From owner-freebsd-stable@FreeBSD.ORG Wed Nov 13 18:05:08 2013 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 0CAD0572; Wed, 13 Nov 2013 18:05:08 +0000 (UTC) Received: from mail-pb0-x22d.google.com (mail-pb0-x22d.google.com [IPv6:2607:f8b0:400e:c01::22d]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id B867B2423; Wed, 13 Nov 2013 18:05:07 +0000 (UTC) Received: by mail-pb0-f45.google.com with SMTP id mc8so772284pbc.32 for ; Wed, 13 Nov 2013 10:05:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=2lAGtftmfJGxDyj77YLx7bUgjoKp6nSMoCGxMWfsmTQ=; b=SU8W4YY/ovkUTlrOGqahFWY67yMyoZ1wGhhYl9gmClYEDzqZ9bfoNv++hZG0xR/crj 3bH2fuqNuFDggoXUiKqIpcRNj6moACICj2DttwsNw0B1+BVauGwCVr9Ovc8CwCW055WZ yCKxQdPFTQZyfk8q3rfktEe6Bi/R/AgCz2Q9gO3N8mocuPFfe7KnydBJiCcMOeTUQ0KB bb4f8kaZ5ELrtHXGIiUJTqSMF/Gy9xirhAuyRrhXJreNycKP138ihadBEVKr2iUVK9MP R5zeWgzHtveIAKuxLh6OvINpnWW4ePrttNWW3XHTvhTDP9oztfbRk3cP3WeclWANPTC5 xK6w== MIME-Version: 1.0 X-Received: by 10.66.119.202 with SMTP id kw10mr43760628pab.118.1384365907432; Wed, 13 Nov 2013 10:05:07 -0800 (PST) Received: by 10.68.248.106 with HTTP; Wed, 13 Nov 2013 10:05:07 -0800 (PST) In-Reply-To: References: <20131103220654.GU52889@FreeBSD.org> <6AA4A8E1-CBCE-4C87-A320-BB08EC76715F@lassitu.de> <20131104083443.GZ52889@FreeBSD.org> <2B21E123-23BA-4E07-B9DD-9DE1CDE40D08@FreeBSD.org> <20131104163457.GJ52889@FreeBSD.org> <868B00D6-101A-4B17-995F-A3E2AFE41908@lansing.dk> <20131112111322.GV90670@droso.dk> Date: Wed, 13 Nov 2013 20:05:07 +0200 Message-ID: Subject: Re: FreeBSD 10 Beta2 /etc/rc.d/named script and /etc/defaults/rc.conf From: George Kontostanos To: Erwin Lansing Content-Type: text/plain; charset=ISO-8859-1 X-Content-Filtered-By: Mailman/MimeDel 2.1.16 Cc: FreeBSD Release Engineering Team , Stefan Bethke , FreeBSD Current , Gleb Smirnoff , freebsd-stable , =?ISO-8859-1?Q?Dag=2DErling_Sm=F8rgrav?= , =?ISO-8859-1?Q?=D6zkan_KIRIK?= X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Nov 2013 18:05:08 -0000 On Wed, Nov 13, 2013 at 7:59 PM, George Kontostanos wrote: > On Tue, Nov 12, 2013 at 1:13 PM, Erwin Lansing wrote: > >> On Wed, Nov 06, 2013 at 02:59:15PM +0100, Erwin Lansing wrote: >> > >> E> > >> > >> E> > Erwin, can you please handle that? >> > >> E> >> > >> E> Things are much worse that this, the ports are completely written >> under the assumption that there is a Bind in base, which of course would >> already break with WITHOUT_BIND before Bind was completely removed. It >> will be hard to fix without breaking the installed base of 8 and 9. Sigh. >> > >> E> >> > >> E> I'll try to work on it this week, but unfortunately have a full >> schedule of meetings and travel as well. >> > > >> > > Suggestion. An option to install the rc script would solve that >> problem. >> > > >> > >> > If only it was that simple, it would have been done a long time ago. >> As Gleb points out, the ports are broken by design. The rc script needs a >> complete rewrite, and that's only after fixing all configuration files, >> setting up chroot, etc etc and all that while not breaking the installed >> base on 8 and 9. I spent most of yesterday on this and if I'm lucky, I'm >> halfway through. >> > >> >> >> Sorry about the delay, but I did finally update all three dns/bind9* >> ports today. I have dropped the complicated chroot, and related >> symlinking, logic from the default rc script as I don't think that >> is the right place to implement things. I would recommend users >> who want the extra security to use jail(8) instead of a mere chroot. >> >> This change should not affect the installed base of FreeBSD 9.x and >> earlier systems, but new installations there should note that the >> symlink option is no longer turned on by default, but still supported. >> >> I tested some default cases, but by no means can test every corner case, >> so please let me know how this works out. >> >> Best, >> Erwin >> >> > Excellent thanks so much! > > If you had named running using the old rc scripts and config in 10 you > will need to: > > 1) Backup your zones & stop named > 2) Delete /var/named/* > 3) Create a new symlink in etc to /usr/local/etc/namedb > 4) Restore your zones > 5) Start named from the new rc script > > Sorry I forgot also that if if you don't specify the location of named in the rc.conf: named_program="/usr/local/sbin/named" You will get an error message: root@hp:/etc # /usr/local/etc/rc.d/named start /usr/local/etc/rc.d/named: WARNING: run_rc_command: cannot run /usr/sbin/named Those are observations from a test machine that I use which was running bind with the old rc style. Thanks -- George Kontostanos --- http://www.aisecure.net