From owner-cvs-all Thu Aug 23 13:29:27 2001 Delivered-To: cvs-all@freebsd.org Received: from Awfulhak.org (gw.Awfulhak.org [217.204.245.18]) by hub.freebsd.org (Postfix) with ESMTP id 932C737B407; Thu, 23 Aug 2001 13:29:15 -0700 (PDT) (envelope-from brian@Awfulhak.org) Received: from hak.lan.Awfulhak.org (root@hak.lan.Awfulhak.org [fec0::1:12]) by Awfulhak.org (8.11.5/8.11.5) with ESMTP id f7NKTIv38924; Thu, 23 Aug 2001 21:29:18 +0100 (BST) (envelope-from brian@Awfulhak.org) Received: from hak.lan.Awfulhak.org (brian@localhost [127.0.0.1]) by hak.lan.Awfulhak.org (8.11.4/8.11.4) with ESMTP id f7NKT6g86317; Thu, 23 Aug 2001 21:29:06 +0100 (BST) (envelope-from brian@hak.lan.Awfulhak.org) Message-Id: <200108232029.f7NKT6g86317@hak.lan.Awfulhak.org> X-Mailer: exmh version 2.5 07/13/2001 with nmh-1.0.4 To: Kris Kennaway Cc: "Andrey A. Chernov" , Jun Kuriyama , cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org, brian@freebsd-services.com Subject: Re: cvs commit: src/etc/defaults rc.conf src/etc/mtree BSD.var.dist src/etc/namedb named.conf In-Reply-To: Message from Kris Kennaway of "Thu, 23 Aug 2001 12:40:33 PDT." <20010823124033.A90942@xor.obsecurity.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Thu, 23 Aug 2001 21:29:06 +0100 From: Brian Somers Sender: owner-cvs-all@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG > > --huq684BweRXVnRxX > Content-Type: text/plain; charset=us-ascii > Content-Disposition: inline > Content-Transfer-Encoding: quoted-printable > > On Thu, Aug 23, 2001 at 05:44:58PM +0400, Andrey A. Chernov wrote: > > On Thu, Aug 23, 2001 at 06:34:46 -0700, Jun Kuriyama wrote: > > > kuriyama 2001/08/23 06:34:46 PDT > > >=20 > > > Modified files: > > > etc/defaults rc.conf=20 > > > etc/mtree BSD.var.dist=20 > > > etc/namedb named.conf=20 > > > Log: > > > Invoke named with privilege of bind:bind. > > > Change pidfile location to /var/run/named/pid. > >=20 > > Is it discussed or I miss something? We already have an option to run it > > in bind sandbox, but as non-default option. Some functions not works in > > bind sandbox, I don't remember exactly at this moment. > > With my security officer hat on, I support this change. It is not > suitable for everyone because of the interface binding problem, but > since named requires configuration before it can be used, slightly > changing the nature of that configuration process for some people is a > reasonable thing to do providing it's documented. > > It's well past time we did this, and if there's ever another remote > hole in bind8, we'll all thank Kuriyama-san for doing it. Bear in mind that we're also breaking existing configurations that have ``named_enable=YES'' in /etc/rc.conf (they're now running as bind:bind). An entry should be made in UPDATING. > Kris -- Brian http://www.freebsd-services.com/ Don't _EVER_ lose your sense of humour ! To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message