Date: Tue, 15 Dec 2009 10:58:06 +0000 (GMT) From: Robert Watson <rwatson@FreeBSD.org> To: Doug Barton <dougb@FreeBSD.org> Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org Subject: Re: svn commit: r200563 - in head/etc: mtree namedb Message-ID: <alpine.BSF.2.00.0912151056130.61723@fledge.watson.org> In-Reply-To: <200912150514.nBF5Eej4050810@svn.freebsd.org> References: <200912150514.nBF5Eej4050810@svn.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 15 Dec 2009, Doug Barton wrote:
> The named process needs to have a "working directory" that it can
> write to. This is specified in "options { directory }" in named.conf.
> So, create /etc/namedb/working with appropriate permissions, and
> update the entry in named.conf to match.
>
> In addition to specifying the working directory, file and path names
> in named.conf can be specified relative to the directory listed.
> However, since that directory is now different from /etc/namedb
> (where the configuration, zone, rndc.*, and other files are located)
> further update named.conf to specify all file names with fully
> qualified paths. Also update the comment about file and path names
> so users know this should be done for all file/path names in the file.
>
> This change will eliminate the 'working directory is not writable'
> messages at boot time without sacrificing security. It will also
> allow for features in newer versions of BIND (9.7+) to work as
> designed.
On a couple of occasions, I've found myself trying to help people get BIND to
core dump on a bug, which is a bit tricky in practice. It involves setting
appropriate sysctls so that sugid processes generate cores, arranging for a
writable core dump directory in the chroot and setting a sysctl so it is
found, etc. Does this change simplify that process down to "enable core dump
for sugid processes"? If not, are there other things we could do to make this
easier?
Robert N M Watson
Computer Laboratory
University of Cambridge
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?alpine.BSF.2.00.0912151056130.61723>