Bug 1321239

Summary: The bind and bind-chroot packages specs define and apply group ownership and permissions differently for the /usr/lib64/bind (chroot'd as /var/named/chroot/usr/lib64/bind) directory
Product: Red Hat Enterprise Linux 6 Reporter: Mukesh Thapa <mthapa>
Component: bindAssignee: Petr Menšík <pemensik>
Status: CLOSED ERRATA QA Contact: Petr Sklenar <psklenar>
Severity: medium Docs Contact:
Priority: medium    
Version: 6.7CC: akarande, mdshaikh, pemensik, psklenar, thozza
Target Milestone: rcKeywords: Patch
Target Release: 6.9   
Hardware: All   
OS: All   
Fixed In Version: bind-9.8.2-0.59.rc1.el6 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1392531 (view as bug list) Environment:
Last Closed: 2017-03-21 10:06:54 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 1269194, 1356054, 1359261, 1392531, 1392538    

Description Mukesh Thapa 2016-03-25 05:26:32 UTC
Description of problem:

The bind and bind-chroot packages specs define and apply group ownership and permissions differently for the /usr/lib64/bind (chroot'd as /var/named/chroot/usr/lib64/bind) directory.

Version-Release number of selected component (if applicable):
Red Hat Enterprise Linux 6.7

How to re-produce.

# rpm -q --queryformat '%{NAME}:\n[%{FILEMODES:perms} %{FILEUSERNAME} %{FILEGROUPNAME} %{FILEFLAGS:fflags} %{FILENAMES}\n]' bind | grep lib64
drwxr-xr-x root root  /usr/lib64/bind

# rpm -q --queryformat '%{NAME}:\n[%{FILEMODES:perms} %{FILEUSERNAME} %{FILEGROUPNAME} %{FILEFLAGS:fflags} %{FILENAMES}\n]' bind-chroot | grep lib64
drwxr-x--- root named  /var/named/chroot/usr/lib64/bind

*** On disk ownership and permissions (matches bind-chroot specs)

# ll /usr/lib64 | grep bind
drwxr-x---.  2 root named     4096 Mar  9 16:05 bind

*** The results of RPM validation (flagging because the bind specs do not match)

# rpm -Va  | grep '^.M'
.M....G..    /usr/lib64/bind

# rpm -Va | grep '^......G'
.M....G..    /usr/lib64/bind

Expected results:

Same permission should not inherit.

Comment 5 Petr Menšík 2016-10-26 14:55:37 UTC
When bind-chroot is installed, result of

(sudo) rpm -V bind-chroot

is different, when named service is stopped and when is started.

Current version will pass check when stopped.
service named stop
rpm -V bind bind-chroot

But fails after (successful) start
service named start
rpm -V bind bind-chroot

Test case should include both cases.

Comment 16 errata-xmlrpc 2017-03-21 10:06:54 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.