Kolab setup needs to change slapd apparmor profile

[Stefan Hamminga]

Binary package hint: kolabd

after installing the kolabd packages, including slapd, on Ubuntu Server i386 Jaunty (2009-04-6-7) I needed to run 'kolab_bootstrap -b' to generate a default config. This failes with a message containing '/etc/kolab/rootDSE.ldif: Permission denied'.

After checking all permissions I found out slapd is protected with Apparmor and the '/etc/kolab/' directory was not present in the allowed list. Adding it indeed enabled kolab_bootstrap to continue.

[Alvin (alvind)]

Workaround (quoted from http://kolab.org/pipermail/kolab-users/2008-May/007953.html)

Edit /etc/apparmor.d/usr.sbin.slapd and add
the following lines:

/usr/share/kolabd/schema/ r,
/usr/share/kolabd/schema/* r,
/etc/kolab/ r,
/etc/kolab/* r,

[Mathias Gug (mathiaz)]

Does kolab uses the cn=config to manage the configuration of slapd?

[Chuck Short (zulcss)]

We'd like to figure out what's causing this bug for you, but we haven't heard back from you in a while. Could you please provide the requested information? Thanks!

[Blackpaw (blackpaw)]

Hi Chuck, I ran into this problem to - what was it you wanted to know? because Stefan reported the cause (apparmor config) and Alvin gave a workaround.

[Alex (alepot-org23)]

Bug still present in 10.04 i386

[Gryphis (gryphis)]

After the workaround a 'service apparmor reload' is necessary.
It would be nice to remove the bug now in Maverick Meerkat.
Thanks.

[FriedChicken (domlyons)]

Confirmed for Natty, too

[Jamie Strandboge (jdstrand)]

Are these rules still all that is needed to fix this bug (see comment #1)?
/usr/share/kolabd/schema/ r,
/usr/share/kolabd/schema/* r,
/etc/kolab/ r,
/etc/kolab/* r,

[Launchpad Janitor (janitor)]

[Expired for openldap (Ubuntu) because there has been no activity for 60 days.]