Bug 851671

Description of problem:

As noted upstream bug:
  http://sourceware.org/bugzilla/show_bug.cgi?id=13935

the currently used domain search / domain creation mechanism in glibc does not allow to turn the implicit domain expansion to be turned off, resulting in security flaw:
  https://bugzilla.redhat.com/show_bug.cgi?id=812394

Since this might be widely used functionality it is not possible directly to switch this behaviour off (due regressions).

Thus as such an option should be implemented, which would allow the system administrator to specify which way of glibc's behaviour (if no domain entry was present, if glibc should determine the domain part from the local hostname as returned by gethostbyname(2) and consider for the domain part to be everything past the first '.' or not) is the desired one.

Version-Release number of selected component (if applicable):
glibc-2.15-47.el7

How reproducible:
Always

Steps to Reproduce:
1. See http://centos.org/modules/newbb/viewtopic.php?topic_id=36693&forum=59
for an example strace log
  
Actual results:
Currently it is not possible to turn the default glibc's 'domain composition' behaviour to turn off.

Expected results:
An /etc/resolv.conf option should be added which once applied would allow to turn the default 'domain composition' behaviour to turn off.

Additional info:
From the resolv.conf manual page:

Most queries for names within this domain can use short names relative to the local domain.  If no domain entry is present, the domain is determined from the local hostname returned by gethostname(2); the domain part is taken to  be  everything  after the first '.'.  Finally, if the hostname does not contain a domain part, the root domain is assumed.

See also:
https://bugzilla.redhat.com/show_bug.cgi?id=812394
http://serverfault.com/questions/341383/possible-nxdomain-hijacking