From owner-cvs-all Thu Aug 23 10:28: 8 2001 Delivered-To: cvs-all@freebsd.org Received: from Awfulhak.org (gw.Awfulhak.org [217.204.245.18]) by hub.freebsd.org (Postfix) with ESMTP id 185D237B409; Thu, 23 Aug 2001 10:27:49 -0700 (PDT) (envelope-from brian@Awfulhak.org) Received: from hak.lan.Awfulhak.org (root@hak.lan.Awfulhak.org [fec0::1:12]) by Awfulhak.org (8.11.5/8.11.5) with ESMTP id f7NHRxv37907; Thu, 23 Aug 2001 18:27:59 +0100 (BST) (envelope-from brian@Awfulhak.org) Received: from hak.lan.Awfulhak.org (brian@localhost [127.0.0.1]) by hak.lan.Awfulhak.org (8.11.4/8.11.4) with ESMTP id f7NHRng82227; Thu, 23 Aug 2001 18:27:49 +0100 (BST) (envelope-from brian@hak.lan.Awfulhak.org) Message-Id: <200108231727.f7NHRng82227@hak.lan.Awfulhak.org> X-Mailer: exmh version 2.5 07/13/2001 with nmh-1.0.4 To: Matt Dillon Cc: "Andrey A. Chernov" , Brian Somers , Jun Kuriyama , cvs-committers@FreeBSD.ORG, cvs-all@FreeBSD.ORG, brian@freebsd-services.com, brian@freebsd-services.com Subject: Re: cvs commit: src/etc/defaults rc.conf src/etc/mtree BSD.var.dist src/etc/namedb named.conf In-Reply-To: Message from Matt Dillon of "Thu, 23 Aug 2001 09:45:34 PDT." <200108231645.f7NGjYe86993@earth.backplane.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Thu, 23 Aug 2001 18:27:49 +0100 From: Brian Somers Sender: owner-cvs-all@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG > > I like the idea of, finally, invoking named in a sandbox. I don't > understand why the pidfile location has to change, though. named > creates its pidfile as root before it setuid's itself. > > While it is true that named cannot rescan interfaces when operating > in this mode, this restriction has never been an impediment to anything > I've ever done with it. Most dialup users don't run named, they simply > allow ppp to setup /etc/resolv.conf for them. Those who do will be savvy > enough to add the appropriate override to /etc/rc.conf (or won't have to > if they don't bother to mergemaster the new default rc files). > > I know it isn't a perfect solution, but we *REALLY* need to secure > named this time around. It is years past the time we should have done > it. The only problem I have with the change is that people who currently have ``named_enable=YES'' in their /etc/rc.conf will have broken configurations when they update. If this change goes in, I won't argue as long as it's *NOT* MFC'd. > -Matt > > :> > > Invoke named with privilege of bind:bind. > :> > > Change pidfile location to /var/run/named/pid. > :> > > :> > Is it discussed or I miss something? We already have an option to run it > :> > in bind sandbox, but as non-default option. Some functions not works in > :> > bind sandbox, I don't remember exactly at this moment. > :> > :> named won't be able to listen on interface addresses that are not > :> configured when named is invoked. This can break name services on a > :> dialup server quite badly. > : > :Yes, exact this thing. > : > :> I think this change should be reverted. > : > :I too. > :If named allows root compromise, better fix named. > : > :-- > :Andrey A. Chernov > :http://ache.pp.ru/ -- Brian http://www.freebsd-services.com/ Don't _EVER_ lose your sense of humour ! To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message