Hi John, > Thank you for the obvious suggestion, Mark. It hadn't occurred to me that a > yum update might have clobbered my existing permissions. > > Sure enough, there it was - > 755 root:root /var/opt/isc/isc-bind/log/ > Everything in that directory was still - > 644 named:named > but the user "named" was unable to create anything new > > Looking at my installation notes from earlier this year, I found the > following: > > Adjust the log directory permissions. chown named:named > > /var/opt/isc/isc-bind/log > > chmod 775 /var/opt/isc/isc-bind/log > > I have re-applied that permission change, and things are happy again. Which > brings me to two follow-up questions. > > A) Should I expect these file permissions be altered by a minor update? I > know I started at 9.11.8 and have updated to 9.11.9 and 9.11.10 without > seeing this behavior.
/var/opt/isc/isc-bind/log is part of the isc-bind-runtime package, which is the runtime package for the isc-bind Software Collection. The contents of that package are determined by the %{scl_files} macro used in the *.spec file for the isc-bind metapackage [1]. That is how the runtime package is supposed to be created according to Software Collection docs [2]. We do not add that directory explicitly. Answering your question, this directory is not touched when you update the isc-bind-bind package (which is usually the only package that gets updated whenever a new version of BIND is released), but it *will* be affected (i.e. its permissions will be reset to those specified by the package) by isc-bind-runtime updates. We recently had to update the metapackage to make the Software Collection work on RHEL/CentOS 8, which also caused a revision bump for the isc-bind-runtime package. That is likely the update that caused the permissions on your box to be reset. Updates like this are rare, but can happen from time to time, so I would avoid relying on customized permissions for packaged directories. > B) Should I not be logging to /var/opt/isc/isc-bind/log? > The log path in my named.conf is currently set to a relative path > "../../log/query.log", but I could easily change it to an absolute path > "/var/log/named/query.log" You can really log where you want as long as the permissions are right. The default named.conf included with our packages causes logs to be written to /var/opt/isc/isc-bind/named/data/named.run, mimicking what stock RHEL/CentOS BIND packages do (with the path adjusted to follow the Software Collection's directory layout). Note that /var/opt/isc/isc-bind/log is the Software Collection's equivalent of /var/log; if you configured named to log to the latter, it would also not work because /var/log is owned by root:root by default, just like /var/opt/isc/isc-bind/log is. If you are okay with adhering to the Software Collection's directory layout, feel free to create a subdirectory in /var/opt/isc/isc-bind/log with proper permissions - subdirectories should not be affected by the metapackage updates I mentioned above. But the Software Collection does not force you to use that location. Hope this helps, [1] https://gitlab.isc.org/isc-packages/rpms/isc-bind/blob/434d4d8a6e436e0943cfc2deac2f1a07fe3136b5/isc-bind.spec#L63 [2] https://www.softwarecollections.org/en/docs/guide/#bh-Example_of_the_Meta_Package -- Best regards, Michał Kępień _______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users