https://bugzilla.novell.com/show_bug.cgi?id=738156 https://bugzilla.novell.com/show_bug.cgi?id=738156#c2 --- Comment #2 from Lars Müller 2011-12-21 23:38:43 CET --- We might consider to move the added chroot checks into initializeNamed or checkAndCopyConfigFiles. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=738156 https://bugzilla.novell.com/show_bug.cgi?id=738156#c4 Lars Müller changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO InfoProvider| |lynn@steve-ss.com --- Comment #4 from Lars Müller 2011-12-22 00:47:14 CET --- Please test with the packages provided at the location quoted with comment #3 and report back. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=738156 https://bugzilla.novell.com/show_bug.cgi?id=738156#c6 --- Comment #6 from lynn wilson 2011-12-22 14:43:47 UTC --- (In reply to comment #3)

http://download.opensuse.org/repositories/home:/lmuelle:/branches:/server:/d... is the download location for several openSUSE and SUSE Linux Enterprise products.

Need to add a suffix here no? e.g. http://download.opensuse.org/repositories/home:/lmuelle:/branches:/server:/d... -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=738156 https://bugzilla.novell.com/show_bug.cgi?id=738156#c8 --- Comment #8 from Lars Müller 2011-12-22 17:48:14 CET --- The permissions are and had been ok for many, many years. hip:~ # ls -ld /var/lib/named/ drwxr-xr-x 1 root root 146 21. Dez 22:09 /var/lib/named/ The goal is to keep this directory write protected for the user with the name 'named'. In /var/lib/named/ you find a dedicated directory named 'dyn' for zones which get a dynamic update. This directory also has the required permission set as described before. We also have a prepackaged directory '/var/lib/named/slave/' with the same permission set. And from the name you might get this this directory is intended to be used for slave zones. After a zone transfer named must be able to write the gathered data to a file. hip:~ # ls -dl /var/lib/named/{dyn,slave} drwxr-xr-x 1 named named 0 8. Dez 16:07 /var/lib/named/dyn drwxr-xr-x 1 named named 0 8. Dez 16:07 /var/lib/named/slave If this is not ok please file a separate issue where you describe why the used permission set doesn't fix the general use case. I'm going to cleanup the mess in the init script a bit further as described in comment#2 and then I'm filing a submit request to openSUSE Factory first. After this we have to investigate how big the difference is to the bind package used as part of openSUSE 12.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=738156 https://bugzilla.novell.com/show_bug.cgi?id=738156#c10 --- Comment #10 from Lars Müller 2011-12-22 22:07:40 CET --- a) The chroot default is a reasonable and more secure approach. b) Changing the default by _no_ reason is bad. Cause you're not able to configure Samba4 in the way it's able to work with a chrooted bind setup is no argument to modify a reasonable and working approach. Up to now no user complained about the chroot approach. c) /var/lib/named owned by named: is wrong. This gives the named process more rights than needed. Please read comment #8 again before you make a statement again which sounds as you've not read what I explained in comment #8. I've used dynamic updates with BIND and these settings over many years. What comment#8 doesn't state direct or verbose is: Your zone definitions in named.conf have to reference /var/lib/named/dyn/ as location to store the particular dynamic zone file. But for a person willing and able to handle BIND this must have been clear after what got written in comment #8. If you still believe something is wrong with the default permissions of the directory created by the bind package please file a separate bug report. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=738156 https://bugzilla.novell.com/show_bug.cgi?id=738156#c12 --- Comment #12 from Lars Müller 2011-12-22 23:49:08 CET --- No, No the packages from comment #3 don't produce this error. Cause the permissions of /var/lib/named/ and below have not been changed. You can prove this from the history of the repository. I've also tested these packages. Also rpm -V might be of help. No bug got introduced. You're not reading how to handle dynamic zone files Or you don't understand the general permission principle to only grant those permissions which are needed. See comment 10. Fix your dynamic zone definitions and use /var/lib/named/dyn/ to let named store and handle the information from there. And this also has nothing to do with a Microsoft Windows network. If there is something broken by this minimal change set please point us to the location where is is broken. The permissions of /var/lib/named/ and any directory or file below are unmodified. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=738156 https://bugzilla.novell.com/show_bug.cgi?id=738156#c14 --- Comment #14 from lynn wilson 2011-12-23 02:20:07 UTC --- (In reply to comment #12)

No, No the packages from comment #3 don't produce this error. Cause the permissions of /var/lib/named/ and below have not been changed. You can prove this from the history of the repository. I've also tested these packages. Also rpm -V might be of help.

No bug got introduced. You're not reading how to handle dynamic zone files. Or you don't understand the general permission principle to only grant those permissions which are needed.

See comment 10. Fix your dynamic zone definitions and use /var/lib/named/dyn/ to let named store and handle the information from there.

And this also has nothing to do with a Microsoft Windows network.

mmm Ironically, this bug came to light _because_ of a windows network. Were it not been for Samba 4, we would still be stuck in the bind-for-webservers era.

