Red Hat Bugzilla – Bug 851671
[RFE] glibc: Provide ability / mechanism / option to turn off the domain searches in glibc
Last modified: 2017-08-02 02:47:05 EDT
Description of problem:
As noted upstream bug:
the currently used domain search / domain creation mechanism in glibc does not allow to turn the implicit domain expansion to be turned off, resulting in security flaw:
Since this might be widely used functionality it is not possible directly to switch this behaviour off (due regressions).
Thus as such an option should be implemented, which would allow the system administrator to specify which way of glibc's behaviour (if no domain entry was present, if glibc should determine the domain part from the local hostname as returned by gethostbyname(2) and consider for the domain part to be everything past the first '.' or not) is the desired one.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. See http://centos.org/modules/newbb/viewtopic.php?topic_id=36693&forum=59
for an example strace log
Currently it is not possible to turn the default glibc's 'domain composition' behaviour to turn off.
An /etc/resolv.conf option should be added which once applied would allow to turn the default 'domain composition' behaviour to turn off.
From the resolv.conf manual page:
Most queries for names within this domain can use short names relative to the local domain. If no domain entry is present, the domain is determined from the local hostname returned by gethostname(2); the domain part is taken to be everything after the first '.'. Finally, if the hostname does not contain a domain part, the root domain is assumed.