nsd users - Dec 2019 - Permission error after upgrade to Debian Buster (10.2)

An HTML attachment was scrubbed...
URL:
<http://lists.nlnetlabs.nl/pipermail/nsd-users/attachments/20191213/6b896416/attachment.htm>

Hi Kaulkwappe,

El vie, 13-12-2019 a las 13:18 +0100, Kaulkwappe
escribi?:
> Unfortunately I still get this errors in NSD 4.1.26 on Debian Buster
> 10.2:
> 
> 1) Log file:
> > error: Cannot open /var/log/nsd.log for appending (Permission
> denied), logging to std
> 
> When it se the owner of nsd.log to root:root, I don't get an error
> message on start. However, after this start, NSD will change the
> owner to nsd:nsd and on the next start I will get this error message.
> 
> 2) PID file:
> > warning: failed to unlink pidfile /run/nsd/nsd.pid: Permission
> denied
> It seems that NSD needs a PID file, because if I change pidfile:
> "/run/nsd/nsd.pid" to pidfile: "" I get:
> 
> > error: cannot open pidfile : No such file or directory
> > error: cannot overwrite the pidfile : No such file or directory
---> Debian 10.2
---> NSD 4.1.26

About LOG and PID, I don't know if what I'm doing is correct, but
apparently NSD works correctly.

In the NSD configuration file I considered:

sudo nano /etc/nsd/nsd.conf
...
        logfile: "/var/run/log/nsd.log"
...
        pidfile: "/var/lib/nsd/nsd.pid"
...

With those routes I got the LOG written (I didn't get it written in
other places):

sudo mc
...
/var/run/log
	/journal
	nsd.log		<--- !!

But the LOG reported that the PID could not be written in
/var/lib/nsd due to permission issues ...

Because I think *pid.nsd* must be written by *root*, I modified owner
and permissions like this:

sudo chown root:nsd /var/lib/nsd
sudo chmod 755 /var/lib/nsd

With this, the PID is now written:

sudo mc
...
/var/lib/nsd
	nsd.db
	nsd.pid		<--- !!
	xfrd.state

Regards.
Jos? Luis
> From: Jos?Luis Artuch <zenbakaitz at speedy.com.ar>
> Sent: Tuesday, 26. Nov 2019 ? 01:03 CET +0100
> To: Kaulkwappe <kaulkwappe at prvy.eu>
> nsd-users at NLnetLabs.nl
> 
> Subject: Re: [nsd-users] Permission error after upgrade to Debian
> Buster (10.2)
> 
> Hi Kaulkwappe,
> 
> El lun, 25-11-2019 a las 01:34 +0100, Kaulkwappe escribi?:
> > > [...] I'd double check if it's indeed effective with
"systemctl
> > show nsd | grep ReadWritePaths"
> > 
> > Seems to be effective:
> > > # systemctl show nsd | grep ReadWritePaths
> > > ReadWritePaths=/var/lib/nsd /var/log /etc/nsd /run
> > 
> > The problem with the log file will never stop the NSD service from
> > working (I believe) but the log file is quite important, so, of
> > course, NSD should be able to append to it.
> > 
> > Does anyone already had this problem after an upgrade?
> > 
> > Kind Regards,
> > Kaulkwappe
> > 
> 
> My knowledge on this subject is very limited, but since you ask I
> give
> you my recent experience. I have also upgraded from Debian 9 to
> Debian
> 10, two ways, starting from Debian 9 and also from scratch. In both
> cases I have not got NSD to write the log file. I have tested changes
> of permissions and/or routes.
> However, I have not had problems with the start of NSD, but I clarify
> that I use NSD with a very elementary configuration and without
> /var/lib/nsd/zone.list defined.
> A cordial greeting.
> Jos? Luis
> 
> > From: Simon Deziel <simon at sdeziel.info>
> > Sent: Monday, 25. Nov 2019 ? 01:26 CET +0100
> > To: nsd-users at NLnetLabs.nl
> > 
> > Subject: Re: [nsd-users] Permission error after upgrade to Debian
> > Buster (10.2)
> > 
> > On 2019-11-24 6:10 p.m., Kaulkwappe wrote:
> > > Hi Simon,
> > > 
> > >  > I would have expect a permission error instead of a
"read-
> only"
> > one. It
> > >  > looks as if /var/log was not properly added to be
> ReadWritePaths
> > set.
> > > That is what I have used:
> > >  > ReadWritePaths=/var/lib/nsd /var/log /etc/nsd /run
> > 
> > Not sure what would explain the read-only error then. I'd double
> > check
> > if it's indeed effective with "systemctl show nsd | grep
> > ReadWritePaths"
> > 
> > >  > This unlink failure is expected and AFAICT harmless.
> > > It should be harmless, but it doesn't look nice. I would
consider
> > this as a bug.
> > 
> > Agreed. Interestingly, unbound accepts "-p" to skip managing
its
> own
> > PID. If nsd could get this, it would be handy when managing the
> > daemon
> > with systemd.
> > 
> > >  > I believe that xfrd.state should be owned by nsd:nsd as the
> > daemon needs
> > >  > to write to that file.
> > > After changing the owner to nsd:nsd I believe this problem is
> > fixed. Thanks!
> > 
> > Glad to hear that!
> > 
> > Regards,
> > Simon
> > _______________________________________________
> > nsd-users mailing list
> > nsd-users at NLnetLabs.nl
> > https://open.nlnetlabs.nl/mailman/listinfo/nsd-users
> > _______________________________________________
> > nsd-users mailing list
> > nsd-users at NLnetLabs.nl
> > https://open.nlnetlabs.nl/mailman/listinfo/nsd-users
> 
> _______________________________________________
> nsd-users mailing list
> nsd-users at NLnetLabs.nl
> https://open.nlnetlabs.nl/mailman/listinfo/nsd-users

