Firewall Wizards mailing list archives

BIND 8.1.1 + chroot/setuid


From: Darren Reed <darrenr () cyber com au>
Date: Tue, 14 Oct 1997 12:45:08 +1000 (EST)


After a brief hack last night (motivated by mjr), I added in support for
chroot and running as non-root to BIND 8.1.1.

Both features are controlled via the "options" section of the config file.
`chroot [yes|no];' tells it whether or not to chroot to the specified
directory and `runas "username[.groupname]";' specifies which user to
run as (numbers won't work).

If you want to reload the nameserver once it is chroot'd, two named.conf's
are required with the second one missing the chroot option (and runas if
that was present).  named-xfer will need to be placed in the appropriate
subdirectory, along with shared libs if you cannot compile it as static.
Various directories such as /var/tmp will need to be created too.

Changing some options such as logging and ports to use, whilst running
chroot'd and/or non-root should not be expected to work once it has
chroot'd.  Thankfully, it does connect to /dev/log prior to the chroot
(as well as open up all the right sockets).

I've included below the two named.conf's I've used for testing this
configuration, with the patches for BIND 8.1.1 after that.

Cheers,
Darren

Primary named.conf, to be used to make the chroot.
--------------------------------------------------
options {
        directory "/tmp/namedb";
        chroot yes;
        runas "nobody.nobody";
        forwarders { 192.168.3.112; };
        recursion yes;
        multiple-cnames yes;
        query-source address * port 53;
};

zone "." {
        type hint;
        file "named.cache";
};

zone "melb.convergent.com.au" {
        type slave;
        file "db/convergent";
        masters { 192.168.3.112; };
};
--------------------------------------------------
Secondary named.conf, to be used after the chroot.
--------------------------------------------------
options {
        directory "/";
        forwarders { 192.168.3.112; };
        recursion yes;
        multiple-cnames yes;
        query-source address * port 53;
};

zone "." {
        type hint;
        file "named.cache";
};

zone "melb.convergent.com.au" {
        type slave;
        file "db/convergent";
        masters { 192.168.3.112; };
};
--------------------------------------------------

