From owner-freebsd-net@FreeBSD.ORG Tue Aug 29 09:20:11 2006 Return-Path: X-Original-To: net@freebsd.org Delivered-To: freebsd-net@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9E2BF16A4E0 for ; Tue, 29 Aug 2006 09:20:11 +0000 (UTC) (envelope-from simon@zaphod.nitro.dk) Received: from mx.nitro.dk (zarniwoop.nitro.dk [83.92.207.38]) by mx1.FreeBSD.org (Postfix) with ESMTP id 13F3843D45 for ; Tue, 29 Aug 2006 09:20:11 +0000 (GMT) (envelope-from simon@zaphod.nitro.dk) Received: from zaphod.nitro.dk (unknown [192.168.3.39]) by mx.nitro.dk (Postfix) with ESMTP id 2246E32E431; Tue, 29 Aug 2006 09:20:10 +0000 (UTC) Received: by zaphod.nitro.dk (Postfix, from userid 3000) id 0C2891141D; Tue, 29 Aug 2006 11:20:09 +0200 (CEST) Date: Tue, 29 Aug 2006 11:20:09 +0200 From: "Simon L. Nielsen" To: Jeremie Le Hen Message-ID: <20060829092009.GC982@zaphod.nitro.dk> References: <44EF6E18.6090905@elischer.org> <44EF74CD.6080500@elischer.org> <20060829085001.GB982@zaphod.nitro.dk> <20060829090148.GD15761@obiwan.tataz.chchile.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20060829090148.GD15761@obiwan.tataz.chchile.org> User-Agent: Mutt/1.5.11 Cc: Julian Elischer , FreeBSD Net Subject: Re: [fbsd] Re: possible patch for implementing split DNS X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Aug 2006 09:20:11 -0000 On 2006.08.29 11:01:48 +0200, Jeremie Le Hen wrote: Hey, > On Tue, Aug 29, 2006 at 10:50:02AM +0200, Simon L. Nielsen wrote: > > On 2006.08.25 15:08:13 -0700, Julian Elischer wrote: > > Since a bunch of people have suggested other solutions I just wanted > > to add me 0.01$CURRENCY, FWIW. > > > > Other than missing update for some manual page (not sure where this > > should go) I don't see a problem adding this patch. "Normal" users > > should be able already get similar functionality already by simply > > preloading a custom patched libc, so I don't see a problem supporting > > this. > > I agree with this statement. If users really want to, they can > compile their own libc. However, nectar@ has added the following > comment in nsdispatch.c: > > % #if defined(_NSS_DEBUG) && defined(_NSS_SHOOT_FOOT) > % /* NOTE WELL: THIS IS A SECURITY HOLE. This must only be built > % * for debugging purposes and MUST NEVER be used in production. > % */ > % path = getenv("NSSWITCH_CONF"); > % if (path == NULL) > % #endif > % path = _PATH_NS_CONF; > > We should remove this #if clause because of your argument. I'm not sure > it is worth documenting it however. Well, nsswitch is part of the user authentication framework (I think), so I'm not entirely sure if exactly the same argument can be used safely. I never really had a need to look at nsswitch, so I don't know if it's used in contexts (other than set[ug]id) where overriding nsswitch.conf can cause problems. At least if that #if is removed it's probably required to add a issetugid() check. -- Simon L. Nielsen