Bug 20968 - Upgrade to the P7 bind fails to set ownerships properly
Summary: Upgrade to the P7 bind fails to set ownerships properly
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: bind
Version: 6.1
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Bernhard Rosenkraenzer
QA Contact: Dale Lovelace
Depends On:
TreeView+ depends on / blocked
Reported: 2000-11-16 17:58 UTC by Daniel Senie
Modified: 2005-10-31 22:00 UTC (History)
1 user (show)

Clone Of:
Last Closed: 2002-01-24 22:51:36 UTC

Attachments (Terms of Use)

Description Daniel Senie 2000-11-16 17:58:50 UTC
The RPM upgrade to the new P7 patch level of Bind changes the way bind is 
run, so that it runs under user named, group named, instead of root.root. 
While a good move security-wise, the installation scripts were not 
sufficient to properly do this upgrade. I'm cleaning up a lot of systems 
by hand.

Specifically, the /var/run/named.pid file should have been set to 
named.named ownership, and the entire contents of /var/named should have 
been set (i.e. chown -R named.named /var/named) to ensure all existing 
zone files in that directory are properly set. This last is especially 
important on secondary name servers, where those files must be overwritten 
by the running named process when zones are updated.

I observed this behaviour with Redhat 6.1 plus patches, but it will 
certainly happen the same way on all releases to which this patch is 

Comment 1 Daniel Senie 2000-11-21 17:35:18 UTC
Further problems. It's not enough to set ownership on /var/run/named.pid, since bind wants to be able to CREATE the pid file. My solution to this is to 
create a directory:


which is owned by named.named, then alter /etc/named.conf to include in the options area:

pid-file "/var/run/named/named.pid";

While this works, it appears it'll confuse the library of functions in /etc/rc.d/init.d/functions which expect the PID file to be in /var/run. The solution to this 
would be to alter the /etc/rc.d/init.d/named script to NOT use /etc/rc.d/init.d/functions at all.

Is anyone at RedHat actually looking into a fixed RPM for this? I'm busy repatching a few dozen systems, but sooner or later the masses are going to 
scream for a fixed RPM.

Comment 2 Karsten Hopp 2002-07-22 12:06:57 UTC
The current bind package uses /var/run/named/named.pid for it's pid file as 
suggested in the bind FAQ.

Note You need to log in before you can comment on or make changes to this bug.