begin 644 chroot.diff2.gz
M'XL("$W80C0  V-H<F]O="YD:69F,@#D7'EWVSB2_UOY%(B2;E^TK-.'W,ZN
MVI8=[3B2VY)[DAG/,C0%67RA20U)^4@F^]FW4 !)D ))*9VDL[-Y>;*(.@@4
M?D 5"H#&UF1"MDV/^)ZY\\;X0">63=E#Q9QZKAM$9<\V-S<33*71=$[>&$^D
M7B?55KO5:C>:I'9PL/=L>WM;I:'TQG7(P Q(K4%JS7:S"C)<8#/Y#U]5KVGU
M/8*/A Q?'_E3^ O_#=LFIDT-AXSIC#IC8CE^P K'EA\@H=TFIY?'SYZ3TG_Z
M-"#;])!<@V#IGGJ^Y3I'[TTC("\_C087GW_G1>\%A__D!T\S>O3^Y:?AZ\^"
M9^9ZP8Z@B***>(SD:!!8SJVO$A2D2#)\OD8S\5;"M^TO;R4V\O%';>6Q>W<'
M_>[/;\:61\W ]2SJMQ%)@_,38D#;)*Q 49[$C>6D): H3\)R3'L^IFDI49PG
M:5LW:2DHRI-@IDB+L+)G \=^@AZ4RD'@:5PQ#7-*E=3'2<5V;RO56N.@ULKB
M"#S#S&T"6'/GUZ'*R*RX2%)A;%&\Q#MW3F!B\3/>S(G+:!E;MUDZ@+2,!L>X
MH^,L'4A<6LOVXX1ZN:J08VE]%8_:KI%?.<&SBDZ8*!9QJ&1:2NO8S-0U-I?2
MX-NN^V$^RU0CZ 4#?\<8CQ>L'Y87R2IP)(H+)1W_GW/J/2G%!:U(Q]3U%SHD
M+"^25>(W(BPEK<1MDEJH9Q$%HKA0,J/W95JQCOEL; 0+L[A,>S:6(YFH=<J8
M9I$:13>+)(QS_FON0*@"D4N[7F]7#Y1QCDIT3GG$ Y$1A#OU=K.6$_'4M?I^
M&/$<GW1_O3H[(MNW/"!XL>[0H(X&L (?H@+?A+" .H&_ 3' \-UP].ZB2X[(
MC3]V?> '-PQ/E<I.I0)/O?[Q.3P*]QQY/T(N!I<C010T].?@X+G&F!>C%:RA
MB%:^M(83CU*HY;>H8P8$'%\W76=BW59,=7])# H@2%3L4,1"E50;[>9NN]4H
MP$):6H)#J]T\R(9#<T]KU3D<F'+VN!O:GID[C&S*S!JZ,0FH5YF6&7$+B),Q
MG9!NO_/K>5>_O.IWAE@J1'Z9/8PKTU>)HEMO)HJ@UZP)O@&5O.[\WM7/NJ/+
MJV'GK%LJ[6R2MV_?DLT=N1*_0*RX U[%G7LF97I(J$?5M+W]NK9W4 NQ7O)H
M,/<<LE[;.(3'S[R!\)[!+("XU>?O@O\N?P8X.?1!%T_K&^034R(>@8DI*5DS
M_<X(S*EN0\1,K#L[64IM>@?8! (]1/ON[>]J^_7(PJHZ;9%[UQK#'PAO=6_N
M&+ZHPWK\;HV84\,CFW.?>I8S<3> _5-FCY3\P)L#(&:&[S^,R2;TRZ%4?.NY
M,'%N0M=@*=>,A>R9%5D3LK[.V8X(2 '\UL-7:V2MLK:QL8'O+Y6XX-86,*Y=
M5]=0(\H_!P5,_)8&MQZ ENL#0>0H 8 ?#,^!<'X=OD)4*O"L<7*)$%)&8Y '
M*YB2N?/!<1\<4?>UG_RULL3)5?-W4]NGG.+.ME]Q>X9-@1IMO[KU]%N+&^0S
MB;AY9?M7Y^>'H06>KX/A> MF#ZP%D?5%(S+;H*PZDT[4'"H>:<271I6):XY"
