Bug 2121623 - [DDF] Is unbound supported with chroot ?
Summary: [DDF] Is unbound supported with chroot ?
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: Red_Hat_Enterprise_Linux-Release_Notes-7-en-US
Version: 7.9
Hardware: All
OS: All
medium
unspecified
Target Milestone: rc
: ---
Assignee: Lenka Špačková
QA Contact:
Šárka Jana
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-08-26 03:03 UTC by Direct Docs Feedback
Modified: 2022-10-19 15:55 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Enhancement
Doc Text:
If this bug requires documentation, please select an appropriate Doc Type value.
Clone Of:
Environment:
Last Closed: 2022-10-17 14:53:27 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-132401 0 None None None 2022-08-26 03:24:29 UTC

Description Direct Docs Feedback 2022-08-26 03:03:40 UTC
Hi

 From seeing the bug, it seems that we don't support unbound with chroot.
    
    Bug 1113947 - Add unbound-chroot systemd service for running unbound in the chroot (edit)
    https://bugzilla.redhat.com/show_bug.cgi?id=1113947

On the other hand,we are talking about chroot command here.

Is there nothing with unbound chroot , or anything wrong with the description?

In short,I was wondering whether unbound is supported with chroot or not.

Thank you very much in advance.

Reported by: rhn-support-shgao

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.5_release_notes/new_features_networking#annotations:d81534d4-0f1c-4bb3-86bb-f43e1ea71caf

Comment 5 Petr Menšík 2022-08-30 10:44:12 UTC
We definitely do not recommend running unbound under chroot. SELinux system protection in enforcing mode provides much better security. If SELinux is enforcing then protection is already strong enough and chroot does not improve it significantly. Protection by chroot is lower and I would recommend to consider it only when SELinux cannot be kept in enforcing mode.

I think we may prepare support article with steps required to have working unbound in chroot environment. But unlike bind we have not prepared special package with helpers, because it should not be necessary.

Comment 16 Lenka Špačková 2022-10-19 15:55:47 UTC
Thanks a lot for the input!

The new release note is now published:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/new_features#BZ-2121623

linking to the new article: https://access.redhat.com/articles/6980379


Note You need to log in before you can comment on or make changes to this bug.