From f6f1672b4e460571c418e43ae3bd0fae97e4c149 Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Thu, 6 Nov 2008 05:30:24 +0000 Subject: [PATCH] 2486. [func] The default locations for named.pid and lwresd.pid are now /var/run/named/named.pid and /var/run/lwresd/lwresd.pid respectively. This allows the owner of the containing directory to be set, for "named -u" support, and allows there to be a permanent symbolic link in the path, for "named -t" support. [RT #18306] --- CHANGES | 9 +++++++++ README | 6 ++++++ bin/named/config.c | 4 ++-- bin/named/include/named/globals.h | 18 +++++++++++++++--- bin/named/lwresd.docbook | 4 ++-- bin/named/named.docbook | 4 ++-- bin/named/unix/os.c | 26 +++++++++++++++++++++++++- doc/arm/Bv9ARM-book.xml | 5 +++-- 8 files changed, 64 insertions(+), 12 deletions(-) diff --git a/CHANGES b/CHANGES index 619fff8b8f..2c1968071b 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,12 @@ +2486. [func] The default locations for named.pid and lwresd.pid + are now /var/run/named/named.pid and + /var/run/lwresd/lwresd.pid respectively. + + This allows the owner of the containing directory + to be set, for "named -u" support, and allows there + to be a permanent symbolic link in the path, for + "named -t" support. [RT #18306] + 2485. [bug] Change update's the handling of obscured RRSIG records. Not all orphand DS records were being removed. [RT #18828] diff --git a/README b/README index a73c974a04..808d5e9e6e 100644 --- a/README +++ b/README @@ -56,6 +56,9 @@ BIND 9.6.0 The BIND 8 resolver library, libbind, has been removed from the BIND 9 distribution and is now available as a separate download. + Change the default pid file location from /var/run to + /var/run/{named,lwresd} for improved chroot/setuid support. + BIND 9.5.0 BIND 9.5.0 has a number of new features over 9.4, @@ -451,6 +454,9 @@ Building To disable the default check set. -DCHECK_SIBLING=0 named-checkzone checks out-of-zone addresses by default. To disable this default set. -DCHECK_LOCAL=0 + To create the default pid files in ${localstatedir}/run rather + than ${localstatedir}/run/{named,lwresd}/ set. + -DNS_RUN_PID_DIR=0 LDFLAGS Linker flags. Defaults to empty string. diff --git a/bin/named/config.c b/bin/named/config.c index a85be69c51..96b071d13a 100644 --- a/bin/named/config.c +++ b/bin/named/config.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: config.c,v 1.92 2008/09/27 23:35:31 jinmei Exp $ */ +/* $Id: config.c,v 1.93 2008/11/06 05:30:24 marka Exp $ */ /*! \file */ @@ -69,7 +69,7 @@ options {\n\ memstatistics-file \"named.memstats\";\n\ multiple-cnames no;\n\ # named-xfer ;\n\ -# pid-file \"" NS_LOCALSTATEDIR "/named.pid\"; /* or /lwresd.pid */\n\ +# pid-file \"" NS_LOCALSTATEDIR "/run/named/named.pid\"; /* or /lwresd.pid */\n\ port 53;\n\ recursing-file \"named.recursing\";\n\ " diff --git a/bin/named/include/named/globals.h b/bin/named/include/named/globals.h index 0beef48ba4..29c2652867 100644 --- a/bin/named/include/named/globals.h +++ b/bin/named/include/named/globals.