<div style="font-family: Arial; text-align: left; font-size: 14px; color: #000000;">Hi Simon,</div><div style="font-family: Arial; text-align: left; font-size: 14px; color: #000000;"><br></div><div style="font-family: Arial; text-align: left; font-size: 14px; color: #000000;">thanks for your fast answer.</div><div style="font-family: Arial; text-align: left; font-size: 14px; color: #000000;"><br></div><div style="font-family: Arial; text-align: left; font-size: 14px; color: #000000;">It seems that you're right that NSD tries to open the files as root user – which seems is blocked by the restrictive nsd.service configuration. See also:</div><div style="text-align: left;"><span style="font-size: 14px;">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=938987</span></div><div style="text-align: left;"><span style="font-size: 14px;"><br></span></div><div style="text-align: left;"><span style="font-size: 14px;">So, I changed the owner of all the files to 'root:root' and added '/var/log' to '</span><span style="font-size: 14px;">ReadWritePaths'. </span><span style="font-size: 14px;">Then NSD starts without any problems.</span></div><div style="text-align: left;"><span style="font-size: 14px;"><div><br></div><div>However, on the next startup I see that NSD always changes back the ownership of '/var/log/nsd.log' from 'root:root' back to the nsd user. This leads to following error message:</div></span></div><div style="font-family: Arial; text-align: left; font-size: 14px; color: #000000;">> Nov 24 18:48:05 ns2 nsd[1959]: [2019-11-24 18:48:05.896] nsd[1959]: error: Cannot open /var/log/nsd.log for appending (Read-only file system), logging to stderr</div><div style="font-family: Arial; text-align: left; font-size: 14px; color: #000000;"><br></div><div style="font-family: Arial; text-align: left; font-size: 14px; color: #000000;">When I stop NSD, I get following messages:</div><div style="font-family: Arial; text-align: left; font-size: 14px; color: #000000;"><div>> Nov 24 21:01:22 ns2 nsd[2168]: [2019-11-24 21:01:22.109] nsd[2169]: warning: signal received, shutting down...</div><div>> Nov 24 21:01:22 ns2 nsd[2168]: [2019-11-24 21:01:22.112] nsd[2169]: warning: failed to unlink pidfile /run/nsd/nsd.pid: Permission denied</div><div>> Nov 24 21:01:22 ns2 nsd[2168]: [2019-11-24 21:01:22.117] nsd[2168]: error: xfrd: Could not open file /var/lib/nsd/xfrd.state for writing: Permission denied</div></div><div style="font-family: Arial; text-align: left; font-size: 14px; color: #000000;"><br></div><div style="font-family: Arial; text-align: left; font-size: 14px; color: #000000;">This is very confusing since /var/lib/nsd/xfrd.state still has root:root, while NSD created the /run/nsd/nsd.pid using nsd:nsd.</div><div style="font-family: Arial; text-align: left; font-size: 14px; color: #000000;"><br></div><div style="font-family: Arial; text-align: left; font-size: 14px; color: #000000;">Kind Regards,</div><div style="font-family: Arial; text-align: left; font-size: 14px; color: #000000;">Kaulkwappe<br><br><br><hr style="border: 0; border-bottom: 1px solid #DADADA;"><b>From:</b> Simon Deziel <<a href="/email/new/1/simon%40sdeziel.info">simon@sdeziel.info</a>><br><b>Sent:</b> Sunday, 24. Nov 2019 – 17:09 CET +0100<br><b>To:</b> <a href="/email/new/1/nsd-users%40NLnetLabs.nl">nsd-users@NLnetLabs.nl</a><br><br><b>Subject:</b> Re: [nsd-users] Permission error after upgrade to Debian Buster (10.2)<br><br></div><div>
<style>
body {
font-family: "Arial";
font-size: 100% !important;
margin: 0;
line-height: 1.2rem;
}
</style>
<pre style="white-space: pre-wrap; color: #173860;">Hi Kaulkwappe,
On 2019-11-24 10:41 a.m., Kaulkwappe wrote:
> Dear colleagues,
>
> after upgrading from Stretch to Debian Buster (10.2) I get following error
> message which blocks NSD (4.1.26) from starting:
>
> > Nov 24 16:18:40 ns2 nsd[989]: [2019-11-24 16:18:40.030] nsd[989]: error:
> could not open zone list /var/lib/nsd/zone.list: Permission denied
> > Nov 24 16:18:40 ns2 nsd[989]: [2019-11-24 16:18:40.032] nsd[989]: error:
> could not read zonelist file /var/lib/nsd/zone.list
>
> However, the permissions are all fine; they did not change during the update.
