slapo-nssov not able to write socket file

Bug #508190 reported by ben thielsen
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
openldap (Ubuntu)
Fix Released
Medium
Unassigned

Bug Description

the nss overlay attempts to write it's socket file to /var/run/nslcd/socket, but is prevented from doing so by apparmor:

type=1503 audit(1263524239.632:23): operation="mknod" pid=17179 parent=1 profile="/usr/sbin/slapd" requested_mask="w::" denied_mask="w::" fsuid=107 ouid=107 name="/var/run/nslcd/socket"

adjusting /etc/apparmor/usr.sbin.slapd to accommodate this resolves the issue:

  # pid files and sockets
  /var/run/slapd/* w,
  /var/run/nslcd/* w,

additionally, i don't believe that the slapd package created the /var/run/nslcd/ directory:

drwxr-xr-x 2 openldap openldap 80 2010-01-15 18:28 /var/run/nslcd/

Tags: apparmor

Related branches

Revision history for this message
ben thielsen (btb-bitrate) wrote :

i neglected to include the following information:

source package: 2.4.18-0ubuntu1

>lsb_release -rd
Description: Ubuntu 9.10
Release: 9.10

>apt-cache policy slapd
slapd:
  Installed: 2.4.18-0ubuntu1
  Candidate: 2.4.18-0ubuntu1
  Version table:
 *** 2.4.18-0ubuntu1 0
        500 http://us.archive.ubuntu.com karmic/main Packages
        100 /var/lib/dpkg/status

Chuck Short (zulcss)
tags: added: apparmor
Chuck Short (zulcss)
Changed in openldap (Ubuntu):
importance: Undecided → Medium
status: New → Confirmed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package openldap - 2.4.21-0ubuntu2

---------------
openldap (2.4.21-0ubuntu2) lucid; urgency=low

  * debian/apparmor-profile: Update apparmor profile. (LP: #508190)
 -- Chuck Short <email address hidden> Tue, 09 Mar 2010 13:33:35 -0500

Changed in openldap (Ubuntu):
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.