Bug 518084 - Fix out of order retro changelog entries

When using the retro changelog plugin, post-op plugins that perform
internal operations (such as memberOf) can result in the internal
operation preceeding the original operation in the changelog.

The fix is to give the retro changelog a higher precedence than the
other post-op plugins.  This required some core server changes to
be made around the plugin precedence to allow an object plugin to
pass it's precedence into it's calls to slapi_register_plugin()
when it registers other plugin types.

I added an update LDIF to set the plugin precedence when running
"setup-ds.pl -u".  I also noticed an AVC when restarting after the
update due to the schema.bak directory that is created.  I've
adjusted the dirsrv SELinux policy to deal with this AVC.

Makefile.am

@@ -425,6 +425,7 @@ update_DATA = ldap/admin/src/scripts/exampleupdate.pl \
 	ldap/admin/src/scripts/50linkedattrsplugin.ldif \
 	ldap/admin/src/scripts/50usnplugin.ldif \
 	ldap/admin/src/scripts/50smd5pwdstorageplugin.ldif \
+	ldap/admin/src/scripts/50retroclprecedence.ldif \
 	ldap/admin/src/scripts/60upgradeschemafiles.pl \
 	ldap/admin/src/scripts/dnaplugindepends.ldif
 

Makefile.in

@@ -1475,6 +1475,7 @@ update_DATA = ldap/admin/src/scripts/exampleupdate.pl \
 	ldap/admin/src/scripts/50linkedattrsplugin.ldif \
 	ldap/admin/src/scripts/50usnplugin.ldif \
 	ldap/admin/src/scripts/50smd5pwdstorageplugin.ldif \
+	ldap/admin/src/scripts/50retroclprecedence.ldif \
 	ldap/admin/src/scripts/60upgradeschemafiles.pl \
 	ldap/admin/src/scripts/dnaplugindepends.ldif
 

ldap/admin/src/scripts/50retroclprecedence.ldif

@@ -0,0 +1,4 @@
+dn: cn=Retro Changelog Plugin,cn=plugins,cn=config
+changetype: modify
+replace: nsslapd-pluginPrecedence
+nsslapd-pluginPrecedence: 25

ldap/ldif/template-dse.ldif.in

@@ -568,6 +568,7 @@ nsslapd-pluginpath: libretrocl-plugin
 nsslapd-plugininitfunc: retrocl_plugin_init
 nsslapd-plugintype: object
 nsslapd-pluginenabled: off
+nsslapd-pluginprecedence: 25
 nsslapd-plugin-depends-on-type: database
 nsslapd-plugin-depends-on-named: Class of Service
 

ldap/servers/plugins/retrocl/retrocl.c

@@ -375,20 +375,23 @@ retrocl_plugin_init(Slapi_PBlock *pb)
 {
   	static int legacy_initialised= 0;
     	int rc = 0;
+	int precedence = 0;
 	void *identity = NULL;
 
 	slapi_pblock_get (pb, SLAPI_PLUGIN_IDENTITY, &identity);
 	PR_ASSERT (identity);
 	g_plg_identity[PLUGIN_RETROCL] = identity;
+
+	slapi_pblock_get( pb, SLAPI_PLUGIN_PRECEDENCE, &precedence );
     
 	if (!legacy_initialised) {
 	  rc= slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_01 );
 	  rc= slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION, (void *)&retrocldesc );
 	  rc= slapi_pblock_set( pb, SLAPI_PLUGIN_START_FN, (void *) retrocl_start );
 	  rc= slapi_pblock_set( pb, SLAPI_PLUGIN_CLOSE_FN, (void *) retrocl_stop );
-	  
-	  rc= slapi_register_plugin("postoperation", 1 /* Enabled */, "retrocl_postop_init", retrocl_postop_init, "Retrocl postoperation plugin", NULL, identity);
-	  rc= slapi_register_plugin("internalpostoperation", 1 /* Enabled */, "retrocl_internalpostop_init", retrocl_internalpostop_init, "Retrocl internal postoperation plugin", NULL, identity);
+
+	  rc= slapi_register_plugin_ext("postoperation", 1 /* Enabled */, "retrocl_postop_init", retrocl_postop_init, "Retrocl postoperation plugin", NULL, identity, precedence);
+	  rc= slapi_register_plugin_ext("internalpostoperation", 1 /* Enabled */, "retrocl_internalpostop_init", retrocl_internalpostop_init, "Retrocl internal postoperation plugin", NULL, identity, precedence);
 	}
 	
