Bug 851671 - glibc: [RFE] Provide ability / mechanism / option to turn off the domain searches in glibc
Summary: glibc: [RFE] Provide ability / mechanism / option to turn off the domain sear...
Keywords:
Status: CLOSED UPSTREAM
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: glibc
Version: 8.2
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: 8.0
Assignee: glibc team
QA Contact: qe-baseos-tools-bugs
URL: http://sourceware.org/bugzilla/show_b...
Whiteboard:
Depends On:
Blocks: 812394 880347
TreeView+ depends on / blocked
 
Reported: 2012-08-24 16:27 UTC by Jan Lieskovsky
Modified: 2023-07-18 14:30 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Enhancement
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-06-22 13:42:06 UTC
Type: Bug
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1761888 0 unspecified CLOSED glibc: domain name resolver should not search names with dots 2023-07-18 14:30:35 UTC
Sourceware 13935 0 P2 RESOLVED getaddrinfo NXDOMAIN hijack exploit for hosts with two-component hostnames 2020-10-30 20:59:11 UTC
Sourceware 25163 0 P1 NEW Allow DNS stub resolver configuration for current search list practices 2020-10-30 20:59:11 UTC

Internal Links: 1761888

Description Jan Lieskovsky 2012-08-24 16:27:45 UTC
Description of problem:

As noted upstream bug:
  http://sourceware.org/bugzilla/show_bug.cgi?id=13935

the currently used domain search / domain creation mechanism in glibc does not allow to turn the implicit domain expansion to be turned off, resulting in security flaw:
  https://bugzilla.redhat.com/show_bug.cgi?id=812394

Since this might be widely used functionality it is not possible directly to switch this behaviour off (due regressions).

Thus as such an option should be implemented, which would allow the system administrator to specify which way of glibc's behaviour (if no domain entry was present, if glibc should determine the domain part from the local hostname as returned by gethostbyname(2) and consider for the domain part to be everything past the first '.' or not) is the desired one.

Version-Release number of selected component (if applicable):
glibc-2.15-47.el7

How reproducible:
Always

Steps to Reproduce:
1. See http://centos.org/modules/newbb/viewtopic.php?topic_id=36693&forum=59
for an example strace log
  
Actual results:
Currently it is not possible to turn the default glibc's 'domain composition' behaviour to turn off.

Expected results:
An /etc/resolv.conf option should be added which once applied would allow to turn the default 'domain composition' behaviour to turn off.

Additional info:
From the resolv.conf manual page:

Most queries for names within this domain can use short names relative to the local domain.  If no domain entry is present, the domain is determined from the local hostname returned by gethostname(2); the domain part is taken to  be  everything  after the first '.'.  Finally, if the hostname does not contain a domain part, the root domain is assumed.

See also:
https://bugzilla.redhat.com/show_bug.cgi?id=812394
http://serverfault.com/questions/341383/possible-nxdomain-hijacking

Comment 8 Florian Weimer 2020-06-22 13:42:06 UTC
We are tracking this upstream:

  https://sourceware.org/bugzilla/show_bug.cgi?id=13935
  https://sourceware.org/bugzilla/show_bug.cgi?id=25163

Once an upstream fix is available, we can review backporting it.


Note You need to log in before you can comment on or make changes to this bug.