From owner-freebsd-net@FreeBSD.ORG  Sun Aug  3 16:02:03 2008
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 693421065674
	for <net@freebsd.org>; Sun,  3 Aug 2008 16:02:03 +0000 (UTC)
	(envelope-from smithi@nimnet.asn.au)
Received: from gaia.nimnet.asn.au (nimbin.lnk.telstra.net [139.130.45.143])
	by mx1.freebsd.org (Postfix) with ESMTP id 131308FC0A
	for <net@freebsd.org>; Sun,  3 Aug 2008 16:02:01 +0000 (UTC)
	(envelope-from smithi@nimnet.asn.au)
Received: from localhost (smithi@localhost)
	by gaia.nimnet.asn.au (8.8.8/8.8.8R1.5) with SMTP id CAA23962;
	Mon, 4 Aug 2008 02:01:19 +1000 (EST)
	(envelope-from smithi@nimnet.asn.au)
Date: Mon, 4 Aug 2008 02:01:17 +1000 (EST)
From: Ian Smith <smithi@nimnet.asn.au>
To: Eugene Grosbein <eugen@kuzbass.ru>
In-Reply-To: <20080803144719.GA33577@svzserv.kemerovo.su>
Message-ID: <Pine.BSF.3.96.1080804013046.13190C-100000@gaia.nimnet.asn.au>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Cc: net@freebsd.org
Subject: Re: permissions on /etc/namedb
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 03 Aug 2008 16:02:03 -0000

On Sun, 3 Aug 2008, Eugene Grosbein wrote:
 > On Sun, Aug 03, 2008 at 10:32:22PM +1000, Ian Smith wrote:
 > 
 > >  > I need /etc/namedb to be owned by root:bind and have permissions 01775,
 > >  > so bind may write to it but may not overwrite files that belong to root
 > >  > here, and I made it so. Suprise!
 > >  > 
 > >  > # /etc/rc.d/named restart                                                       
 > >  > Stopping named.                                                                 
 > >  > Waiting for PIDS: 1892.                                                         
 > >  > etc/namedb changed                                                              
 > >  >         gid expected 0 found 53 modified                                        
 > >  >         permissions expected 0755 found 01775 modified                          
 > >  > Starting named.
 > > 
 > > Are you running /etc/namedb linked to chroot'd /var/named/etc/namedb?
 > > If so, that'd be mtree restoring perms from /etc/mtree/BIND.chroot.dist
 > 
 > I just have 'named_enable="YES"' in /etc/rc.conf, it's 6.3-STABLE
 > and stock bind9. I could set named_chroot_autoupdate="NO",
 > but I see now it won't mount devfs into chroot are in that case.

So hacking /etc/rc.d/named in chroot_autoupdate to do something like:

	files_bind_writes='named.run'	# whatever
	for f in ${files_bind_writes}; do 
		touch ${named_chrootdir}/etc/namedb/${f}
		chown bind:wheel ${named_chrootdir}/etc/namedb/${f}
	done

wouldn't work for you?

cheers, Ian