http://bugzilla.novell.com/show_bug.cgi?id=557618 http://bugzilla.novell.com/show_bug.cgi?id=557618#c1 Erwin Lam changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |erwinlam@dds.nl --- Comment #1 from Erwin Lam 2009-11-22 19:56:57 UTC --- In addition, since pdns-recursor runs as user pdns, group pdns, you need to change some file ownership/permissions: chown -R pdns.pdns /var/lib/pdns chmod go-rwx /var/lib/pdns Otherwise, the command "rec_control dump-cache dump.txt" fails because "pdns_recursor" has no permission to write the file "dump.txt" in /var/lib/pdns. (Remeber, "pdns_recursor" is running chroot-ed in /var/lib/pdns.) -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=557618 http://bugzilla.novell.com/show_bug.cgi?id=557618#c2 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |meissner@novell.com, | |security-team@suse.de AssignedTo|nadvornik@novell.com |bnc-team-screening@forge.pr | |ovo.novell.com --- Comment #2 from Marcus Meissner 2010-07-21 13:55:59 UTC --- reassign to current factory maintainer , or better bnc-team-screening first. i am only reading this, but the daemon should not be able to read - write in its chroot. This is an actual intended security feature of this chroot setup I think. I guess its unlikely the dump feature is meant to work in chroot mode, or should be implemented differently. (or have just have 1 specific file writeable as dump target) -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=557618 http://bugzilla.novell.com/show_bug.cgi?id=557618#c3 --- Comment #3 from Erwin Lam 2010-07-21 15:29:03 UTC --- On the contrary, the idea of a chroot jail is that an application can savely write inside it but never outside it. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.