From owner-cvs-all  Wed Aug 29  6:31: 0 2001
Delivered-To: cvs-all@freebsd.org
Received: from axl.seasidesoftware.co.za (axl.seasidesoftware.co.za [196.31.7.201])
	by hub.freebsd.org (Postfix) with ESMTP
	id 6AC1337B401; Wed, 29 Aug 2001 06:30:53 -0700 (PDT)
	(envelope-from sheldonh@starjuice.net)
Received: from sheldonh (helo=axl.seasidesoftware.co.za)
	by axl.seasidesoftware.co.za with local-esmtp (Exim 3.33 #1)
	id 15c5Qo-000Jwi-00; Wed, 29 Aug 2001 15:30:58 +0200
From: Sheldon Hearn <sheldonh@starjuice.net>
To: Brian Somers <brian@Awfulhak.org>
Cc: Joshua Goodall <joshua@roughtrade.net>,
	Giorgos Keramidas <keramida@ceid.upatras.gr>,
	cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org,
	brian@freebsd-services.com
Subject: Re: cvs commit: src/etc/defaults rc.conf src/etc/mtree BSD.var.dist src/etc/namedb named.conf 
In-reply-to: Your message of "Wed, 29 Aug 2001 14:09:14 +0100."
             <200108291309.f7TD9Ef75762@hak.lan.Awfulhak.org> 
Date: Wed, 29 Aug 2001 15:30:58 +0200
Message-ID: <76675.999091858@axl.seasidesoftware.co.za>
Sender: owner-cvs-all@FreeBSD.ORG
Precedence: bulk
List-ID: <cvs-all.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20cvs-all>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20cvs-all>
X-Loop: FreeBSD.ORG



On Wed, 29 Aug 2001 14:09:14 +0100, Brian Somers wrote:

> For the n'th time on this thread, everyone that has
> 
>   named_enable=YES
> 
> in /etc/rc.conf and don't have ``named_flags='' will now have named 
> running with -u bind and will not be able to update their secondary 
> zone files.

Why?  The same mergemaster that changes named_flags in
/etc/defaults/rc.conf will also change /etc/namedb/named.conf .

> Now perhaps someone can tell me what the purpose of this blatant
> -minded breakage is.  What do we gain by changing the default 
> variable values for a service that has never been enabled by default ?

We gain protection of a significant number of entry-level administrators
from potential root exploits.

I ignored the rest of your message because it only applies if you're
right about the impact, and I don't think you are.

Ciao,
Sheldon.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message