Subject: Re: proposals for running named in a non-root chroot cage
To: None <tech-security@netbsd.org>
From: Michael Richardson <mcr@sandelman.ottawa.on.ca>
List: tech-security
Date: 03/11/2001 02:21:15
>>>>> "Andrew" == Andrew Brown <atatat@atatdot.net> writes:
>> - change the build system to populate /var/named/ by default
>> (with named-xfer, the example etc/namedb, ...)
Andrew> ...named-xfer would be installed in /var/named/usr/libexec/named-xfer
Andrew> and a symlink would be put at /usr/libexec/named-xfer?
No, please put a copy, and have "ndc" or something update it if it disappears.
Having the only copy in the chroot jail defeats part of the point of the jail.
>> - alternatively, consider a manual migration tool/process.
Andrew> might not be so bad.
Yes, please.
] Train travel features AC outlets with no take-off restrictions|gigabit is no[
] Michael Richardson, Solidum Systems Oh where, oh where has|problem with[
] mcr@solidum.com www.solidum.com the little fishy gone?|PAX.port 1100[
] panic("Just another NetBSD/notebook using, kernel hacking, security guy"); [