Description of problem: As noted upstream bug: http://sourceware.org/bugzilla/show_bug.cgi?id=13935 the currently used domain search / domain creation mechanism in glibc does not allow to turn the implicit domain expansion to be turned off, resulting in security flaw: https://bugzilla.redhat.com/show_bug.cgi?id=812394 Since this might be widely used functionality it is not possible directly to switch this behaviour off (due regressions). Thus as such an option should be implemented, which would allow the system administrator to specify which way of glibc's behaviour (if no domain entry was present, if glibc should determine the domain part from the local hostname as returned by gethostbyname(2) and consider for the domain part to be everything past the first '.' or not) is the desired one. Version-Release number of selected component (if applicable): glibc-2.15-47.el7 How reproducible: Always Steps to Reproduce: 1. See http://centos.org/modules/newbb/viewtopic.php?topic_id=36693&forum=59 for an example strace log Actual results: Currently it is not possible to turn the default glibc's 'domain composition' behaviour to turn off. Expected results: An /etc/resolv.conf option should be added which once applied would allow to turn the default 'domain composition' behaviour to turn off. Additional info: From the resolv.conf manual page: Most queries for names within this domain can use short names relative to the local domain. If no domain entry is present, the domain is determined from the local hostname returned by gethostname(2); the domain part is taken to be everything after the first '.'. Finally, if the hostname does not contain a domain part, the root domain is assumed. See also: https://bugzilla.redhat.com/show_bug.cgi?id=812394 http://serverfault.com/questions/341383/possible-nxdomain-hijacking
We are tracking this upstream: https://sourceware.org/bugzilla/show_bug.cgi?id=13935 https://sourceware.org/bugzilla/show_bug.cgi?id=25163 Once an upstream fix is available, we can review backporting it.