Handle wrong file ownership

diff --git a/ldap-server/config-redhat-linux b/ldap-server/config-redhat-linux
index 883452d..5d51655 100644 (file)
--- a/ldap-server/config-redhat-linux
+++ b/ldap-server/config-redhat-linux
@@ -7,3 +7,4 @@ start_cmd=/etc/init.d/ldap start
 stop_cmd=/etc/init.d/ldap stop
 apply_cmd=/etc/init.d/ldap restart
 init_name=ldap
+data_dir=/var/lib/ldap

diff --git a/ldap-server/config.info b/ldap-server/config.info
index cbbfe28..bce31ed 100644 (file)
--- a/ldap-server/config.info
+++ b/ldap-server/config.info
@@ -9,6 +9,7 @@ config_file=OpenLDAP server configuration file,8
 schema_dir=OpenLDAP schema directory,7
 ldap_user=User OpenLDAP server runs as,5
 init_name=OpenLDAP server boot script name,3,Same as module name
+data_dir=OpenLDAP database directory,3,Not known
 
 line2=User interface settings,11
 browse_max=Maximum number of sub-objects to display,3,Unlimited

diff --git a/ldap-server/defaultacl b/ldap-server/defaultacl
new file mode 100644 (file)
index 0000000..90264f7
--- /dev/null
+++ b/ldap-server/defaultacl
@@ -0,0 +1,7 @@
+slapd=1
+schema=1
+acl=1
+browser=1
+create=1
+start=1
+apply=1

diff --git a/ldap-server/index.cgi b/ldap-server/index.cgi
index ad1ce77..fad1dbd 100644 (file)
--- a/ldap-server/index.cgi
+++ b/ldap-server/index.cgi
@@ -42,9 +42,21 @@ elsif ($local == 0) {
                }
        }
 
+# Check if ldap directory permissions are correct
+$p = &check_ldap_permissions();
+if (!$p) {
+       print "<center>\n";
+       print &ui_form_start("perms.cgi");
+       print &text('index_permsdesc', "<tt>$config{'data_dir'}</tt>",
+                                      "<tt>$config{'ldap_user'}</tt>"),"<p>\n";
+       print &ui_form_end([ [ undef, $text{'index_perms'} ] ]);
+       print "</center>\n";
+       print "<hr>\n";
+       }
+
 # Check if need to init new install, by creating the root DN
 $ldap = &connect_ldap_db();
-if (ref($ldap) && $access{'browser'}) {
+if ($p && ref($ldap) && $access{'browser'}) {
        $conf = &get_config();
        $base = &find_value("suffix", $conf);
        $rv = $ldap->search(base => $base,

diff --git a/ldap-server/lang/en b/ldap-server/lang/en
index c6a9f8d..d447af0 100644 (file)
--- a/ldap-server/lang/en
+++ b/ldap-server/lang/en
@@ -14,6 +14,8 @@ index_boot=Start at boot?
 index_bootdesc=Change this selection to determine if the OpenLDAP server is started at boot time or not.
 index_setupdesc=Your LDAP server's database does not contain the root DN $1 yet, which means that no data can be added until you create it. However, Webmin can do this for you by clicking the button below.
 index_setup=Create Root DN
+index_permsdesc=The LDAP server data directory $1 contains files not owned by the correct user $2, which means that it is unlikely to start up properly. However, Webmin can fix this for you by clicking the button below.
+index_perms=Fix Ownership
 
 connect_eserver=The LDAP server $1 does not exist
 connect_euser=No user to login as has been configured
@@ -215,7 +217,7 @@ log_delete_attr=Deleted from object $2
 log_delete_attr_l=Deleted attribute $1 from object $2
 log_delete_attrs=Deleted $1 attributes from object $2
 log_stop=Stopped LDAP server
-log_start=Started LDAP Server
+log_start=Started LDAP server
 log_apply=Applied configuration
 log_slapd=Changed LDAP server configuration
 log_schema=Changed enabled LDAP schemas
@@ -223,6 +225,10 @@ log_gencert=Generated new SSL certificate
 log_sfile=Modified schema file $1
 log_sup=Moved up schema file $1
 log_sdown=Moved down schema file $1
+log_create=Created new DN $1
+log_bootup=Enabled LDAP server at boot
+log_bootdown=Disabled LDAP server at boot
+log_perms=Fixed LDAP server permissions
 
