From owner-cvs-all  Thu Aug 23  7:55:32 2001
Delivered-To: cvs-all@freebsd.org
Received: from nagual.pp.ru (pobrecita.freebsd.ru [194.87.13.42])
	by hub.freebsd.org (Postfix) with ESMTP
	id 3DFC637B403; Thu, 23 Aug 2001 07:55:25 -0700 (PDT)
	(envelope-from ache@nagual.pp.ru)
Received: (from ache@localhost)
	by nagual.pp.ru (8.11.6/8.11.6) id f7NEtGN28235;
	Thu, 23 Aug 2001 18:55:16 +0400 (MSD)
	(envelope-from ache)
Date: Thu, 23 Aug 2001 18:55:15 +0400
From: "Andrey A. Chernov" <ache@nagual.pp.ru>
To: Brian Somers <brian@Awfulhak.org>
Cc: Jun Kuriyama <kuriyama@FreeBSD.org>, cvs-committers@FreeBSD.org,
	cvs-all@FreeBSD.org, brian@freebsd-services.com
Subject: Re: cvs commit: src/etc/defaults rc.conf src/etc/mtree BSD.var.dist src/etc/namedb named.conf
Message-ID: <20010823185515.A28168@nagual.pp.ru>
References: <ache@nagual.pp.ru> <20010823174457.A27360@nagual.pp.ru> <200108231413.f7NEDvg71094@hak.lan.Awfulhak.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <200108231413.f7NEDvg71094@hak.lan.Awfulhak.org>
User-Agent: Mutt/1.3.21i
Sender: owner-cvs-all@FreeBSD.ORG
Precedence: bulk
List-ID: <cvs-all.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20cvs-all>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20cvs-all>
X-Loop: FreeBSD.ORG

On Thu, Aug 23, 2001 at 15:13:57 +0100, Brian Somers wrote:
> > On Thu, Aug 23, 2001 at 06:34:46 -0700, Jun Kuriyama wrote:
> > > kuriyama    2001/08/23 06:34:46 PDT
> > > 
> > >   Modified files:
> > >     etc/defaults         rc.conf 
> > >     etc/mtree            BSD.var.dist 
> > >     etc/namedb           named.conf 
> > >   Log:
> > >   Invoke named with privilege of bind:bind.
> > >   Change pidfile location to /var/run/named/pid.
> > 
> > Is it discussed or I miss something? We already have an option to run it
> > in bind sandbox, but as non-default option. Some functions not works in
> > bind sandbox, I don't remember exactly at this moment.
> 
> named won't be able to listen on interface addresses that are not 
> configured when named is invoked.  This can break name services on a 
> dialup server quite badly.

Yes, exact this thing.

> I think this change should be reverted.

I too.
If named allows root compromise, better fix named.

-- 
Andrey A. Chernov
http://ache.pp.ru/

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message