Skip to main content
Unix & Linux

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

4
  • I've always configured Bind with a writable working directory. Bind reference (bind9.readthedocs.io/en/latest/reference.html) says "<...>For this reason, among others, the working directory should be always be writable by named. <...>" so I guess it's by design, regardless of operation mode. Commented Jul 30, 2024 at 9:33
  • @Edward Thanks. Perhaps these temporary files could be written elsewhere? In my setup they are not needed and security hardening principles say a daemon cannot be allowed change its own configuration. Commented Jul 30, 2024 at 9:49
  • If you are running SELinux in enforced mode, bind can't change it's own config even when it's writable because the named_t domain isn't allowed write on named_conf_t file contexts: sesearch --allow -s named_t -t named_conf_t -c file shows readonly access. But then you need to be sure that your config files have the named_conf_t context. By default, that should be true. Commented Jul 30, 2024 at 13:22
  • Good point. SELinux is set to enforcing but could named by accident/hack write zone files (db)? Those are not strictly config files but I want to make sure these are not changed or deleted. Commented Jul 30, 2024 at 17:18