(sat, &soc->soc_required) ) {
                                        *err = *attrs1;
@@ -201,6 +205,7 @@ static int
 oc_create_allowed(
     ObjectClass                *soc,
     char               **attrs,
+       int                     *op,
     const char         **err )
 {
        char            **attrs1;
@@ -214,6 +219,9 @@ oc_create_allowed(
                                *err = *attrs1;
                                return SLAP_SCHERR_ATTR_NOT_FOUND;
                        }
+
+                       if( is_at_operational( sat )) (*op)++;
+
                        if ( at_find_in_list(sat, soc->soc_required) < 0 &&
                             at_find_in_list(sat, soc->soc_allowed) < 0 ) {
                                if ( at_append_to_list(sat, &soc->soc_allowed) ) {
@@ -231,6 +239,7 @@ static int
 oc_add_sups(
     ObjectClass                *soc,
     char                       **sups,
+       int                     *op,
     const char         **err )
 {
        int             code;
@@ -274,16 +283,19 @@ oc_add_sups(
                                return SLAP_SCHERR_CLASS_BAD_USAGE;
                        }
 
-                       if ( add_sups )
+                       if( soc->soc_flags & SLAP_OC_OPERATIONAL ) (*op)++;
+
+                       if ( add_sups ) {
                                soc->soc_sups[nsups] = soc1;
+                       }
 
-                       code = oc_add_sups( soc, soc1->soc_sup_oids, err );
+                       code = oc_add_sups( soc, soc1->soc_sup_oids, op, err );
                        if ( code ) return code;
 
-                       code = oc_create_required( soc, soc1->soc_at_oids_must, err );
+                       code = oc_create_required( soc, soc1->soc_at_oids_must, op, err );
                        if ( code ) return code;
 
-                       code = oc_create_allowed( soc, soc1->soc_at_oids_may, err );
+                       code = oc_create_allowed( soc, soc1->soc_at_oids_may, op, err );
                        if ( code ) return code;
 
                        nsups++;
@@ -382,11 +394,13 @@ oc_insert(
 int
 oc_add(
     LDAPObjectClass    *oc,
+       int user,
     const char         **err
 )
 {
        ObjectClass     *soc;
        int             code;
+       int             op = 0;
 
        if ( oc->oc_names != NULL ) {
                int i;
@@ -419,19 +433,21 @@ oc_add(
        {
                /* structural object classes implicitly inherit from 'top' */
                static char *top_oids[] = { SLAPD_TOP_OID, NULL };
-               code = oc_add_sups( soc, top_oids, err );
+               code = oc_add_sups( soc, top_oids, &op, err );
        } else {
-               code = oc_add_sups( soc, soc->soc_sup_oids, err );
+               code = oc_add_sups( soc, soc->soc_sup_oids, &op, err );
        }
 
        if ( code != 0 ) return code;
 
-       code = oc_create_required( soc, soc->soc_at_oids_must, err );
+       code = oc_create_required( soc, soc->soc_at_oids_must, &op, err );
        if ( code != 0 ) return code;
 
-       code = oc_create_allowed( soc, soc->soc_at_oids_may, err );
+       code = oc_create_allowed( soc, soc->soc_at_oids_may, &op, err );
        if ( code != 0 ) return code;
 
+       if( user && op ) return SLAP_SCHERR_CLASS_OPERATIONAL;
+
        code = oc_insert(soc,err);
        return code;
 }

diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h
index 7b2a65a980508f7dbfd1eb8cbf9b184ab1266f71..ec841a6df93f7face3e2bafba9a7c858075f58c7 100644 (file)
--- a/servers/slapd/proto-slap.h
+++ b/servers/slapd/proto-slap.h
@@ -626,6 +626,7 @@ LDAP_SLAPD_F (void) mra_free LDAP_P((
 /* oc.c */
 LDAP_SLAPD_F (int) oc_add LDAP_P((
        LDAPObjectClass *oc,
+       int user,
        const char **err));
 LDAP_SLAPD_F (void) oc_destroy LDAP_P(( void ));
 