 gencert_title=Generate SSL Certificate
 gencert_header=New SSL certificate details
@@ -235,6 +241,8 @@ gencert_dir=Directory
 gencert_err=Failed to generate certificate
 gencert_edest=Destination directory does not exist
 
+perms_err=Failed to fix file ownership
+
 acl_slapd=Can configure LDAP server?
 acl_schema=Can manage schema?
 acl_acl=Can edit access control?

diff --git a/ldap-server/ldap-server-lib.pl b/ldap-server/ldap-server-lib.pl
index e33c5e3..4f42176 100644 (file)
--- a/ldap-server/ldap-server-lib.pl
+++ b/ldap-server/ldap-server-lib.pl
@@ -1,7 +1,6 @@
 # Functions for configuring and talking to an LDAP server
 # XXX help pages
 # XXX acl section
-# XXX /var/lib/ldap/* files are owned by root on redhat
 
 do '../web-lib.pl';
 &init_config();
@@ -375,5 +374,28 @@ return sort { $b->{'core'} <=> $a->{'core'} ||
              $a->{'name'} cmp $b->{'name'} } @rv;
 }
 
+# check_ldap_permissions()
+# Returns 1 if ownership of the data dir is correct, 0 if not, -1 if not known
+sub check_ldap_permissions
+{
+local @uinfo;
+if ($config{'data_dir'} && $config{'ldap_user'} &&
+    defined(@uinfo = getpwnam($config{'ldap_user'}))) {
+       opendir(DATADIR, $config{'data_dir'});
+       local @datafiles = grep { !/^\./ } readdir(DATADIR);
+       closedir(DATADIR);
+       if (@datafiles) {
+               local @st = stat("$config{'data_dir'}/$datafiles[0]");
+               if ($st[4] != $uinfo[2]) {
+                       return 0;
+                       }
+               }
+       return 1;
+       }
+else {
+       return -1;
+       }
+}
+
 1;
 

diff --git a/ldap-server/log_parser.pl b/ldap-server/log_parser.pl
index f95af7e..8458451 100644 (file)
--- a/ldap-server/log_parser.pl
+++ b/ldap-server/log_parser.pl
@@ -35,6 +35,9 @@ elsif ($type eq 'attrs') {
 elsif ($action eq 'sfile' || $action eq 'sup' || $action eq 'sdown') {
        return &text('log_'.$action, "<tt>".&html_escape($object)."</tt>");
        }
+elsif ($action eq 'boot') {
+       return $object ? $text{'log_bootup'} : $text{'log_bootdown'};
+       }
 else {
        return $text{'log_'.$action};
        }

diff --git a/ldap-server/perms.cgi b/ldap-server/perms.cgi
new file mode 100644 (file)
index 0000000..40f301f
--- /dev/null
+++ b/ldap-server/perms.cgi
@@ -0,0 +1,17 @@
+#!/usr/local/bin/perl
+# Fix file ownership, and then restart if running
+
+require './ldap-server-lib.pl';
+&ReadParse();
+&error_setup($text{'perms_err'});
+$access{'slapd'} || &error($text{'slapd_ecannot'});
+
+&system_logged("chown -R $config{'ldap_user'} ".quotemeta($config{'data_dir'}));
+if (&is_ldap_server_running()) {
+       &stop_ldap_server();
+       $err = &start_ldap_server();
+       &error($err) if ($err);
+       }
+&webmin_log("perms");
+&redirect("");
+