summaryrefslogtreecommitdiff
path: root/source/n/bind/rc.bind
diff options
context:
space:
mode:
Diffstat (limited to 'source/n/bind/rc.bind')
-rw-r--r--source/n/bind/rc.bind51
1 files changed, 38 insertions, 13 deletions
diff --git a/source/n/bind/rc.bind b/source/n/bind/rc.bind
index 6d77d73d..d58dc1e3 100644
--- a/source/n/bind/rc.bind
+++ b/source/n/bind/rc.bind
@@ -1,15 +1,13 @@
#!/bin/sh
# Start/stop/restart the BIND name server daemon (named).
-
# Start bind. In the past it was more secure to run BIND as a non-root
# user (for example, with '-u daemon'), but the modern version of BIND
# knows how to use the kernel's capability mechanism to drop all root
# privileges except the ability to bind() to a privileged port and set
-# process resource limits, so -u should not be needed. If you wish to
-# use it anyway, chown the /var/run/named and /var/named directories to
-# the non-root user. The command options can be set like this in
-# /etc/default/named :
+# process resource limits, so running as a non-root user is not needed.
+# But if you want to run as a non-root user anyway, the command options
+# can be set like this in /etc/default/named:
# NAMED_OPTIONS="-u daemon"
# So you will not have to edit this script.
@@ -17,7 +15,7 @@
# a discussion of which may be found in
# /usr/doc/Linux-HOWTOs/Chroot-BIND-HOWTO.
-# One last note: rndc has a lot of other nice features that it is not
+# One last note: rndc has a lot of other nice features that it is not
# within the scope of this start/stop/restart script to support.
# For more details, see "man rndc" or just type "rndc" to see the options.
@@ -25,17 +23,45 @@
if [ -f /etc/default/named ] ; then . /etc/default/named ; fi
if [ -f /etc/default/rndc ] ; then . /etc/default/rndc ; fi
-# Sanity check. If /usr/sbin/named is missing then it
+# Sanity check. If /usr/sbin/named is missing then it
# doesn't make much sense to try to run this script:
if [ ! -x /usr/sbin/named ]; then
echo "/etc/rc.d/rc.bind: no /usr/sbin/named found (or not executable); cannot start."
exit 1
fi
-# Start BIND. As many times as you like. ;-)
+# Function to find the user BIND is running as in $NAMED_OPTIONS:
+find_bind_user() {
+ if echo $NAMED_OPTIONS | grep -wq "\-u" ; then
+ unset BIND_USER USER_FOUND
+ echo $NAMED_OPTIONS | tr ' ' '\n' | while read element ; do
+ if [ "$USER_FOUND" = "true" ]; then
+ BIND_USER="$element"
+ echo $BIND_USER
+ break
+ elif [ "$element" = "-u" ]; then
+ USER_FOUND="true"
+ fi
+ done
+ else
+ echo "root"
+ fi
+}
+
+# Start BIND. As many times as you like. ;-)
# Seriously, don't run "rc.bind start" if BIND is already
# running or you'll get more than one copy running.
bind_start() {
+ # If we are running as a non-root user, we'll need to be sure that
+ # /var/run/named exists, and /var/run/named and /var/named are
+ # chowned properly to that user:
+ BIND_USER="$(find_bind_user)"
+ if [ ! "$BIND_USER" = "root" ]; then
+ mkdir -p /var/run/named
+ chown -R $BIND_USER /var/run/named /var/named
+ else # prevent error if switching back to running as root:
+ chown -R root /var/run/named /var/named
+ fi
if [ -x /usr/sbin/named ]; then
echo "Starting BIND: /usr/sbin/named $NAMED_OPTIONS"
/usr/sbin/named $NAMED_OPTIONS
@@ -49,8 +75,8 @@ bind_start() {
if ps axc | grep -q named ; then
echo "SUCCESS: named started."
else
- echo "FAILED: Sorry, a second attempt to start named has also failed."
- echo "There may be a configuration error that needs fixing. Good luck!"
+ echo "FAILED: Sorry, a second attempt to start named has also failed."
+ echo "There may be a configuration error that needs fixing. Good luck!"
fi
fi
}
@@ -62,8 +88,8 @@ bind_stop() {
# A problem with using "/usr/sbin/rndc stop" is that if you
# managed to get multiple copies of named running it will
# only stop one of them and then can't stop the others even
- # if you run it again. So, after doing things the nice way
- # we'll do them the old-fashioned way. If you don't like
+ # if you run it again. So, after doing things the nice way
+ # we'll do them the old-fashioned way. If you don't like
# it you can comment it out, but unless you have a lot of
# other programs you run called "named" this is unlikely
# to have any ill effects:
@@ -109,4 +135,3 @@ case "$1" in
*)
echo "usage $0 start|stop|reload|restart|status"
esac
-