diff --git a/servers/slapd/schema_prep.c b/servers/slapd/schema_prep.c
index 6d85cc83bced0548473e36128d65acdfb843f495..73c36a7170273720df7b57ce1ef20107fff02f58 100644 (file)
--- a/servers/slapd/schema_prep.c
+++ b/servers/slapd/schema_prep.c
@@ -162,28 +162,29 @@ static struct slap_schema_oc_map {
                        "NAME 'extensibleObject' "
                        "DESC 'RFC2252: extensible object' "
                        "SUP top AUXILIARY )",
-               0, 0, offsetof(struct slap_internal_schema, si_oc_extensibleObject) },
+               0, SLAP_OC_OPERATIONAL,
+               offsetof(struct slap_internal_schema, si_oc_extensibleObject) },
        { "alias", "( 2.5.6.1 NAME 'alias' "
                        "DESC 'RFC2256: an alias' "
                        "SUP top STRUCTURAL "
                        "MUST aliasedObjectName )",
-               aliasObjectClass, SLAP_OC_ALIAS,
+               aliasObjectClass, SLAP_OC_ALIAS|SLAP_OC_OPERATIONAL,
                offsetof(struct slap_internal_schema, si_oc_alias) },
        { "referral", "( 2.16.840.1.113730.3.2.6 NAME 'referral' "
                        "DESC 'namedref: named subordinate referral' "
                        "SUP top STRUCTURAL MUST ref )",
-               referralObjectClass, SLAP_OC_REFERRAL,
+               referralObjectClass, SLAP_OC_REFERRAL|SLAP_OC_OPERATIONAL,
                offsetof(struct slap_internal_schema, si_oc_referral) },
        { "LDAProotDSE", "( 1.3.6.1.4.1.4203.1.4.1 "
                        "NAME ( 'OpenLDAProotDSE' 'LDAProotDSE' ) "
                        "DESC 'OpenLDAP Root DSE object' "
                        "SUP top STRUCTURAL MAY cn )",
-               rootDseObjectClass, 0,
+               rootDseObjectClass, SLAP_OC_OPERATIONAL,
                offsetof(struct slap_internal_schema, si_oc_rootdse) },
        { "subentry", "( 2.5.20.0 NAME 'subentry' "
                        "SUP top STRUCTURAL "
                        "MUST ( cn $ subtreeSpecification ) )",
-               subentryObjectClass, SLAP_OC_SUBENTRY,
+               subentryObjectClass, SLAP_OC_SUBENTRY|SLAP_OC_OPERATIONAL,
                offsetof(struct slap_internal_schema, si_oc_subentry) },
        { "subschema", "( 2.5.20.1 NAME 'subschema' "
                "DESC 'RFC2252: controlling subschema (sub)entry' "
@@ -191,17 +192,19 @@ static struct slap_schema_oc_map {
                "MAY ( dITStructureRules $ nameForms $ ditContentRules $ "
                        "objectClasses $ attributeTypes $ matchingRules $ "
                        "matchingRuleUse ) )",
-               subentryObjectClass, 0,
+               subentryObjectClass, SLAP_OC_OPERATIONAL,
                offsetof(struct slap_internal_schema, si_oc_subschema) },
        { "monitor", "( 1.3.6.1.4.1.4203.666.3.2 NAME 'monitor' "
                "DESC 'OpenLDAP system monitoring' "
                "STRUCTURAL "
                "MUST cn )",
-               0, 0, offsetof(struct slap_internal_schema, si_oc_monitor) },
+               0, SLAP_OC_OPERATIONAL,
+               offsetof(struct slap_internal_schema, si_oc_monitor) },
        { "collectiveAttributeSubentry", "( 2.5.20.2 "
                        "NAME 'collectiveAttributeSubentry' "
                        "AUXILIARY )",
-               subentryObjectClass, SLAP_OC_COLLECTIVEATTRIBUTESUBENTRY|SLAP_OC_HIDE,
+               subentryObjectClass,
+               SLAP_OC_COLLECTIVEATTRIBUTESUBENTRY|SLAP_OC_OPERATIONAL|SLAP_OC_HIDE,
                offsetof(struct slap_internal_schema, si_oc_collectiveAttributeSubentry) },
        { "dynamicObject", "( 1.3.6.1.4.1.1466.101.119.2 "
                        "NAME 'dynamicObject' "
@@ -307,14 +310,14 @@ static struct slap_schema_ad_map {
                        "EQUALITY octetStringMatch "
                        "SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{64} "
                        "SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
-               NULL, 0, NULL, NULL, NULL,
+               NULL, SLAP_AT_HIDE, NULL, NULL, NULL,
                offsetof(struct slap_internal_schema, si_ad_entryUUID) },
        { "entryCSN", "( 1.3.6.1.4.1.4203.666.1.7 NAME 'entryCSN' "
                        "DESC 'LCUP/LDUP: change sequence number' "
                        "EQUALITY octetStringMatch "
                        "SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{64} "
                        "SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
-               NULL, 0, NULL, NULL, NULL,
+               NULL, SLAP_AT_HIDE, NULL, NULL, NULL,
                offsetof(struct slap_internal_schema, si_ad_entryCSN) },
 
        /* root DSE attributes */
@@ -715,7 +718,7 @@ slap_schema_load( void )
                                return LDAP_OTHER;
                        }
 