M1P0JLOUJ]J#/><7#&O)V\WX0_;5-:ANL+RK8%2]"E855Y5@CCAL0ZA@W-AV7
M-P[C<;L%6-U::?QP6(6.]^F/#R?ED#]H:OO5:C3DF5%<Z$C>DQNLJ#0S',M<
M+]_!.M<UR<0 #\H6OLG!7M:X!'L_6_VR'HCJS@:!<0_!K;=>KI21!QEFUEAG
M#IE-R1*/?M$9O=8O>B>GO?-NS(T3MXY!4YKW[6GW,F8<S^]FV7I/KMY<",5L
M@MFO'VC[C6BQ__4LP!5)5F#^ME1B?C95?J@R6/3]A[&6"C_[>S5M?V\W]H<'
MU7WM !QI:$[3\,&Y7HQZ@[[>'_0'H][IN[:"T+F"E_7?G@S>='K]!88W5^>C
MW@7,T,?]SIONL(W3KD0_?GTY&(Q0#.U^;]ASROL.VSBQC5N?_ OB,->U69=A
MZ_E\H6I6K5YK:O!Q$#>L5F_5H6BW%C4-II\;&H!_)_#*8$K#<4QN "4?R)0M
M(4G9" +/NID'U"<\(AZ7R3WVK-"Q;EL?*,H_&$_D+41HABUFOK-C(>-OB,DB
M]"UQHWY.VF"#_/PS>>Y"=(,13PIIT;3+$9V:R:HPF9F&LQ80+DP"E_P$\?Y/
M?C3C)M1IS+51SW.]=?AT8%H_Y',<G_T9;^ 9C@\8]'7+X?V1+@7$G71/.]#!
MB,LA<\+]7O\,>XAU$ D'4D+J%7G3>9N48#.DNC-WJZSGHK2EB&18U,!&*K@(
M'8( 8VX'B>"%Y_"BHL1@U\!+');DJ(B#I%$%D#1@)2) LL2K%/-\SIMC/D45
ME*W?;34T^-B7H+Q[T-)J>]7]A:BJ*D=5?F $E@GS7  /,:( +7X@PBDV96Q(
M@52)@Y"!1:A\+J20L\"CNCX#((>>Y$YA)<EB:85##=L-HVB3G+H>Z!O#<+R%
MP:^T1;W>@*52O1$MYR(7+-J*@>1SXCI4#\!GBI$Q]PP,)X4+QA>6X(V7X%SO
M;MCX=ZS ,FQB6W=LC35Q/=;3#+AET=ME8OG$GU'3FECH.X0*@_!7$#8!5\1J
M;I]5<C_JG=4JJ0X;OF&=U89N-J -K8/0T$ST(ZNQ_W1W U-PP"(D&/H,VG+1
M^M\&_:X^?/=&'V%$/NS]K9ORJ\KA>BC>D3**/H8">$WM,#D600]+WZ5-)R$[
M=(C"?H#0,;V9+P1_#4 L)@L3FG#&))&*L')\5E34D$<&6:@+Q:,^/,8=",S=
M/)&91^\M=^ZG:H#K?=[%UL<P37  G2)-3M^X4^0 YQOU3KBL2\/]3^RNQ5;_
MD7Y3#RY8$T-GUA-1^W-HYRU,IKK8DJ)C[F_EGA$L'%*AD\;.BJ4P?DAUI:23
M>Z?L09B_J*/;+,-] XN5*=")T! &3F)E@$A P#8:T-!&LYX(SO_\AB:[^&NU
M6-W5X*GA0W+>8 \H:NQ&HQ@B*NKX$'%"Q#")9PL!HB0Z8;!5Q?HW(_,!8-WB
M8)T:SBWEBVX&2KXZML9K?H6$1+;SR4HTXD'0JA$ZF8!AK'O," L]YMSS< DZ
M(3/7]RTVQ<!R.9@RYS)UY_88HFCP*:YC0@3-=M38V]C$ .&PT $MY/6O\(*=
M, Z&RMU3+^R81+9B(TJD0"AU:XUS>5?(J<QQ<<]"8Y,; ;Z%MB$_C=MQL,S8
M<UXJ<ZG"Z-PFLF[AE2:BB?/,)B+O'VPAPN#K-C!*:'[.21 #1/W*-#.%R\DX
