freebsd-dev/etc/rc.d/named
Doug Barton a16334d031 In the case where named_chroot_autoupdate is NOT set, but
named_chrootdir IS set, named-checkconf fails because it
cannot find the conf file. Fix this by making checkconf a
variable that includes "-t $named_chrootdir" as needed.
Notice of the bug and suggested direction for the fix from [1].

Using required_files for named.conf is overkill ever since
I added the named-checkconf call, so rather than update the
logic to handle the case described above, remove it. This
also handles the case where named_chroot_autoupdate IS set
but the symlink doesn't exist yet.

PR:		conf/145904
Submitted by:	J R Matthews
2010-04-28 22:29:17 +00:00

286 lines
7.1 KiB
Bash
Executable File

#!/bin/sh
#
# $FreeBSD$
#
# PROVIDE: named
# REQUIRE: SERVERS cleanvar
# KEYWORD: shutdown
. /etc/rc.subr
name="named"
rcvar=named_enable
extra_commands="reload"
start_precmd="named_prestart"
start_postcmd="named_poststart"
reload_cmd="named_reload"
stop_cmd="named_stop"
stop_postcmd="named_poststop"
# If running in a chroot cage, ensure that the appropriate files
# exist inside the cage, as well as helper symlinks into the cage
# from outside.
#
# As this is called after the is_running and required_dir checks
# are made in run_rc_command(), we can safely assume ${named_chrootdir}
# exists and named isn't running at this point (unless forcestart
# is used).
#
chroot_autoupdate()
{
local file
# Create (or update) the chroot directory structure
#
if [ -r /etc/mtree/BIND.chroot.dist ]; then
mtree -deU -f /etc/mtree/BIND.chroot.dist \
-p ${named_chrootdir}
else
warn "/etc/mtree/BIND.chroot.dist missing,"
warn "chroot directory structure not updated"
fi
# Create (or update) the configuration directory symlink
#
if [ ! -L "${named_conf%/*}" ]; then
if [ -d "${named_conf%/*}" ]; then
warn "named chroot: ${named_conf%/*} is a directory!"
elif [ -e "${named_conf%/*}" ]; then
warn "named chroot: ${named_conf%/*} exists!"
else
ln -s ${named_confdir} ${named_conf%/*}
fi
else
# Make sure it points to the right place.
ln -shf ${named_confdir} ${named_conf%/*}
fi
# Mount a devfs in the chroot directory if needed
#
if [ `${SYSCTL_N} security.jail.jailed` -eq 0 ]; then
umount ${named_chrootdir}/dev 2>/dev/null
devfs_domount ${named_chrootdir}/dev devfsrules_hide_all
devfs -m ${named_chrootdir}/dev rule apply path null unhide
devfs -m ${named_chrootdir}/dev rule apply path random unhide
else
if [ -c ${named_chrootdir}/dev/null -a \
-c ${named_chrootdir}/dev/random ]; then
info "named chroot: using pre-mounted devfs."
else
err 1 "named chroot: devfs cannot be mounted from" \
"within a jail. Thus a chrooted named cannot" \
"be run from within a jail." \
"To run named without chrooting it, set" \
"named_chrootdir=\"\" in /etc/rc.conf."
fi
fi
# Copy and/or update key files to the chroot /etc
#
for file in localtime protocols services; do
if [ -r /etc/$file ]; then
cmp -s /etc/$file "${named_chrootdir}/etc/$file" ||
cp -p /etc/$file "${named_chrootdir}/etc/$file"
fi
done
}
# Make symlinks to the correct pid file
#
make_symlinks()
{
checkyesno named_symlink_enable &&
ln -fs "${named_chrootdir}${pidfile}" ${pidfile}
}
named_poststart () {
make_symlinks
if checkyesno named_wait; then
until ${command%/sbin/named}/bin/host $named_wait_host >/dev/null 2>&1; do
echo " Waiting for nameserver to resolve $named_wait_host"
sleep 1
done
fi
}
named_reload()
{
${command%/named}/rndc reload
}
named_stop()
{
# This duplicates an undesirably large amount of code from the stop
# routine in rc.subr in order to use rndc to shut down the process,
# and to give it a second chance in case rndc fails.
rc_pid=$(check_pidfile $pidfile $command)
if [ -z "$rc_pid" ]; then
[ -n "$rc_fast" ] && return 0
_run_rc_notrunning