     legacy_initialised = 1;

ldap/servers/slapd/pblock.c

@@ -460,6 +460,9 @@ slapi_pblock_get( Slapi_PBlock *pblock, int arg, void *value )
 	case SLAPI_PLUGIN_VERSION:
 		(*(char **)value) = pblock->pb_plugin->plg_version;
 		break;
+	case SLAPI_PLUGIN_PRECEDENCE:
+		(*(int *)value) = pblock->pb_plugin->plg_precedence;
+		break;
 	case SLAPI_PLUGIN_OPRETURN:
 		(*(int *)value) = pblock->pb_opreturn;
 		break;
@@ -1779,6 +1782,9 @@ slapi_pblock_set( Slapi_PBlock *pblock, int arg, void *value )
 	case SLAPI_PLUGIN_VERSION:
 		pblock->pb_plugin->plg_version = (char *) value;
 		break;
+	case SLAPI_PLUGIN_PRECEDENCE:
+		pblock->pb_plugin->plg_precedence = *((int *) value;
+		break;
 	case SLAPI_PLUGIN_OPRETURN:
 		pblock->pb_opreturn = *((int *) value);
 		break;

ldap/servers/slapd/plugin.c

@@ -241,14 +241,30 @@ add_plugin_entry_dn(const Slapi_DN *plugin_dn)
  */
 int
 slapi_register_plugin(
-    const char *plugintype,
+	const char *plugintype,
 	int enabled,
 	const char *initsymbol,
 	slapi_plugin_init_fnptr initfunc,
-	const char *name, 
-    char **argv,
+	const char *name,
+	char **argv,
 	void *group_identity
 )
+{
+	return slapi_register_plugin_ext(plugintype, enabled, initsymbol,
+			initfunc, name, argv, group_identity, PLUGIN_DEFAULT_PRECEDENCE);
+}
+
+int
+slapi_register_plugin_ext(
+	const char *plugintype,
+	int enabled,
+	const char *initsymbol,
+	slapi_plugin_init_fnptr initfunc,
+	const char *name, 
+	char **argv,
+	void *group_identity,
+	int precedence
+)
 {
 	int ii = 0;
     int rc = 0;
@@ -263,6 +279,7 @@ slapi_register_plugin(
 		slapi_entry_attr_set_charptr(e, ATTR_PLUGIN_ENABLED, "off");
 
 	slapi_entry_attr_set_charptr(e, ATTR_PLUGIN_INITFN, initsymbol);
+	slapi_entry_attr_set_int(e, ATTR_PLUGIN_PRECEDENCE, precedence);
 
 	for (ii = 0; argv && argv[ii]; ++ii) {
 		char argname[64];

ldap/servers/slapd/slapi-plugin.h

@@ -2616,6 +2616,9 @@ int slapi_register_plugin( const char *plugintype, int enabled,
 	const char *initsymbol, slapi_plugin_init_fnptr initfunc,
 	const char *name, char **argv, void *group_identity);
 
+int slapi_register_plugin_ext( const char *plugintype, int enabled,
+	const char *initsymbol, slapi_plugin_init_fnptr initfunc,
+	const char *name, char **argv, void *group_identity, int precedence);
 
 /*
  * logging
@@ -3130,6 +3133,7 @@ typedef struct slapi_plugindesc {
 } Slapi_PluginDesc;
 
 #define SLAPI_PLUGIN_IDENTITY                   13
+#define SLAPI_PLUGIN_PRECEDENCE			14
 
 /* common for internal plugin_ops */
 #define SLAPI_PLUGIN_INTOP_RESULT		15

selinux/dirsrv.te

@@ -123,6 +123,7 @@ files_lock_filetrans(dirsrv_t, dirsrv_var_lock_t, { file })
 
 # config files
 manage_files_pattern(dirsrv_t, dirsrv_config_t, dirsrv_config_t)
+manage_dirs_pattern(dirsrv_t, dirsrv_config_t, dirsrv_config_t)
 
 # tmp files
 manage_files_pattern(dirsrv_t, dirsrv_tmp_t, dirsrv_tmp_t)