[arch-general] nsd 4.3.5 broken

[Archange]

Le 06/02/2021 à 20:00, Archange via arch-general a écrit :
> Le 06/02/2021 à 18:51, Genes Lists via arch-general a écrit :
>> On 2/6/21 9:34 AM, Genes Lists via arch-general wrote:
>>>
>>
>> I tried couple more things.
>>
>> I changed RunTimeDirecroy=/etc/nad   # it was previosuly set to: =nsd
>>
>> Now I can get nsd to start up, but get this problem:
>>
>>   nsd[10230]: setsockopt(..., IP_TRANSPARENT, ...) failed for tcp: 
>> Operation not permitted

So if you use this option (IP_TRANSPARENT), which is non-default, you 
might want to add a service drop-in extending CapabilityBoundingSet to 
also include CAP_NET_ADMIN. Since I expect this to be a non-standard use 
case, I’d prefer to not add it by default and rather document it on the 
wiki.

>>   nsd[10230]: cannot open pidfile /run/nsd/nsd.pid: No such file or 
>> directory
>>   nsd[10230]: cannot overwrite the pidfile /run/nsd/nsd.pid: No such 
>> file or directory

This is because you changed the RuntimeDirectory, which should not be 
touched.

>>   nsd[10230]: unable to initgroups nsd: Operation not permitted

This is harmless, it happens because nsd thought to be root and tried to 
give up rights, but I’m not starting nsd as root anymore with the new 
service, so actually this is just a warning and expected.

>>
>> So the new permissions seem too strict.
>>
>> I confirmed this as If i put the 4.3.4 nsd.service into
>>   /etc/systemd/system
>> then 4.3.5 starts up and works fine.
>>
>> Bruno can you help get this sorted out please?
>
> Yes of course, it’s not like I sent an email to you personally to tell 
> you about the changes and that breaking was expected, so that tests of 
> the package in [testing] was welcome. ;)
>
> Regarding the first issue, what if you change WorkingDirectory (to 
> WorkingDirectory=/etc/nsd for instance, or maybe /run/nsd/) instead?

Actually removing the line entirely is the better solution, I thought I 
had done it after removing the $home from the nsd user, but apparently 
not. Pushed 4.3.5-2 to [community-testing] with that change, continuing 
on the bug tracker for further debugging. ;)

Regards,
Bruno/Archange