Date: Thu, 23 Aug 2001 09:45:34 -0700 (PDT) From: Matt Dillon <dillon@earth.backplane.com> To: "Andrey A. Chernov" <ache@nagual.pp.ru> Cc: Brian Somers <brian@Awfulhak.org>, Jun Kuriyama <kuriyama@FreeBSD.ORG>, cvs-committers@FreeBSD.ORG, cvs-all@FreeBSD.ORG, brian@freebsd-services.com Subject: Re: cvs commit: src/etc/defaults rc.conf src/etc/mtree BSD.var.dist src/etc/namedb named.conf Message-ID: <200108231645.f7NGjYe86993@earth.backplane.com> References: <ache@nagual.pp.ru> <20010823174457.A27360@nagual.pp.ru> <200108231413.f7NEDvg71094@hak.lan.Awfulhak.org> <20010823185515.A28168@nagual.pp.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
I like the idea of, finally, invoking named in a sandbox. I don't
understand why the pidfile location has to change, though. named
creates its pidfile as root before it setuid's itself.
While it is true that named cannot rescan interfaces when operating
in this mode, this restriction has never been an impediment to anything
I've ever done with it. Most dialup users don't run named, they simply
allow ppp to setup /etc/resolv.conf for them. Those who do will be savvy
enough to add the appropriate override to /etc/rc.conf (or won't have to
if they don't bother to mergemaster the new default rc files).
I know it isn't a perfect solution, but we *REALLY* need to secure
named this time around. It is years past the time we should have done
it.
-Matt
:> > > Invoke named with privilege of bind:bind.
:> > > Change pidfile location to /var/run/named/pid.
:> >
:> > Is it discussed or I miss something? We already have an option to run it
:> > in bind sandbox, but as non-default option. Some functions not works in
:> > bind sandbox, I don't remember exactly at this moment.
:>
:> named won't be able to listen on interface addresses that are not
:> configured when named is invoked. This can break name services on a
:> dialup server quite badly.
:
:Yes, exact this thing.
:
:> I think this change should be reverted.
:
:I too.
:If named allows root compromise, better fix named.
:
:--
:Andrey A. Chernov
:http://ache.pp.ru/
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200108231645.f7NGjYe86993>