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: globals.h,v 1.77 2008/10/24 01:08:21 marka Exp $ */ +/* $Id: globals.h,v 1.78 2008/11/06 05:30:24 marka Exp $ */ #ifndef NAMED_GLOBALS_H #define NAMED_GLOBALS_H 1 @@ -42,6 +42,10 @@ #define INIT(v) #endif +#ifndef NS_RUN_PID_DIR +#define NS_RUN_PID_DIR 1 +#endif + EXTERN isc_mem_t * ns_g_mctx INIT(NULL); EXTERN unsigned int ns_g_cpus INIT(0); EXTERN isc_taskmgr_t * ns_g_taskmgr INIT(NULL); @@ -109,9 +113,17 @@ EXTERN isc_boolean_t ns_g_foreground INIT(ISC_FALSE); EXTERN isc_boolean_t ns_g_logstderr INIT(ISC_FALSE); EXTERN const char * ns_g_defaultpidfile INIT(NS_LOCALSTATEDIR - "/run/named.pid"); + "/run/" +#if NS_RUN_PID_DIR + "named/" +#endif + "named.pid"); EXTERN const char * lwresd_g_defaultpidfile INIT(NS_LOCALSTATEDIR - "/run/lwresd.pid"); + "/run/" +#if NS_RUN_PID_DIR + "lwresd/" +#endif + "lwresd.pid"); EXTERN const char * ns_g_username INIT(NULL); EXTERN int ns_g_listen INIT(3); diff --git a/bin/named/lwresd.docbook b/bin/named/lwresd.docbook index 6d7378266d..3e72fd3d49 100644 --- a/bin/named/lwresd.docbook +++ b/bin/named/lwresd.docbook @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> - + June 30, 2000 @@ -199,7 +199,7 @@ Use pid-file as the PID file instead of the default, - /var/run/lwresd.pid. + /var/run/lwresd/lwresd.pid. diff --git a/bin/named/named.docbook b/bin/named/named.docbook index 3fe94396c2..f47eae1e6b 100644 --- a/bin/named/named.docbook +++ b/bin/named/named.docbook @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> - + June 30, 2000 @@ -391,7 +391,7 @@ - /var/run/named.pid + /var/run/named/named.pid The default process-id file. diff --git a/bin/named/unix/os.c b/bin/named/unix/os.c index 6fb6a63f43..15888c889e 100644 --- a/bin/named/unix/os.c +++ b/bin/named/unix/os.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: os.c,v 1.87 2008/10/24 01:44:48 tbox Exp $ */ +/* $Id: os.c,v 1.88 2008/11/06 05:30:24 marka Exp $ */ /*! \file */ @@ -645,6 +645,9 @@ ns_os_writepidfile(const char *filename, isc_boolean_t first_time) { pid_t pid; char strbuf[ISC_STRERRORSIZE]; void (*report)(const char *, ...); + unsigned int mode; + char *slash; + int n; /* * The caller must ensure any required synchronization. @@ -667,6 +670,27 @@ ns_os_writepidfile(const char *filename, isc_boolean_t first_time) { /* This is safe. */ strcpy(pidfile, filename); + /* + * Make the containing directory if it doesn't exist. + */ + slash = strrchr(pidfile, '/'); + if (slash != NULL && slash != pidfile) { + *slash = '\0'; + mode = S_IRUSR | S_IWUSR | S_IXUSR; /* u=rwx */ + mode |= S_IRGRP | S_IXGRP; /* g=rx */ + mode |= S_IROTH | S_IXOTH; /* o=rx */ + n = mkdir(pidfile, mode); + if (n == -1 && errno != EEXIST) { + isc__strerror(errno, strbuf, sizeof(strbuf)); + (*report)("couldn't mkdir %s': %s", filename, + strbuf); + free(pidfile); + pidfile = NULL; + return; + } + *slash = '/'; + } + fd = safe_open(filename, ISC_FALSE); if (fd < 0) { isc__strerror(errno, strbuf, sizeof(strbuf)); diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 252c3bd005..7b2a6cdf55 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> - + BIND 9 Administrator Reference Manual @@ -4797,7 +4797,8 @@ category notify { null; }; The pathname of the file the server writes its process ID - in. If not specified, the default is /var/run/named.pid. + in. If not specified, the default is + /var/run/named/named.pid. The pid-file is used by programs that want to send signals to the running name server. Specifying pid-file none disables the