bind-chroot directory permissions?

[Gene Czarcinski]

On Friday 25 September 2009 11:21:41 Tom Horsley wrote:
> I recently enabled dynamic DNS for the virtual machines I've
> been installing and named started getting errors (running
> as chroot) trying to write .jnl files to the /var/named
> directory under the chroot. Fixing the directory to
> be root:named 770 instead of root:named 750 took care of
> that.
> 
> Then with the recent update of bind and bind-chroot, I started
> seeing these messages in the log:
> 
> Sep 25 08:03:21 zooty named[12710]: dumping master file: tmp-PDw9vymVVL:
>  open: permission denied
> 
> I'm not sure what directory it is trying to write those
> in, but I found and chmodded a few more directories
> and haven't seen one of those messages since.
> 
> Should directory permissions be adjusted in one or more
> of the rpms to take these things into account?
> 

1. Don't turn selinux off on your local name-server system ... it actually 
works fine with bind/named.

2. You really do not need to run chroot'ed if you have selinux enabled.  
However, it will run fine and with selinux -- this will give you an "belt and 
suspenders" solution for named security.

3. As currently implemented on Fedora 11, dynamic updates (by dhcpd I assume) 
need to have your "database" files in either a "dynamic" or a "slaves" 
subdirectory of the "named" directory (either one will work).

4.  Then, in the zone definitions in the named.conf file, you need to point to 
the subdirectory with something like:
      file  "dynamic/lcl.db";
rather than:
     file  "lcl.db";

Gene