The OpenLDAP server startup script /usr/sbin/rcldap does some optional ownership/access mode checks and provides a hook to check the ldap database before starting slapd. This is done by parsing/checking /etc/openldap/slapd.conf. However, configuration file syntax permits the inclusion of arbitrary bits of configuration from other files. These files need to be checked for permissions too, and need to be scanned to list all database directories, too.