Bug 851671 - [RFE] glibc: Provide ability / mechanism / option to turn off the domain searches in glibc
[RFE] glibc: Provide ability / mechanism / option to turn off the domain sear...
Status: NEW
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: glibc (Show other bugs)
7.1
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: glibc team
qe-baseos-tools
http://sourceware.org/bugzilla/show_b...
: FutureFeature, Security
Depends On:
Blocks: 880347 812394
  Show dependency treegraph
 
Reported: 2012-08-24 12:27 EDT by Jan Lieskovsky
Modified: 2017-08-02 02:47 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2012-08-24 12:27:45 EDT
Description of problem:

As noted upstream bug:
  http://sourceware.org/bugzilla/show_bug.cgi?id=13935

the currently used domain search / domain creation mechanism in glibc does not allow to turn the implicit domain expansion to be turned off, resulting in security flaw:
  https://bugzilla.redhat.com/show_bug.cgi?id=812394

Since this might be widely used functionality it is not possible directly to switch this behaviour off (due regressions).

Thus as such an option should be implemented, which would allow the system administrator to specify which way of glibc's behaviour (if no domain entry was present, if glibc should determine the domain part from the local hostname as returned by gethostbyname(2) and consider for the domain part to be everything past the first '.' or not) is the desired one.

Version-Release number of selected component (if applicable):
glibc-2.15-47.el7

How reproducible:
Always

Steps to Reproduce:
1. See http://centos.org/modules/newbb/viewtopic.php?topic_id=36693&forum=59
for an example strace log
  
Actual results:
Currently it is not possible to turn the default glibc's 'domain composition' behaviour to turn off.

Expected results:
An /etc/resolv.conf option should be added which once applied would allow to turn the default 'domain composition' behaviour to turn off.

Additional info:
From the resolv.conf manual page:

Most queries for names within this domain can use short names relative to the local domain.  If no domain entry is present, the domain is determined from the local hostname returned by gethostname(2); the domain part is taken to  be  everything  after the first '.'.  Finally, if the hostname does not contain a domain part, the root domain is assumed.

See also:
https://bugzilla.redhat.com/show_bug.cgi?id=812394
http://serverfault.com/questions/341383/possible-nxdomain-hijacking

Note You need to log in before you can comment on or make changes to this bug.