{"action":"created","issue":{"url":"https://api.github.com/repos/PowerDNS/pdns/issues/6233","repository_url":"https://api.github.com/repos/PowerDNS/pdns","labels_url":"https://api.github.com/repos/PowerDNS/pdns/issues/6233/labels{/name}","comments_url":"https://api.github.com/repos/PowerDNS/pdns/issues/6233/comments","events_url":"https://api.github.com/repos/PowerDNS/pdns/issues/6233/events","html_url":"https://github.com/PowerDNS/pdns/issues/6233","id":291931242,"number":6233,"title":"bind-dnssec-db write access / ownership: document / fix pdnsutil","user":{"login":"stbuehler","id":528446,"avatar_url":"https://avatars1.githubusercontent.com/u/528446?v=4","gravatar_id":"","url":"https://api.github.com/users/stbuehler","html_url":"https://github.com/stbuehler","followers_url":"https://api.github.com/users/stbuehler/followers","following_url":"https://api.github.com/users/stbuehler/following{/other_user}","gists_url":"https://api.github.com/users/stbuehler/gists{/gist_id}","starred_url":"https://api.github.com/users/stbuehler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stbuehler/subscriptions","organizations_url":"https://api.github.com/users/stbuehler/orgs","repos_url":"https://api.github.com/users/stbuehler/repos","events_url":"https://api.github.com/users/stbuehler/events{/privacy}","received_events_url":"https://api.github.com/users/stbuehler/received_events","type":"User","site_admin":false},"labels":[{"id":37445974,"url":"https://api.github.com/repos/PowerDNS/pdns/labels/auth","name":"auth","color":"eb6420","default":false},{"id":37446007,"url":"https://api.github.com/repos/PowerDNS/pdns/labels/defect","name":"defect","color":"cccccc","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-01-26T15:13:28Z","updated_at":"2018-05-01T18:12:46Z","closed_at":null,"author_association":"CONTRIBUTOR","body":" - Program: Authoritative (bind backend)\r\n - Issue type: who knows...\r\n\r\n### Description\r\n\r\nWhile debugging another issue with strace, I saw this in the log:\r\n\r\n```\r\n[pid   791] stat(\"/var/lib/powerdns/bind-dnssec.db\", {st_mode=S_IFREG|0644, st_size=28672, ...}) = 0\r\n[pid   791] open(\"/var/lib/powerdns/bind-dnssec.db\", O_RDWR|O_CREAT|O_CLOEXEC, 0644) = -1 EACCES (Permission denied)\r\n[pid   791] open(\"/var/lib/powerdns/bind-dnssec.db\", O_RDONLY|O_CLOEXEC) = 21\r\n```\r\n\r\nI.e. pdns tried to open `bind-dnssec-db` read-writable first, and then went for readonly instead.\r\n\r\nThe [docs](https://doc.powerdns.com/authoritative/backends/bind.html#bind-dnssec-db) mention the file is needed for \"slave DNSSEC-enabled domains\" and \"metadata is set during the zonetransfer\", so I assume you usually want pdns to have write access.\r\n\r\nAs it looks like pdns is not opening that file before dropping privileges:\r\n- it should be documented that file should be owned by the user set in `setuid` (or that `setuid`+`setgid` needs write access)\r\n- pdnsutil should create the file with user and group according to `setuid` and `setgid`\r\n- maybe emit a warning on startup if the file is not writable\r\n"},"comment":{"url":"https://api.github.com/repos/PowerDNS/pdns/issues/comments/385744844","html_url":"https://github.com/PowerDNS/pdns/issues/6233#issuecomment-385744844","issue_url":"https://api.github.com/repos/PowerDNS/pdns/issues/6233","id":385744844,"user":{"login":"Habbie","id":525838,"avatar_url":"https://avatars1.githubusercontent.com/u/525838?v=4","gravatar_id":"","url":"https://api.github.com/users/Habbie","html_url":"https://github.com/Habbie","followers_url":"https://api.github.com/users/Habbie/followers","following_url":"https://api.github.com/users/Habbie/following{/other_user}","gists_url":"https://api.github.com/users/Habbie/gists{/gist_id}","starred_url":"https://api.github.com/users/Habbie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Habbie/subscriptions","organizations_url":"https://api.github.com/users/Habbie/orgs","repos_url":"https://api.github.com/users/Habbie/repos","events_url":"https://api.github.com/users/Habbie/events{/privacy}","received_events_url":"https://api.github.com/users/Habbie/received_events","type":"User","site_admin":false},"created_at":"2018-05-01T18:12:46Z","updated_at":"2018-05-01T18:12:46Z","author_association":"OWNER","body":"https://sqlite.org/c3ref/db_readonly.html would come in handy here."}}
{"actor":{"display_login":"Habbie"}}