Description of problem:
I have named (bind) and dhcpd configured to perform dynamic dns updates.
With selinux in enforcing mode, I need to enable named for writing
master zones. Now to support dynamic dns updating from dhcpd, named
creates and updates "___.jnl" files for each zone being handled but
does not modify the actual files which define the base zone
information. To have this work with selinx, I need to set the
named_write_master_zones boolean which (if I understand correctly)
enables it to modify any of the zone files whereas I only want it to
create and update the .jnl files.
This level of granularity should be supported.
I have made this an RFE although I could also consider it a bug.
also see https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=141800
Actually, the .jnl files are just a place to store incoming DDNS
updates, which are then "flushed" periodically or by the "rndc flush"
command : ie. the updates are merged with the existing zone file
contents and the zone file is replaced with the updated zone .
So I can't see any point to enabling .jnl file write without also
enabling zone file write: doing so would make all updates impermanen t
with the same lifetime as the current named instance.
If these 'impermanent updates' are what you want, the same result
could be achieved by making the original zone files read-only.
Thanks for the information. I was not aware that the updates were
merged into the regular zone files.
With this understanding, I am closing the report.
Actually, the above is not quite the full story.
In BIND-9.2.4, the .jnl updates are merged with the master zone
only on name server shutdown / startup.
In BIND-9.3.0, there is now the 'rndc freeze' command, which merges
in the updates and disables DDNS for a zone, and the 'rndc unfreeze'
command, which re-enables DDNS for a zone.