return 1
fi
echo 'Stopping named.'
if ${command%/named}/rndc stop 2>/dev/null; then
wait_for_pids $rc_pid
else
echo -n 'rndc failed, trying kill: '
kill -TERM $rc_pid
wait_for_pids $rc_pid
fi
}
named_poststop()
{
if [ -n "${named_chrootdir}" -a -c ${named_chrootdir}/dev/null ]; then
if [ `${SYSCTL_N} security.jail.jailed` -eq 0 ]; then
umount ${named_chrootdir}/dev 2>/dev/null || true
else
warn "named chroot:" \
"cannot unmount devfs from inside jail!"
fi
fi
}
create_file () {
if [ -e "$1" ]; then
unlink $1
fi
> $1
chown root:wheel $1
chmod 644 $1
}
named_prestart()
{
command_args="-u ${named_uid:=root}"
if [ ! "$named_conf" = '/etc/namedb/named.conf' ]; then
case "$named_flags" in
-c*|*' -c'*) ;; # No need to add it
*) command_args="-c $named_conf $command_args" ;;
esac
fi
local line nsip firstns
# Is the user using a sandbox?
#
if [ -n "$named_chrootdir" ]; then
rc_flags="$rc_flags -t $named_chrootdir"
checkyesno named_chroot_autoupdate && chroot_autoupdate
else
named_symlink_enable=NO
fi
# Create an rndc.key file for the user if none exists
#
confgen_command="${command%/named}/rndc-confgen -a -b256 -u $named_uid \
-c ${named_confdir}/rndc.key"
if [ -s "${named_confdir}/rndc.conf" ]; then
unset confgen_command
fi
if [ -s "${named_confdir}/rndc.key" ]; then
case `stat -f%Su ${named_confdir}/rndc.key` in
root|$named_uid) ;;
*) $confgen_command ;;
esac
else
$confgen_command
fi
local checkconf
checkconf="${command%/named}/named-checkconf"
if ! checkyesno named_chroot_autoupdate && [ -n "$named_chrootdir" ]; then
checkconf="$checkconf -t $named_chrootdir"
fi
# Create a forwarder configuration based on /etc/resolv.conf
if checkyesno named_auto_forward; then
if [ ! -s /etc/resolv.conf ]; then
warn "named_auto_forward enabled, but no /etc/resolv.conf"
# Empty the file in case it is included in named.conf
[ -s "${named_confdir}/auto_forward.conf" ] &&
create_file ${named_confdir}/auto_forward.conf
$checkconf $named_conf ||
err 3 'named-checkconf for $named_conf failed'
return
fi
create_file /var/run/naf-resolv.conf
create_file /var/run/auto_forward.conf
echo ' forwarders {' > /var/run/auto_forward.conf
while read line; do
case "$line" in
'nameserver '*|'nameserver '*)
nsip=${line##nameserver[ ]}
if [ -z "$firstns" ]; then
if [ ! "$nsip" = '127.0.0.1' ]; then
echo 'nameserver 127.0.0.1'
echo " ${nsip};" >> /var/run/auto_forward.conf
fi
firstns=1
else
[ "$nsip" = '127.0.0.1' ] && continue
echo " ${nsip};" >> /var/run/auto_forward.conf
fi
;;
esac
echo $line
done < /etc/resolv.conf > /var/run/naf-resolv.conf
echo ' };' >> /var/run/auto_forward.conf
echo '' >> /var/run/auto_forward.conf
if checkyesno named_auto_forward_only; then
echo " forward only;" >> /var/run/auto_forward.conf
else
echo " forward first;" >> /var/run/auto_forward.conf
fi
if cmp -s /etc/resolv.conf /var/run/naf-resolv.conf; then
unlink /var/run/naf-resolv.conf
else
[ -e /etc/resolv.conf ] && unlink /etc/resolv.conf
mv /var/run/naf-resolv.conf /etc/resolv.conf
fi
if cmp -s ${named_confdir}/auto_forward.conf \
/var/run/auto_forward.conf; then
unlink /var/run/auto_forward.conf
else
[ -e "${named_confdir}/auto_forward.conf" ] &&
unlink ${named_confdir}/auto_forward.conf
mv /var/run/auto_forward.conf \
${named_confdir}/auto_forward.conf
fi
else
# Empty the file in case it is included in named.conf
[ -s "${named_confdir}/auto_forward.conf" ] &&
create_file ${named_confdir}/auto_forward.conf
fi
$checkconf $named_conf || err 3 'named-checkconf for $named_conf failed'
}
load_rc_config $name
# Updating the following variables requires that rc.conf be loaded first
#
required_dirs="$named_chrootdir" # if it is set, it must exist
pidfile="${named_pidfile:-/var/run/named/pid}"
named_confdir="${named_chrootdir}${named_conf%/*}"
run_rc_command "$1"