CHANGE: I did not properly characterized the problem in my original post, so here is the real situation.
If the bash shell from which I launch "named" is owned by root, then "named" runs perfectly using the "-u" option, even listening on the tun/tap interfaces. But if I run "named" as a regular user, relying on the SUID file setting to elevate privileges, then named fails to listen on any addresses. I believe the differences I saw before related to tun/tap interfaces were due to testing on different RedHat platforms, but this revised problem statement describes what is happening on both platforms. So the real problem is this: It seems I can use the SUID file bit to allow a regular user to launch named, OR I can use the "-u" option of "named" to lower the privileges after launch (requiring native root privileges to launch), but I can't use both at the same time. Can anyone shed any light on this scenario? Thanks. -- Gordon A. Lang On Fri, Sep 25, 2015 at 8:26 PM, Gordon Lang <gl...@goalex.com> wrote: > Problem: named launches and functions perfectly fine if launched without > the "-u" option, but it won't listen on any ip addresses if any of them are > bound to TAP interfaces when the "-u" is used. This problem surfaced when > upgrading to BIND version 9.10.2-P3, but the problem does not occur with > BIND version 9.9.3-P2. > > Background: We place service addresses on their own RedHat tun/tap > interfaces as opposed to placing all of the service addresses on the Eth > interface as secondary addresses. We do this for a number of reasons. > Many years ago, I used multiple loopback interfaces for this purpose, but > a while ago when loopbacks would no longer would on RedHat, we discovered > that RedHat tun/tap interfaces (in the TAP mode) served the same purpose, > and we found a similar construct on Solaris. But now there seems to be a > problem. > > Platform: RedHat Enterprise Linux release 6.6, kernel version > 2.6.32-504.16.2.el6.x86_64 > > Conifg: I have the config file set to listen on two ip addresses, one of > which is bound to eth0, and the other bound to a TAP interface. > . > Here is an excerpt of the debug output when launching "named -u incadmin > -g -d99" which fails to listen on any ip addresses: > > 25-Sep-2015 19:58:49.963 socket 0x7f5921547010: created > 25-Sep-2015 19:58:49.963 sockmgr 0x7f592152e010: watcher got message -3 > for socket 20 > 25-Sep-2015 19:58:49.963 sockmgr 0x7f592152e010: watcher got message -2 > for socket -1 > 25-Sep-2015 19:58:49.963 socket 0x7f5921547010: socket_recv: event > 0x7f5921548010 -> task 0x7f5921540010 > 25-Sep-2015 19:58:49.964 loading configuration from > '/export/local/ISC/bind-9.10.2-P3/etc/named.conf' > 25-Sep-2015 19:58:49.969 reading built-in trusted keys from file > '/export/local/ISC/bind-9.10.2-P3/etc/bind.keys' > 25-Sep-2015 19:58:49.969 set maximum stack size to 18446744073709551615: > success > 25-Sep-2015 19:58:49.969 set maximum data size to 18446744073709551615: > success > 25-Sep-2015 19:58:49.969 set maximum core size to 0: success > 25-Sep-2015 