svn commit: r200563 - in head/etc: mtree namedb

[Robert Watson]

On Tue, 15 Dec 2009, Doug Barton wrote:

>  The named process needs to have a "working directory" that it can
>  write to. This is specified in "options { directory }" in named.conf.
>  So, create /etc/namedb/working with appropriate permissions, and
>  update the entry in named.conf to match.
>
>  In addition to specifying the working directory, file and path names
>  in named.conf can be specified relative to the directory listed.
>  However, since that directory is now different from /etc/namedb
>  (where the configuration, zone, rndc.*, and other files are located)
>  further update named.conf to specify all file names with fully
>  qualified paths. Also update the comment about file and path names
>  so users know this should be done for all file/path names in the file.
>
>  This change will eliminate the 'working directory is not writable'
>  messages at boot time without sacrificing security. It will also
>  allow for features in newer versions of BIND (9.7+) to work as
>  designed.

On a couple of occasions, I've found myself trying to help people get BIND to 
core dump on a bug, which is a bit tricky in practice.  It involves setting 
appropriate sysctls so that sugid processes generate cores, arranging for a 
writable core dump directory in the chroot and setting a sysctl so it is 
found, etc.  Does this change simplify that process down to "enable core dump 
for sugid processes"?  If not, are there other things we could do to make this 
easier?

Robert N M Watson
Computer Laboratory
University of Cambridge