From owner-freebsd-net@FreeBSD.ORG  Wed Dec 27 22:00:26 2006
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: net@freebsd.org
Delivered-To: freebsd-net@FreeBSD.ORG
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 17AE516A403
	for <net@freebsd.org>; Wed, 27 Dec 2006 22:00:26 +0000 (UTC)
	(envelope-from skip.ford@verizon.net)
Received: from vms042pub.verizon.net (vms042pub.verizon.net [206.46.252.42])
	by mx1.freebsd.org (Postfix) with ESMTP id DCEE613C46E
	for <net@freebsd.org>; Wed, 27 Dec 2006 22:00:25 +0000 (UTC)
	(envelope-from skip.ford@verizon.net)
Received: from pool-71-168-196-193.pskn.east.verizon.net ([71.168.196.193])
	by vms042.mailsrvcs.net
	(Sun Java System Messaging Server 6.2-6.01 (built Apr  3 2006))
	with ESMTPA id <0JAY000KSD4L5J54@vms042.mailsrvcs.net> for
	net@freebsd.org; Wed, 27 Dec 2006 16:00:22 -0600 (CST)
Date: Wed, 27 Dec 2006 17:00:19 -0500
From: Skip Ford <skip.ford@verizon.net>
In-reply-to: <4592AED6.4040508@ab.ote.we.lv>
To: "Eugene M. Kim" <freebsd.org@ab.ote.we.lv>
Message-id: <20061227220019.GA1044@lucy.menantico.com>
MIME-version: 1.0
Content-type: text/plain; charset=us-ascii
Content-disposition: inline
References: <4592AED6.4040508@ab.ote.we.lv>
User-Agent: Mutt/1.4.2.1i
Cc: net@freebsd.org
Subject: Re: BIND running setuid with interface changes
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 27 Dec 2006 22:00:26 -0000

Eugene M. Kim wrote:
[snip]
> Then, when a new address comes up (such as on a dynamically created L2TP
> tun(4) interface), BIND tries to listen on it, but fails because it is
> running setuid as bind:
> 
> Dec 27 02:32:00 home named[1121]: listening on IPv4 interface tun0, 10.0.2.129#53
> Dec 27 02:32:00 home named[1121]: could not listen on UDP socket: permission denied
> 
> The only workarounds that I can think of is either to run BIND as setuid
> root, or to restart (not reload) BIND every time a new VPN connection
> comes up, both of which I am not comfortable with.
> 
> Any better ideas?

mac_portacl(4)

http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/mac-portacl.html

-- 
Skip