#47601 Plugin library path validation prevents intentional loading of out-of-tree modules
Closed: wontfix None Opened 10 years ago by nalin.

Ticket #47384 adds some sanity testing to the value of nsslapd-pluginPath when a plugin entry is added or modified. This is tripping up the slapi-nis self-tests which involve modifying the plugin entry (the plugin entry is added to dse.ldif offline), as the server now returns an unwilling-to-perform error in response to the modify request when it succeeded before.

I think that any of these would work:

  • When checking a modify request, only sanity-check nsslapd-pluginPath when it shows up in the list of mods.
  • Add a run-time-configurable whitelist of locations where plugins could be found.
  • Replace the pathname check with an stat() call or a dlopen(RTLD_NOW) equivalent, to see if it can be loaded (with dlopen() followed by an immediate dlclose()).

git merge ticket47601
Updating 9c6e9bb..d8e8a90
Fast-forward
Makefile.am | 3 ++-
Makefile.in | 6 ++++--
ldap/servers/slapd/dynalib.c | 2 +-
ldap/servers/slapd/fedse.c | 9 ++++++---
4 files changed, 13 insertions(+), 7 deletions(-)

git push origin master
Counting objects: 17, done.
Delta compression using up to 4 threads.
Compressing objects: 100% (9/9), done.
Writing objects: 100% (9/9), 1.27 KiB, done.
Total 9 (delta 7), reused 0 (delta 0)
To ssh://git.fedorahosted.org/git/389/ds.git
9c6e9bb..d8e8a90 master -> master

commit d8e8a90
Author: Mark Reynolds mreynolds@redhat.com
Date: Wed Dec 11 16:13:11 2013 -0500

git push origin 389-ds-base-1.3.2

37d922f..a2fa1cb 389-ds-base-1.3.2 -> 389-ds-base-1.3.2

Metadata Update from @nkinder:
- Issue assigned to mreynolds
- Issue set to the milestone: 1.3.2.9

7 years ago

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/938

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata Update from @spichugi:
- Issue close_status updated to: wontfix (was: Fixed)

3 years ago

Login to comment on this ticket.

Metadata