Bug 258917

Summary: net/openldap24-server: OTP unavailable because can't read/write key database /etc/opiekeys: Permission denied
Product: Ports & Packages Reporter: martin
Component: Individual Port(s)Assignee: Xin LI <delphij>
Status: Closed Overcome By Events    
Severity: Affects Only Me Flags: bugzilla: maintainer-feedback? (delphij)
Priority: ---    
Version: Latest   
Hardware: Any   
OS: Any   

Description martin 2021-10-04 11:34:07 UTC
Since version 2.4.59, I'm seeing many of these warnings in /var/log/messages.  I'm now running openldap24-server-2.4.59_5 from FreeBSD 11.4 pkgs and rc.conf contains:

slapd_enable="YES"
slapd_flags='-l DAEMON -h "ldapi://%2fvar%2frun%2fopenldap%2fldapi/ ldap://0.0.0.0/"'
slapd_sockets="/var/run/openldap/ldapi"

The backtrace is

#0  syslog (pri=35, fmt=0x80122bd99 "%s")
    at /usr/src/lib/libc/gen/syslog.c:127
#1  0x000000080121f5f7 in sasl_errdetail () from /usr/local/lib/libsasl2.so.3
#2  0x000000080121febc in _sasl_log () from /usr/local/lib/libsasl2.so.3
#3  0x0000000803831eee in otp_client_plug_init ()
   from /usr/local/lib/sasl2/libotp.so.3
#4  0x000000080122629c in sasl_server_start ()
   from /usr/local/lib/libsasl2.so.3
#5  0x0000000801226b3f in _sasl_server_listmech ()
   from /usr/local/lib/libsasl2.so.3
#6  0x00000008012202bb in sasl_listmech () from /usr/local/lib/libsasl2.so.3
#7  0x000000000048012b in slap_sasl_mechs ()
#8  0x000000000047e963 in root_dse_info ()
#9  0x0000000000432760 in fe_op_search ()
#10 0x0000000000432533 in do_search ()
#11 0x0000000000430f83 in connection_assign_nextid ()
#12 0x0000000800946f7b in ldap_pvt_thread_pool_submit ()
   from /usr/local/lib/libldap_r-2.4.so.2
#13 0x0000000801e7e08c in thread_start (curthread=0x84520f000)
    at /usr/src/lib/libthr/thread/thr_create.c:290
#14 0x0000000000000000 in ?? ()

The problem is that the pkg runs slapd as user ldap by default but the file is only accessible by root so it can't work:

-rw-------  1 root  wheel  0 Oct 13  2020 /etc/opiekeys
Comment 1 Xin LI freebsd_committer freebsd_triage 2022-10-02 01:52:49 UTC
OPIE is removed from base.