M5#)$%:EA]7&(+%DI,;S;KC6R$\.U)H3^S3TIS,:"*(Q[ 4HMAY8RUKREZF.U
M6J^R/.X9=1C>*42_SK8QAX5@R.3_ATCP)G6EEL>HJHFJ.K;M/L#HPK4]].,4
M%O?D#F8@:V93OCXNX6AG@N3RTN>#*Z6?1_4EU+N/>D64#FL#-\Y41(&JF%M^
M[?5/]*N+D\ZH&]>9# ?0D./+7G_T^SEI5*LL(Q9.B[ANQUB4K8>9=R6802</
M4\N<*LW>VJMI+3D#T=JK0T$\/4(=^9D-F-Q!%;SB,"S&@HEATD42B[5]J1B@
M#"-,#T@\IK#P5BH4*6! --D4 T+,QNR\!K.(2"!_H$\ZRUJ"C\F&_F3NF#G0
MYV0U]#DM?1*HWJ[M%4,_E%W8(LN!/G@H<$FM,!Z!#MW:FGCN'4&/:@45<VN+
M@X,^@D$=C/)P,O+HQ*/^E/7TNC .BTC1.)L:(D /-C2.5.0/O*="[N>"F[T[
M$3>B=Q1UH,[\C@5? 3QC2B3PQ%-"Q'V P9@GAPRA)(,.ZVR-LV'*@BU>907 
M@[5C)G<_+*RG-<(1:_B^%L;M:%T!Z!_7NMK_52LK,7VPJS6J48S-N*'9+"V#
M2Z8P&<67 ):SCJ5AW&>[SBU6!FM1,L9C+G5G^% YF9=\G&KA/"R,;CDZ/U,!
M']3W,3TLIA-F>"D9Q#H:7\-[''/+$5'\E>FL]BP#RB;#Y!89F@,_I&H[X4::
M/EOG%(2C,(R XP]I& F'W\LT*@PUJF"J6H0AED<GFR#]X%D!JPT-TS6)M:>H
M$<_\ZF'6?Z&SY0RA7%4T2ZA#L7J)]"3VCKC]$D5J>"59$D])K6+O*:EW9K"$
MN;.>[%&-S/488*'5!,!^#*M)B/H1[:9$7W-?:T"T*] G*@-1=[0\EI>J(;X5
M-@C9T^UB#B!-C(Q8D,%!/>#*MK=#5Q8>QP $H#.+_=S,\"#<JCR%;B[5 ?RP
MDFZ8=MQ+B"/1?H&C'ZO]VO>Q0W9X>6N[-SGA)2>KPTM.4ZRL6L7AI22[='A9
MJQUHM7I36EEA0;QG*ZT@DND./&&&MCKI'I_C20WHFDW&A ?!>OW>2&QT'@_Z
MISQYLI50&*]N$@MB7"8EE+)EHP7?4"??YMXBJ=IA4I*X\V V#Q8J%Z$#E"%C
MNHIXLHO7,;M?>428:7].5O<KIRF6#44'ZR39E?H5 MM:O&S W8F%W"Q:"0\8
MLJ6K%;#D$2[+',/&51JM1'LD(GFLBDW#+A<)XH7X]B,_3Q'O>6$*VL>$60E/
M5T&DR?9-W E&PC[2Z5BL>?D.,6].M&WS'9J3E0#_VNU3=M\NVT6,CXNQ+&:4
MU&&K!/44R+LA3HZ3KL=V\EDNT;7'6&66'C0"\D ]BCN $W?NC"N\*B66'5C_
MR X;_8R\?Z_]XY# \R_ALX-_L'!KB]F#[WGRRH93QBJ5U8@JJ?_MZYT]R&WZ
M"(X@>Y0+NGJ8"Z)B_MXM'N>RL#30]]K5W/Q DV6QI20V*VA4H][X5#8!^;=@
MX+)&1OIQ9]0]&UR^^ZP)(DR[#K4Y[76GW^^>QR1J?MAFU?,%N7O\%QW38)\Q
M ?E)["@+*DMD1;(LV@??O1VF>3C/>;?3UWO]4??R]T[\'A>6'-9'RED&EUVV
M"182(>0T(N))9]011*4M]MC=(BE?5=^K0\&^9 L\O+[-#VVBRM^NNI?O].'@
