Date: Thu, 23 Aug 2001 18:27:49 +0100 From: Brian Somers <brian@Awfulhak.org> To: Matt Dillon <dillon@earth.backplane.com> Cc: "Andrey A. Chernov" <ache@nagual.pp.ru>, Brian Somers <brian@Awfulhak.org>, Jun Kuriyama <kuriyama@FreeBSD.ORG>, cvs-committers@FreeBSD.ORG, cvs-all@FreeBSD.ORG, brian@freebsd-services.com, brian@freebsd-services.com Subject: Re: cvs commit: src/etc/defaults rc.conf src/etc/mtree BSD.var.dist src/etc/namedb named.conf Message-ID: <200108231727.f7NHRng82227@hak.lan.Awfulhak.org> In-Reply-To: Message from Matt Dillon <dillon@earth.backplane.com> of "Thu, 23 Aug 2001 09:45:34 PDT." <200108231645.f7NGjYe86993@earth.backplane.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> > I like the idea of, finally, invoking named in a sandbox. I don't > understand why the pidfile location has to change, though. named > creates its pidfile as root before it setuid's itself. > > While it is true that named cannot rescan interfaces when operating > in this mode, this restriction has never been an impediment to anything > I've ever done with it. Most dialup users don't run named, they simply > allow ppp to setup /etc/resolv.conf for them. Those who do will be savvy > enough to add the appropriate override to /etc/rc.conf (or won't have to > if they don't bother to mergemaster the new default rc files). > > I know it isn't a perfect solution, but we *REALLY* need to secure > named this time around. It is years past the time we should have done > it. The only problem I have with the change is that people who currently have ``named_enable=YES'' in their /etc/rc.conf will have broken configurations when they update. If this change goes in, I won't argue as long as it's *NOT* MFC'd. > -Matt > > :> > > Invoke named with privilege of bind:bind. > :> > > Change pidfile location to /var/run/named/pid. > :> > > :> > Is it discussed or I miss something? We already have an option to run it > :> > in bind sandbox, but as non-default option. Some functions not works in > :> > bind sandbox, I don't remember exactly at this moment. > :> > :> named won't be able to listen on interface addresses that are not > :> configured when named is invoked. This can break name services on a > :> dialup server quite badly. > : > :Yes, exact this thing. > : > :> I think this change should be reverted. > : > :I too. > :If named allows root compromise, better fix named. > : > :-- > :Andrey A. Chernov > :http://ache.pp.ru/ -- Brian <brian@freebsd-services.com> <brian@Awfulhak.org> http://www.freebsd-services.com/ <brian@[uk.]FreeBSD.org> Don't _EVER_ lose your sense of humour ! <brian@[uk.]OpenBSD.org> To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200108231727.f7NHRng82227>