If there is something broken by this minimal change set please point us to the location where is is broken.

The permissions of /var/lib/named/ and any directory or file below are unmodified.

-- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=738156 https://bugzilla.novell.com/show_bug.cgi?id=738156#c16 Lars Müller changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO InfoProvider| |bj@sernet.de --- Comment #16 from Lars Müller 2011-12-24 15:12:16 CET --- Samba4 and DNS is still in alpha state. If you're not an experienced user stay away from it and don't try to blame openSUSE and BIND for issues which are very likely caused by your misunderstanding. DNS is a generic protocol. BIND implements this and is also know as the reference implementation. Check the Samba wiki at https://wiki.samba.org/index.php/Samba4/HOWTO#Instructions_for_bind9_9.8.0_o... for the details. And what a surprise even there only the actual dns.keytab file is owned by the user named. All a user has to achieve able is to use the vendors BIND default locations of files instead of trying to use /usr/local/samba/ as used in the Samba wiki. Even might require advanced skills which an average user might not have. bind in the current state from my home repository got tested chrooted and non chrooted and even switching between both setups work again as intended. The only case not covered and not trivial to fix is when named is running and a user modifies the value of /etc/sysconfig/named:NAMED_RUN_CHROOTED As the header of this setting has a '## ServiceRestart: lwresd,named' line it's clear to YaST and a skilled user that a restart of the service is required. @Björn: Please be this nice and test the current code and report back if it works for you. If that's the case I'll start the update work flow to get the fixed package published. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=738156 https://bugzilla.novell.com/show_bug.cgi?id=738156#c18 --- Comment #18 from Lars Müller 2011-12-24 17:47:21 CET --- Please explain the value. As I've asked several times - see above comment#8, comment#10, comment#12, comment#16 - and there had been no input what the actual issue is you see. If this is a feeling please keep it with you. If you have facts please add them with an additional comment. Else please let people willing to get this particular issue fixed discuss this topic without additional, superfluous background noise. The way how BIND is expected to be configured with SUSE has not changed since many years. All what happened by accident is a failing non chroot configuration as stressed several times before. And that's what this issue is about. For anything else please file a fresh bug report. Thanks. @Björn: Your input is the only missing piece before I'm going to start the update process. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=738156 https://bugzilla.novell.com/show_bug.cgi?id=738156#c20 Bjoern Jacke changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED InfoProvider|bj@sernet.de | --- Comment #20 from Bjoern Jacke 2012-01-02 13:59:27 UTC --- the newer 14.1 rpm release, also starts up properly. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=738156 https://bugzilla.novell.com/show_bug.cgi?id=738156#c22 --- Comment #22 from Bjoern Jacke 2012-01-02 19:02:03 UTC --- the enhanced release 16 RPMs from today work well in chroot and non chroot setups here. Looks good as far as I can see. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=738156 https://bugzilla.novell.com/show_bug.cgi?id=738156#c23 Lars Müller changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO InfoProvider| |ug@suse.com --- Comment #23 from Lars Müller 2012-01-02 22:27:35 CET --- Before we're able to start the maintenance work flow we have to negotiate from where to branch the the bind package. Unfortunately openSUSE 12.1 is ahead of server:dns in the OBS. Please tell us from which repository bind is expected to be branched. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=738156 https://bugzilla.novell.com/show_bug.cgi?id=738156#c25 --- Comment #25 from Lars Müller 2012-01-03 00:17:16 CET --- https://build.opensuse.org/request/show/98567 is the required submit request. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=738156 https://bugzilla.novell.com/show_bug.cgi?id=738156#c27 --- Comment #27 from Lars Müller 2012-01-03 14:53:50 CET --- The fixed bind package now got submitted to the correct project named 'network'. This is tracked by submit request https://build.opensuse.org/request/show/98618 Please, please cleanup the server:dns location. It distracts people. Best would be to kill the server:dns or server project at all if it's no longer used. The submit request to openSUSE:12.1:Update:Test is https://build.opensuse.org/request/show/98629 The required packages are: bind and bind-lwresd To make Keep It Simple Stupid we should release all packages. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=738156 https://bugzilla.novell.com/show_bug.cgi?id=738156#c29 Benjamin Brunner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED InfoProvider|maintenance@opensuse.org | --- Comment #29 from Benjamin Brunner 2012-01-11 15:01:43 CET --- The update is already released for 12.1. I'll remove the needinfo-flag. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=738156 https://bugzilla.novell.com/show_bug.cgi?id=738156#c31 --- Comment #31 from Swamp Workflow Management 2013-04-10 22:06:17 UTC --- openSUSE-SU-2013:0666-1: An update that solves four vulnerabilities and has 5 fixes is now available. Category: security (moderate) Bug References: 710430,715881,716745,718441,738156,743758,772946,792926,811876 CVE References: CVE-2011-1907,CVE-2012-3868,CVE-2012-5688,CVE-2013-2266 Sources used: openSUSE 11.4 (src): bind-9.9.2P2-45.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.