MZO(X>B< <H[WAY#CLGM\=3GL#?HQ&5;$CD\%=7@QZ ^[H44P7<4I+.\?ROC4
M]"@WU+![?-D=Q026Y!6$R]^[EY\U$E* 8 5/@@:DWN@=HV9C]\ZPG!SH<K(:
MN9RF .X2>2U)-NF@FCFX;>UK]=V&U%=8$)]N8L$]N')S?>W:66/'8<;4\\2N
M$(2:CS!KU\+'SU$&'F83F 5@96%XMX)XXU'CPV&<.OWM\MWYX QI>,YI[9]K
M;645&\VZ!H%N- G?LBM>=W3]YX"'LZ6;N66/60=:)L6EAU0\\]S #0N?$SFI
M$\_2):X/%L>HF9<!O/B+")ZIPJ^'H2-L-!M0IS@#^U7KI$4'U+@E-[Z@DOG@
MS N?!#T;GH$2G_O+X5,=0>7<QJS58/* CZC_!7Q.!S!3G,"X/Q]T3K@IF']C
M.Y!LNYVP?^#!((X%KV12$B9MV&82S *N,S;$U9H;P_S Q-B!YYW89Q: );+\
MQN&2E:H>BL@^;%"X:_+G-2@7:5_40NG"8-SY;8+G\7!I9Q:S3'/0&RX0,T$6
M,JCQ&U*_#, )Z41HT-S/6P,T8"DG'T[#@FCR^"EP/U '9L@1'D75,1L$KF;4
M&0WQ(<ESVOE+5^^AOY2](GP_[8Z.7^MGYU<I"=FW MMY;SCJ]G4483=<X$_G
MY 0<*-L=E\1X)!%Z4%3Y-*.E7^:X:?2J9#DZWC%=(-P93S<TE_8 LR!G4/JD
M!H1.S?C$-H;[8J>8AKE+7YQ]Y7VB\[U7<;R3!:8>%9MQTCD$EM87F_6A%G$6
M*'G @T7.I;5/:]%QU[7/:[PB_'A""ZH7Q]G?L7K*T9I=6[7#WP/_7D\Y?&G9
M@"U)54,^M_U</C;.SWIG<XO(($?=$7E9YQ<MV,>_H@B6/%%#=SW=X4<D^$T2
M10H[I5I+GA760/M&4CVBF9SKOPU'E[W^65)YXF[-@FK4%5J<Z6)!^ D>T944
MHNF7N1VY$U#U[<R8NCA9BHN+;5ATW]V!K%_)O0@IKDGM&-[,R+B*CK1E=%C^
MPE5,B51PHWWGQE^X3"J*BR1AF"R8*2POE/46KH*+XD+)Q=:*XB))7*HMWGN5
M2$4:V'TV^UZE@%.*?@M@YPQ"3-4/ B AZ5ZQ6'57-4&(W&FB=/&&:L;^^Z+4
MD,X@%"*UO7:CV6[4<]PG3$]1AO\%.S7!4A)>>))J!M'TS+/861*6?F _.M"L
M- E\A86*=6^PLUHP=)DMF-#<#\_YO@"&>PA>9FPKHD*(XWIWADUXX$[ 0]GL
MU!:>WX3QAX<UW!FQF8R4,66GP'BU+)]$5@RE+><>W.F87W4PB,U.?4^("PM*
MSQI3/SH&,G'9(18(HMKQA=7X1NWP=??\_(C@^,>?Z1@<N?#9.3)X.($&"H/)
M_T\&BB_TYIBH:*@8UF-3.508H5AZ_J@6GC\6RF+_*J5YSQ?)CZDY=RSU^P6M
M4(<PH5)':-XB'=-9AA$80?$3(DAL$T8]*%1N>1DM9(1":=MR,NJ&E$)Y\#!9
MUN&D0@UL,S=+A: 5ZO!-MUE7:D#*,O*M:I9\JZKP!]'/Z"P("$+2'X2EI;_"
M6#ZA)LQ)I+K?;AX(?["K] >15,H?-'+]0;VJ-9K2I0OPB',[.%IC,>_#E$TN
M'MN3$,H/88)B$=F]X1V]IX\SCY1?"E*9M$EY[7K][YWMOU6W#_1_;%YO')7?