19:58:49.969 set maximum open files to 18446744073709551615: > success > 25-Sep-2015 19:58:49.970 using default UDP/IPv4 port range: [1024, 65535] > 25-Sep-2015 19:58:49.970 using default UDP/IPv6 port range: [1024, 65535] > 25-Sep-2015 19:58:49.971 listening on IPv4 interface eth0, 10.130.33.71#53 > 25-Sep-2015 19:58:49.971 clientmgr @0x7f5921447010: create > 25-Sep-2015 19:58:49.972 sendmsg: Invalid argument > 25-Sep-2015 19:58:49.972 socket 0x7f5921547268: created > 25-Sep-2015 19:58:49.973 socket 0x7f5921547268: destroying > 25-Sep-2015 19:58:49.973 sockmgr 0x7f592152e010: watcher got message -5 > for socket 512 > 25-Sep-2015 19:58:49.973 sockmgr 0x7f592152e010: watcher got message -2 > for socket -1 > 25-Sep-2015 19:58:49.973 could not listen on UDP socket: permission denied > 25-Sep-2015 19:58:49.973 clientmgr @0x7f5921447010: destroy > 25-Sep-2015 19:58:49.973 clientmgr @0x7f5921447010: clientmgr_destroy > 25-Sep-2015 19:58:49.973 creating IPv4 interface eth0 failed; interface > ignored > 25-Sep-2015 19:58:49.973 listening on IPv4 interface nstest2, > 192.168.53.223#53 > 25-Sep-2015 19:58:49.973 clientmgr @0x7f5921447010: create > 25-Sep-2015 19:58:49.973 socket 0x7f5921547268: created > 25-Sep-2015 19:58:49.973 socket 0x7f5921547268: destroying > 25-Sep-2015 19:58:49.973 sockmgr 0x7f592152e010: watcher got message -5 > for socket 512 > 25-Sep-2015 19:58:49.973 sockmgr 0x7f592152e010: watcher got message -2 > for socket -1 > 25-Sep-2015 19:58:49.973 could not listen on UDP socket: permission denied > 25-Sep-2015 19:58:49.973 clientmgr @0x7f5921447010: destroy > 25-Sep-2015 19:58:49.973 clientmgr @0x7f5921447010: clientmgr_destroy > 25-Sep-2015 19:58:49.973 creating IPv4 interface nstest2 failed; interface > ignored > 25-Sep-2015 19:58:49.973 not listening on any interfaces > > > And here is is an excerpt of the debug output when launching "named -g > -d99" which listens on both configured ip addresses: > > 25-Sep-2015 19:59:22.568 socket 0x7fdb2efb3010: created > 25-Sep-2015 19:59:22.568 sockmgr 0x7fdb2ef9a010: watcher got message -3 > for socket 20 > 25-Sep-2015 19:59:22.568 sockmgr 0x7fdb2ef9a010: watcher got message -2 > for socket -1 > 25-Sep-2015 19:59:22.568 socket 0x7fdb2efb3010: socket_recv: event > 0x7fdb2efb4010 -> task 0x7fdb2efac010 > 25-Sep-2015 19:59:22.569 loading configuration from > '/export/local/ISC/bind-9.10.2-P3/etc/named.conf' > 25-Sep-2015 19:59:22.573 reading built-in trusted keys from file > '/export/local/ISC/bind-9.10.2-P3/etc/bind.keys' > 25-Sep-2015 19:59:22.573 set maximum stack size to 18446744073709551615: > success > 25-Sep-2015 19:59:22.573 set maximum data size to 18446744073709551615: > success > 25-Sep-2015 19:59:22.573 set maximum core size to 0: success > 25-Sep-2015 19:59:22.573 set maximum open files to 18446744073709551615: > success > 25-Sep-2015 19:59:22.573 using default UDP/IPv4 port range: [1024, 65535] > 25-Sep-2015 19:59:22.573 using default UDP/IPv6 port range: [1024, 65535] > 25-Sep-2015 19:59:22.574 listening on IPv4 interface eth0, 10.130.33.71#53 > 25-Sep-2015 19:59:22.574 clientmgr @0x7fdb2eeb3010: create > 25-Sep-2015 19:59:22.582 sendmsg: Invalid argument > 25-Sep-2015 19:59:22.582 socket 0x7fdb2efb3268: created > 25-Sep-2015 19:59:22.582 socket 0x7fdb2efb3268 10.130.33.71#53: bound > 25-Sep-2015 19:59:22.582 dispatchmgr 0x7fdb2ef9b310: > dns_dispatch_createudp: Created UDP dispatch for 10.130.33.71#53 with > socket fd 512 > > 25-Sep-2015 19:59:22.582 dispatchmgr 0x7fdb2ef9b310: created UDP > dispatcher 0x7fdb24092720 > 25-Sep-2015 19:59:22.582 dispatch 0x7fdb24092720: created task > 0x7fdb2eeb1790 > 25-Sep-2015 19:59:22.582 dispatch 0x7fdb24092720: created socket > 0x7fdb2efb3268 > 25-Sep-2015 19:59:22.582 clientmgr @0x7fdb2eeb3010: createclients > 25-Sep-2015 19:59:22.582 clientmgr @0x7fdb2eeb3010: get client > 25-Sep-2015 19:59:22.582 clientmgr @0x7fdb2eeb3010: create new > 25-Sep-2015 19:59:22.582 clientmgr @0x7fdb2eeb3010: clientmctx > 25-Sep-2015 19:59:22.582 client @0x7fdb2409d960: create > 25-Sep-2015 19:59:22.582 socket 0x7fdb2efb34c0: created > 25-Sep-2015 19:59:22.583 socket 0x7fdb2efb34c0 10.130.33.71#53: bound > 25-Sep-2015 19:59:22.583 clientmgr @0x7fdb2eeb3010: createclients > 25-Sep-2015 19:59:22.583 clientmgr @0x7fdb2eeb3010: get client > 25-Sep-2015 19:59:22.583 clientmgr @0x7fdb2eeb3010: create new > 25-Sep-2015 19:59:22.583 clientmgr @0x7fdb2eeb3010: clientmctx > 25-Sep-2015 19:59:22.583 client @0x7fdb240abbc0: create > 25-Sep-2015 19:59:22.583 listening on IPv4 interface nstest2, > 192.168.53.223#53 > 25-Sep-2015 19:59:22.583 clientmgr @0x7fdb2eeb3458: create > 25-Sep-2015 19:59:22.583 socket 0x7fdb2efb3718: created > 25-Sep-2015 19:59:22.583 socket 0x7fdb2efb3718 192.168.53.223#53: bound > 25-Sep-2015 19:59:22.583 dispatchmgr 0x7fdb2ef9b310: > dns_dispatch_createudp: Created UDP dispatch for 192.168.53.223#53 with > socket fd 513 > > 25-Sep-2015 19:59:22.583 dispatchmgr 0x7fdb2ef9b310: created UDP > dispatcher 0x7fdb24092100 > 25-Sep-2015 19:59:22.583 dispatch 0x7fdb24092100: created task > 0x7fdb2eeb19d0 > 25-Sep-2015 19:59:22.583 dispatch 0x7fdb24092100: created socket > 0x7fdb2efb3718 > 25-Sep-2015 19:59:22.583 clientmgr @0x7fdb2eeb3458: createclients > 25-Sep-2015 19:59:22.583 clientmgr @0x7fdb2eeb3458: get client > 25-Sep-2015 19:59:22.583 clientmgr @0x7fdb2eeb3458: create new > 25-Sep-2015 19:59:22.583 clientmgr @0x7fdb2eeb3458: clientmctx > 25-Sep-2015 19:59:22.583 client @0x7fdb240ba4d0: create > 25-Sep-2015 19:59:22.583 socket 0x7fdb2efb3970: created > 25-Sep-2015 19:59:22.583 socket 0x7fdb2efb3970 192.168.53.223#53: bound > 25-Sep-2015 19:59:22.583 clientmgr @0x7fdb2eeb3458: createclients > 25-Sep-2015 19:59:22.583 clientmgr @0x7fdb2eeb3458: get client > 25-Sep-2015 19:59:22.583 clientmgr @0x7fdb2eeb3458: create new > 25-Sep-2015 19:59:22.583 clientmgr @0x7fdb2eeb3458: clientmctx > 25-Sep-2015 19:59:22.584 client @0x7fdb240c88a0: create > > > I am wondering if anyone else has any insight into this. Thanks. > > -- > Gordon A. Lang > -- -- Gordon A. Lang
_______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
