From bec0946cca1a74b11ca7f93c7a7290b29f3296e0 Mon Sep 17 00:00:00 2001
From: Howard Chu <hyc@openldap.org>
Date: Tue, 10 Sep 2024 17:41:39 +0100
Subject: [PATCH] ITS#10256 cn=config: reject modify requests on
 cn=schema,cn=config

Add requests already handled it specially; corresponding treatment
for modify requests was missing. The docs have always stated that
cn=schema,cn=config is only for slapd's hardcoded schema so this
only affects users who don't read docs.
---
 servers/slapd/bconfig.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c
index 45e2eb5e3f..1876106d6b 100644
--- a/servers/slapd/bconfig.c
+++ b/servers/slapd/bconfig.c
@@ -6302,6 +6302,12 @@ config_back_modify( Operation *op, SlapReply *rs )
 		goto out;
 	}
 
+	/* global schema rejects all writes */
+	if ( ce->ce_type == Cft_Schema && ce->ce_parent->ce_type == Cft_Global ) {
+		rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
+		goto out;
+	}
+
 	if ( !acl_check_modlist( op, ce->ce_entry, op->orm_modlist )) {
 		rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
 		goto out;