M<VY;S1WS'H'@?Z\QF;7KER %P3L%,5*FSCW(FE.77%^__'3]$MZ\O0:?]MKG
M]V61LV$5+K_D7P@C>D<O06Z-T=F$REN&:;&7^%,].&G"K/R<[.QL$-0>BA^R
MA</F!DF6OI($GV'N@-!'Z!C\;:98Y2$>)_(-,TQL,>NVI-L32UB7W4IFKRZ+
M0A*9[$\T_'7"\M=?U_2A?#EE_+C\2\Q?.(I=V_ LM<,0M&(=<R?#Y2"E4!X:
MES4?<U*Q!O!*#Q!HU-434DQ>7E--/3=*]*7BY;S)7J(OIRNOLV2&Y;3EF%VB
MK]+*K)\GR^);2;<_A7%0J!FY5K)F<:53C$L%?ZJ?&TL0E].25S>9825M[(?Q
M"C4RIF4"U>R&<MI2.G*;&=-7T97=R"3/<@%U;@T3'(JX)T'?D7_?)E]5@C49
M&V7S8;3$CJ&0/18MU>KM1C5[]9RC9W%#93=G/:U)NWTU33C[Z$($B>XWAS<D
M$O>GXDL.QYT^RSX/^OWN\4@JOQIV]8O!L/=6*L-G?=@[ZW?.AZMU8R8X%KB6
M72_E B3%HX!(BB,?)'G,29CD<99./8MT("BJMTAUCX753?4YM&)-*T&ET= :
MTKX%/#:C PTOY@[;#XI_;D/J[KBP5-Z9^]Z.G_S-M_"WHE9$G I9K.QJU'O3
M_6*TI<V5A3<%W[*KZUS$I7@4B$MQY",NCSF)N#S.TA "543<+JDVV=34RIF:
M<C7]FTU.Z;9FP47!MU0B)=-)A\3EM.0A3F;(2L\@4YLXKCNKN I,RCKR 9G)
MF41C)AM"\93>D!I,?@?M1KU=SX%BMII%'.Y]0QSRV?%U9Z@/._IYM[\2!O/Z
M)&Q<F\BM^Y^54)$)VC334MFY7*S)# H8R>1\&&5R)F&4R9;VH?OMJGK'OT#-
MOP&,Y,:M"J.$8;)@E&9:+DV;.?-%U"7UY.$QP;&:OAW%-J2:2P'T)$\NTK-9
MDU#/YDN=;V^VVBWU^?9"/=\5[-_<=R=;FH7>!:XE=PER<9?*IBP"),F0CY <
MWB1$<AA7B_#R%"V").\PU \/DE13LU"RR+;L5E N3E(\J^K,K*Z";[EMI\Q9
M.:(NJ2>OU0F.)?4%KFMGI+)CNFIK2WY7_CC+9DT.LVR^=-3!!EKV*,O1\WT'
M64[8D1Q,R8'WUTYO=-$[R0P\$NU;-?)(&B<+YPM<RVV.YJ&<4Y?44X#RF&-)
M?;DH#^EJE,?O*D1Y!NL"RC/X%E%>ST=YEIY%E.?\3/E70OG7CJX3S?L"D$NV
MR0%YDFO9O<-LF,?TI77E0GW%?9B0/WOG*,&A GSRC060SV%.@3Z',WV(?*]=
MRPFA"C5];^!_;=PGV[<R\E/FR<3^(M]RN][9V ^I2^K)Q;W,L:2^',S'=!7B
MY7<5X#V3-87V3+X5L9ZOYW^'DM)AW0YZIW3P0DAC) $_5U>7^."0H!#_4!_2
MD@+NQ(JNBL@%%CC3*D*:6)/PI594)5B2&*H"_&D,CUK41(9'(=K A;$%?.\B
MME2&UR",9$;@_AMSY*V[.HC=.2CS7- CZ#&FNJ#BG$KZJ27)T)NN"C)3!M4\
M%UIH%15@+&_'H8Q4DW%E!DQE)"P6PITC4)208B+>G(&AC R3<8<$5J6D+'@B
@'!R&Q/7-D=43%2"&Q/?3L>@A'"2H:KD X4".*"9T  "A
 
end



Current thread: