Bug 143440 - RFE: more granularity for dynamic DNS updates
Summary: RFE: more granularity for dynamic DNS updates
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 3
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2004-12-20 21:22 UTC by Gene Czarcinski
Modified: 2007-11-30 22:10 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2004-12-20 21:54:54 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Gene Czarcinski 2004-12-20 21:22:15 UTC
Description of problem:

I have named (bind) and dhcpd configured to perform dynamic dns updates.

With selinux in enforcing mode, I need to enable named for writing
master zones.  Now to support dynamic dns updating from dhcpd, named
creates and updates "___.jnl" files for each zone being handled but
does not modify the actual files which define the base zone
information.  To have this work with selinx, I need to set the
named_write_master_zones boolean which (if I understand correctly)
enables it to modify any of the zone files whereas I only want it to
create and update the .jnl files.

This level of granularity should be supported.

I have made this an RFE although I could also consider it a bug.

Comment 1 Gene Czarcinski 2004-12-20 21:22:57 UTC
also see https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=141800

Comment 2 Jason Vas Dias 2004-12-20 21:47:18 UTC
 Actually, the .jnl files are just a place to store incoming DDNS 
 updates, which are then "flushed" periodically or by the "rndc flush"
 command : ie. the updates are merged with the existing zone file 
 contents and the zone file is replaced with the updated zone .

 So I can't see any point to enabling .jnl file write without also
 enabling zone file write: doing so would make all updates impermanen   t
 with the same lifetime as the current named instance.  
 
 If these 'impermanent updates' are what you want, the same result 
 could be achieved by making the original zone files read-only. 

Comment 3 Gene Czarcinski 2004-12-20 21:54:54 UTC
Thanks for the information.  I was not aware that the updates were
merged into the regular zone files.

With this understanding, I am closing the report.

Comment 4 Jason Vas Dias 2004-12-20 22:31:41 UTC
 Actually, the above is not quite the full story. 
 See: 
  file:///usr/share/doc/bind-9.2.4/arm/Bv9ARM.ch04.html#dynamic_update
  file:///usr/share/doc/bind-9.3.0/arm/Bv9ARM.ch03.html#AEN347

 In BIND-9.2.4, the .jnl updates are merged with the master zone 
 only on name server shutdown / startup.
 
 In BIND-9.3.0, there is now the 'rndc freeze' command, which merges
 in the updates and disables DDNS for a zone, and the 'rndc unfreeze'
 command, which re-enables DDNS for a zone.


Note You need to log in before you can comment on or make changes to this bug.