-                       code = oc_add(oc,&err);
+                       code = oc_add(oc,0,&err);
                        if ( code ) {
                                fprintf( stderr, "slap_schema_load: "
                                        "%s: %s: \"%s\"\n",

diff --git a/servers/slapd/schemaparse.c b/servers/slapd/schemaparse.c
index 171bd3473edf39ea434574af4be6cb4838efb645..bc9dbd7dd922cded0e670320ecaa8c98eec01f33 100644 (file)
--- a/servers/slapd/schemaparse.c
+++ b/servers/slapd/schemaparse.c
@@ -26,6 +26,7 @@ static char *const err2text[SLAP_SCHERR_LAST+1] = {
        "Out of memory",
        "ObjectClass not found",
        "ObjectClass inappropriate SUPerior",
+       "ObjectClass operational",
        "AttributeType not found",
        "AttributeType inappropriate USAGE",
        "Duplicate objectClass",
@@ -118,7 +119,7 @@ parse_oc(
                return 1;
        }
 
-       code = oc_add(oc,&err);
+       code = oc_add(oc,1,&err);
        if ( code ) {
                fprintf( stderr, "%s: line %d: %s: \"%s\"\n",
                         fname, lineno, scherr2str(code), err);

diff --git a/servers/slapd/slap.h b/servers/slapd/slap.h
index 9f7a91ffd726aff3d4235458b32fac6d4284dc13..a8efb056e8807d0b20785add3b20c8b4ea6e8309 100644 (file)
--- a/servers/slapd/slap.h
+++ b/servers/slapd/slap.h
@@ -221,20 +221,21 @@ typedef struct slap_ssf_set {
 #define SLAP_SCHERR_OUTOFMEM           1
 #define SLAP_SCHERR_CLASS_NOT_FOUND    2
 #define SLAP_SCHERR_CLASS_BAD_USAGE    3
-#define SLAP_SCHERR_ATTR_NOT_FOUND     4
-#define SLAP_SCHERR_ATTR_BAD_USAGE     5
-#define SLAP_SCHERR_DUP_CLASS          6
-#define SLAP_SCHERR_DUP_ATTR           7
-#define SLAP_SCHERR_DUP_SYNTAX         8
-#define SLAP_SCHERR_DUP_RULE           9
-#define SLAP_SCHERR_NO_NAME            10
-#define SLAP_SCHERR_ATTR_INCOMPLETE    11
-#define SLAP_SCHERR_MR_NOT_FOUND       12
-#define SLAP_SCHERR_SYN_NOT_FOUND      13
-#define SLAP_SCHERR_MR_INCOMPLETE      14
-#define SLAP_SCHERR_NOT_SUPPORTED      15
-#define SLAP_SCHERR_BAD_DESCR          16
-#define SLAP_SCHERR_OIDM                       17
+#define SLAP_SCHERR_CLASS_OPERATIONAL 4
+#define SLAP_SCHERR_ATTR_NOT_FOUND     5
+#define SLAP_SCHERR_ATTR_BAD_USAGE     6
+#define SLAP_SCHERR_DUP_CLASS          7
+#define SLAP_SCHERR_DUP_ATTR           8
+#define SLAP_SCHERR_DUP_SYNTAX         9
+#define SLAP_SCHERR_DUP_RULE           10
+#define SLAP_SCHERR_NO_NAME                    11
+#define SLAP_SCHERR_ATTR_INCOMPLETE    12
+#define SLAP_SCHERR_MR_NOT_FOUND       13
+#define SLAP_SCHERR_SYN_NOT_FOUND      14
+#define SLAP_SCHERR_MR_INCOMPLETE      15
+#define SLAP_SCHERR_NOT_SUPPORTED      16
+#define SLAP_SCHERR_BAD_DESCR          17
+#define SLAP_SCHERR_OIDM                       18
 #define SLAP_SCHERR_LAST                       SLAP_SCHERR_OIDM
 
 typedef union slap_sockaddr {
@@ -492,14 +493,15 @@ typedef struct slap_object_class {
        struct slap_object_class        *soc_next;
 } ObjectClass;
 
-#define        SLAP_OC_ALIAS           0x01
-#define        SLAP_OC_REFERRAL        0x02
-#define        SLAP_OC_SUBENTRY        0x04
-#define        SLAP_OC_DYNAMICOBJECT   0x08
-#define        SLAP_OC_COLLECTIVEATTRIBUTESUBENTRY     0x10
-#define        SLAP_OC__MASK           0x1F
-#define        SLAP_OC__END            0x20
-#define SLAP_OC_HIDE           0x80
+#define        SLAP_OC_ALIAS           0x0001
+#define        SLAP_OC_REFERRAL        0x0002
+#define        SLAP_OC_SUBENTRY        0x0004
+#define        SLAP_OC_DYNAMICOBJECT   0x0008
+#define        SLAP_OC_COLLECTIVEATTRIBUTESUBENTRY     0x0010
+#define        SLAP_OC__MASK           0x001F
+#define        SLAP_OC__END            0x0020
+#define SLAP_OC_OPERATIONAL    0x4000
+#define SLAP_OC_HIDE           0x8000
 
 #ifdef LDAP_EXTENDED_SCHEMA
 /*