>
> ls -l /var/lib/nsd/zone.list
> > -rw-r--r-- 1 nsd nsd 1195 Nov 4 17:33 /var/lib/nsd/zone.list
>
> I had a look into /lib/systemd/system/nsd.service:
>
> > [Unit]
> > Description=Name Server Daemon
> > Documentation=man:nsd(8)
> > After=network.target
>
> > [Service]
> > Type=notify
> > Restart=always
> > ExecStart=/usr/sbin/nsd -d
> > ExecReload=+/bin/kill -HUP $MAINPID
> > CapabilityBoundingSet=CAP_CHOWN CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID
> CAP_SETUID CAP_SYS_CHROOT
> > MemoryDenyWriteExecute=true
> > NoNewPrivileges=true
> > PrivateDevices=true
> > PrivateTmp=true
> > ProtectHome=true
> > ProtectControlGroups=true
> > ProtectKernelModules=true
> > ProtectKernelTunables=true
> > ProtectSystem=strict
> > ReadWritePaths=/var/lib/nsd /etc/nsd /run
> > RuntimeDirectory=nsd
> > RestrictRealtime=true
> > SystemCallArchitectures=native
> > SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module mount
> @obsolete @resources
>
> > [Install]
> > WantedBy=multi-user.target
>
> Once I remove following line,
>
> > CapabilityBoundingSet=CAP_CHOWN CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID
> CAP_SETUID CAP_SYS_CHROOT
>
> while it does not help to only remove params from it (I need to remove the full
> line), the error message changes to:
To override a setting you need to reset it and then set it to what you
want, otherwise similar directives accumulate. Like this:
CapabilityBoundingSet=
CapabilityBoundingSet=MY_NEW_SET_OF_CAPS
> > Nov 24 16:37:57 ns2 systemd[1]: Starting Name Server Daemon...
> > Nov 24 16:37:57 ns2 nsd[1607]: [2019-11-24 16:37:57.144] nsd[1607]: error:
> Cannot open /var/log/nsd.log for appending (Read-only file system), logging to
> stderr
With the IMO good ProtectSystem=strict, nsd can only ever write to
directories listed in ReadWritePaths=.
> > Nov 24 16:37:57 ns2 nsd[1607]: [2019-11-24 16:37:57.145] nsd[1607]: notice:
> nsd starting (NSD 4.1.26)
> > Nov 24 16:37:57 ns2 nsd[1607]: [2019-11-24 16:37:57.252] nsd[1608]: notice:
> nsd started (NSD 4.1.26), pid 1607
> > Nov 24 16:37:57 ns2 systemd[1]: Started Name Server Daemon.
>
> Since nsd-control zonestatus now works, NSD now can read
> the /var/lib/nsd/zone.list.
It's a wild guess but maybe /var/lib/nsd/zone.list is opened by nsd
while still running as root. When you have reduced caps
(CapabilityBoundingSet), you don't have CAP_FOWNER, CAP_DAC_READ_SEARCH
and/or CAP_DAC_OVERRIDE so might get a permission error.
I'm not sure if the right thing to do would be to have nsd open the file
post SETUID/GID or if more caps should be added.
> However, it is still not running fine because now
> NSD says it cannot open the /var/log/nsd.log.
>
> Does anyone know how to fix that?
If you want nsd to do logging to a file directly, you'll need to add it
to the ReadWritePaths. I'd suggest "sudo systemctl edit nsd" then enter
and save the following:
[Service]
ReadWritePaths=/var/log
Then "sudo systemctl restart nsd". You can also throw in the
CapabilityBoundingSet tweaks you want in there.
HTH,
Simon
_______________________________________________
nsd-users mailing list
nsd-users@NLnetLabs.nl
https://open.nlnetlabs.nl/mailman/listinfo/nsd-users
</pre>
</div>