dnscache runs under daemontools, unable to bind (access denied) using runit

dnscache runs under daemontools, unable to bind (access denied) using runit

[Charles M. Gerungan]

This starts up dnscache and it responds to queries:

# cat run.daemontools
#!/bin/sh
exec 2>&1
exec <seed
exec envdir ./env sh -c '
   exec envuidgid Gdnscache softlimit -o250 -d "$DATALIMIT" /usr/ 
local/bin/dnscache
'

This does not start up (an adapted version of http://www.skarnet.org: 
80/lists/archive.cgi?2:msp:1046:midfmaimamejgmijfagg -- the content  
of the env dir wasn't given so I hope I interpreted the manual  
correctly):

# cat run
#!/bin/sh
exec 2>&1
exec <seed
exec chpst -v -u Gdnscache:Gnofiles -e ./env -o 250 /usr/local/bin/ 
dnscache

The error I'm getting when invoking:

# ./run
dnscache: fatal: unable to bind UDP socket: access denied

Here's the content of the env dir:

# ll env
total 14
drwxr-sr-x    2 root     wheel         512 May 20 00:31 ./
drwxr-sr-t    5 root     wheel         512 May 20 08:57 ../
-rw-r--r--    1 root     wheel           8 May 20 00:31 CACHESIZE
-rw-r--r--    1 root     wheel           8 May 20 00:31 DATALIMIT
-rw-r--r--    1 root     wheel          13 May 20 02:59 IP
-rw-r--r--    1 root     wheel           8 May 20 00:31 IPSEND
-rw-r--r--    1 root     wheel          25 May 20 00:31 ROOT

# cat env/*
1000000
3000000
83.98.165.81
0.0.0.0
/var/svc.d/dnscache/root

Why am I getting the error and how do I solve it?

-- 
Regards, Charles.

Re: dnscache runs under daemontools, unable to bind (access denied) using runit

[Charles M. Gerungan]

I neglected to post versions:

$ uname -a
FreeBSD redbus.lahaya.com 5.4-RELEASE FreeBSD 5.4-RELEASE #0: Sun  
May  8 10:21:06 UTC 2005     root@harlow.cse.buffalo.edu:/usr/obj/usr/ 
src/sys/GENERIC  i386

Installed: http://smarden.org/runit/runit-1.2.3.tar.gz

-- 
Regards, Charles.

Re: dnscache runs under daemontools, unable to bind (access denied) using runit

[Gregg Howe]

----- Original Message ----- 
From: "Charles M. Gerungan" <charles@nednieuws.com>
To: <supervision@list.skarnet.org>
Sent: Friday, May 20, 2005 5:04 AM
Subject: dnscache runs under daemontools, unable to bind
(access denied) using runit


> This starts up dnscache and it responds to queries:
>
> # cat run.daemontools
> #!/bin/sh
> exec 2>&1
> exec <seed
> exec envdir ./env sh -c '
>    exec envuidgid Gdnscache softlimit -o250 -d
"$DATALIMIT" /usr/
> local/bin/dnscache
> '
>
> This does not start up (an adapted version of
http://www.skarnet.org:
> 80/lists/archive.cgi?2:msp:1046:midfmaimamejgmijfagg -- 
the content
> of the env dir wasn't given so I hope I interpreted the
manual
> correctly):
>
> # cat run
> #!/bin/sh
> exec 2>&1
> exec <seed
> exec chpst -v -u Gdnscache:Gnofiles -e ./env -o 250
/usr/local/bin/
> dnscache
>
> The error I'm getting when invoking:
>
> # ./run
> dnscache: fatal: unable to bind UDP socket: access denied
>
>
> Why am I getting the error and how do I solve it?
>
> -- 
> Regards, Charles.


Charles--

The "-u" option in chpst changes dnscache to an unprivileged
user before it executes, so it isn't able to bind the UPD
socket.  If you use "-U" instead, dnscache will be able to
complete this before it changes to Gdnscache.

Gregg

Re: dnscache runs under daemontools, unable to bind (access denied) using runit

[Charles M. Gerungan]

Op 20-mei-2005, om 18:03 heeft Gregg Howe het volgende geschreven:

> The "-u" option in chpst changes dnscache to an unprivileged
> user before it executes, so it isn't able to bind the UPD
> socket.  If you use "-U" instead, dnscache will be able to
> complete this before it changes to Gdnscache.

Oh, man, I think it's time to modify the manpage as -- at least to me  
-- what you said wasn't obvious:

OPTIONS
        -u user[:group]
               setuidgid.   Set uid and gid to the user's uid and  
gid.  If user
               is followed by a colon and a group, set the gid to   
group's  gid
               instead of user's gid.  All supplementary groups are  
removed.

        -U user[:group]
               envuidgid.   Set  the environment variables $UID and  
$GID to the
               user's uid and gid.  If user is followed by a colon  
and a group,
               set $GID to the group's gid instead of user's gid.

So the difference is that -u drops privileges before the program is  
invoked and -U after?

Thanks for your help. Next step: tinydns.

-- 
Regards, Charles.

Re: dnscache runs under daemontools, unable to bind (access denied) using runit

[Charlie Brady]

On Fri, 20 May 2005, Charles M. Gerungan wrote:

> -U user[:group]
>              envuidgid.   Set  the environment variables $UID and $GID to the
>              user's uid and gid.  If user is followed by a colon and a  group,
>              set $GID to the group's gid instead of user's gid.
>
> So the difference is that -u drops privileges before the program is invoked 
> and -U after?

-U doesn't do anything with privileges. It does exactly what the 
documentation says it does - it sets environment variables.

Read dnscache documentation for effect of any environment variable 
settings.

---
Charlie

Re: dnscache runs under daemontools, unable to bind (access denied) using runit

[Charles M. Gerungan]

Op 20-mei-2005, om 19:22 heeft Charlie Brady het volgende geschreven:

> -U doesn't do anything with privileges. It does exactly what the  
> documentation says it does - it sets environment variables.

Found it. Thanks for pointing that out.

-- 
Regards, Charles.