On Fri, 09 Jan 2009 00:00:15 +1100 Bruce Tulloch wrote > This bug still exists in lenny as of today (bind9/1:9.5.0.dfsg.P2-4) > despite it being reported as fixed in bind9/1:9.5.0.dfsg.P2-1.
Also exists today with bind9/lenny uptodate 1:9.5.1.dfsg.P3-1+lenny1 (presumably after the DNS cache poisoning update CVE-2009-4022) > Clearly the maintainer scripts in bind9/1:9.5.0.dfsg.P2-4 are *still* > setting the ownership permissions for /etc/bind/rndc.key incorrectly. I also think so :-( > What is not clear to me is why ownership of bind.bind does not work. I'd guess it's because of no capabilities settings. It does: 25342 capget(0x20080522, 0, NULL) = -1 EFAULT (Bad address) 25342 capget(0x20080522, 0, NULL) = -1 EFAULT (Bad address) 25342 capget(0x20080522, 0, {CAP_DAC_READ_SEARCH|CAP_SETGID|CAP_SETUID|CAP_NET_BIND_SERVICE|CAP_SYS_CHROOT|CAP_SYS_RESOURCE, CAP_DAC_READ_SEARCH|CAP_SETGID|CAP_SETUID|CAP_NET_BIND_SERVICE|CAP_SYS_CHROOT|CAP_SYS_RESOURCE, 0}) = 0 25342 getuid() = 0 25342 capset(0x20080522, 0, {CAP_NET_BIND_SERVICE|CAP_SYS_RESOURCE, CAP_NET_BIND_SERVICE|CAP_SYS_RESOURCE, 0}) = 0 and then, with /etc/bind/rndc.key owned by bind:bind, rw-r-----, and no setuid, it runs the following sequence (all but the last line are for context) 25344 open("/etc/bind/named.conf", O_RDONLY) = 9 25344 fstat(9, {st_mode=S_IFREG|0640, st_size=1091, ...}) = 0 25344 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f48e9616000 25344 read(9, "// This is the primary configurat"..., 4096) = 1091 25344 open("/etc/bind/named.conf.options", O_RDONLY) = 10 25344 fstat(10, {st_mode=S_IFREG|0640, st_size=2786, ...}) = 0 25344 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f48e9615000 25344 read(10, "acl trusted_ns {\n\t194.243.254.162"..., 4096) = 2786 25344 open("/etc/bind/rndc.key", O_RDONLY) = -1 EACCES (Permission denied) And thereafter fails. The usual workaround, chown root /etc/bind/rndc.key, still works... -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org