[Bug 203901] 'service local_unbound reload' stops name resolution inside jails (but not on host)

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=203901

            Bug ID: 203901
           Summary: 'service local_unbound reload' stops name resolution
                    inside jails (but not on host)
           Product: Base System
           Version: 10.1-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: bin
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: fre.fbsdpr at expertmaker.com

Created attachment 162258
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=162258&action=edit
local_unbound verbosity 4 debug output

Hi,

I did some unbound config changes and, since this was on a critical production
system, thought a 'reload' would be more safe than a 'restart'.  This, however,
bit me, since I did only check if name resolution was still working on the
host.

A 'service local_unbound restart' will make it work inside jails again.

Jails are configured on a separate loopback interface (not lo0) and on a host
local 10.x.x.x/28 network.  Host has "nameserver 127.0.0.1" in /etc/resolv.conf
and jails have "nameserver 10.x.x.1".

Something that also caught my eye was, when doing a

  host# service local_unbound reload
  unbound-checkconf: no errors in /var/unbound/unbound.conf

I see a "Restart" message in /var/log/messages,

  Oct 20 00:04:07 host unbound: [59371:0] notice: Restart of unbound 1.4.22.
  Oct 20 00:04:07 host unbound: [59371:0] notice: init module 0: validator
  Oct 20 00:04:07 host unbound: [59371:0] notice: init module 1: iterator

whereas, for a

  host# service local_unbound restart
  Stopping local_unbound.
  Waiting for PIDS: 59371.
  Starting local_unbound.

I do not,

  Oct 20 00:03:25 host unbound: [59371:0] notice: init module 0: validator
  Oct 20 00:03:25 host unbound: [59371:0] notice: init module 1: iterator

For verbosity level 4 debug output for the 'reload'/SIGHUP and
'restart'/SIGTERM respectively, see attached file.

There are some differences but, lacking time and resources, we have not
investigated further.  Instead we came to the conclusion that, for now, a
'service local_unbound reload' is unsafe and should never be used.

-- 
You are receiving this mail because:
You are the assignee for the bug.