Date: Tue, 16 May 2000 06:48:05 -0500 (CDT) From: Frank Tobin <ftobin@uiuc.edu> To: FreeBSD-security Mailing List <freebsd-security@freebsd.org> Subject: pid file for named Message-ID: <Pine.BSF.4.21.0005160634430.21765-100000@srh0902.urh.uiuc.edu>
next in thread | raw e-mail | index | archive | help
One often wishes to run daemons such as named under other users, e.g., bind:bind. In order to allow bind to write out zones and associated fun stuff correctly, one then does a chmod -R bind:bind /etc/named However, the pid file, /var/run/named.pid, which named tries to write out one cannot give the proper permissions for, because it resides in a root-owned directory /var/run. Granted, named writes out this file before it drops privileges, and doesn't need to re-write this file when it reloads, even though it tries and complains about not being able to because it has dropped privileges. However, at some time we (FreeBSD community) may wish to have a named setup where the we don't have to rely on named dropping its privileges; the better solution of course is to only start it with the proper privileges, and the low-port allocation bit will be handled by a proper capabilities/ACL setup. If we ever move to this setup, where named is started with the lowered-permissions already, it will not be able to write out its pid file correctly. Hence, my suggestion is that the PID file for named be /var/run/named/named.pid. Having this be the location will solve two problems, the minor one of named complaining about not being able to write out it's pid file when reloading, and the future-possibility problem if named is started with lowered-privs, instead of having it drop privs. If we fix it now we don't have to worry about it later. Note that this change we may wish to have changed for many of our daemons (I already put apache's runtime stuff in /var/run/apache/, even though it runs as root). -- Frank Tobin http://www.uiuc.edu/~ftobin/ "To learn what is good and what is to be valued, those truths which cannot be shaken or changed." Myst: The Book of Atrus To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0005160634430.21765-100000>