Hello guys,

I don't run Debian, so I can't offer a solution now, but I am worried
that you're all just stumbling in the dark here, and randomly changing
permissions on directories and files. A well-built package should not
require any of this, and should just work. Has any one of you approached
the maintainer of the Debian package? Perhaps it has been built
incorrectly, and needs to be fixed.

Regards,
Anand

On 13/12/2019 13:18, Kaulkwappe wrote:
> Unfortunately I still get this errors in NSD 4.1.26 on Debian Buster 10.2:
> 
> 1) Log file:
>  > error: Cannot open /var/log/nsd.log for appending (Permission
denied),
> logging to std
> 
> When it se the owner of nsd.log to root:root, I don't get an error
message on
> start. However, after this start, NSD will change the owner to nsd:nsd and
on
> the next start I will get this error message.
> 
> 2) PID file:
>  > warning: failed to unlink pidfile /run/nsd/nsd.pid: Permission denied
> It seems that NSD needs a PID file, because if I change pidfile: 
> "/run/nsd/nsd.pid" to pidfile: "" I get:
> 
>  > error: cannot open pidfile : No such file or directory
>  > error: cannot overwrite the pidfile : No such file or directory
> 
> 
> 
>
--------------------------------------------------------------------------------
> *From:* Jos?Luis Artuch <zenbakaitz at speedy.com.ar 
> </email/new/1/zenbakaitz%40speedy.com.ar>>
> *Sent:* Tuesday, 26. Nov 2019 ? 01:03 CET +0100
> *To:* Kaulkwappe <kaulkwappe at prvy.eu
</email/new/1/kaulkwappe%40prvy.eu>>
> nsd-users at NLnetLabs.nl </email/new/1/nsd-users%40NLnetLabs.nl>
> 
> *Subject:* Re: [nsd-users] Permission error after upgrade to Debian Buster
(10.2)
> 
> Hi Kaulkwappe,
> 
> El lun, 25-11-2019 a las 01:34 +0100, Kaulkwappe escribi?:
>> > [...] I'd double check if it's indeed effective with
"systemctl
>> show nsd | grep ReadWritePaths"
>> 
>> Seems to be effective:
>> > # systemctl show nsd | grep ReadWritePaths
>> > ReadWritePaths=/var/lib/nsd /var/log /etc/nsd /run
>> 
>> The problem with the log file will never stop the NSD service from
>> working (I believe) but the log file is quite important, so, of
>> course, NSD should be able to append to it.
>> 
>> Does anyone already had this problem after an upgrade?
>> 
>> Kind Regards,
>> Kaulkwappe
>> 
> 
> My knowledge on this subject is very limited, but since you ask I give
> you my recent experience. I have also upgraded from Debian 9 to Debian
> 10, two ways, starting from Debian 9 and also from scratch. In both
> cases I have not got NSD to write the log file. I have tested changes
> of permissions and/or routes.
> However, I have not had problems with the start of NSD, but I clarify
> that I use NSD with a very elementary configuration and without
> /var/lib/nsd/zone.list defined.
> A cordial greeting.
> Jos? Luis
> 
>> 
>> From: Simon Deziel <simon at sdeziel.info>
>> Sent: Monday, 25. Nov 2019 ? 01:26 CET +0100
>> To: nsd-users at NLnetLabs.nl
>> 
>> Subject: Re: [nsd-users] Permission error after upgrade to Debian
>> Buster (10.2)
>> 
>> On 2019-11-24 6:10 p.m., Kaulkwappe wrote:
>> > Hi Simon,
>> > 
>> >  > I would have expect a permission error instead of a
"read-only"
>> one. It
>> >  > looks as if /var/log was not properly added to be
ReadWritePaths
>> set.
>> > 
>> > That is what I have used:
>> >  > ReadWritePaths=/var/lib/nsd /var/log /etc/nsd /run
>> 
>> Not sure what would explain the read-only error then. I'd double
>> check
>> if it's indeed effective with "systemctl show nsd | grep
>> ReadWritePaths"
>> 
>> >  > This unlink failure is expected and AFAICT harmless.
>> > It should be harmless, but it doesn't look nice. I would
consider
>> this as a bug.
>> 
>> Agreed. Interestingly, unbound accepts "-p" to skip managing
its own
>> PID. If nsd could get this, it would be handy when managing the
>> daemon
>> with systemd.
>> 
>> >  > I believe that xfrd.state should be owned by nsd:nsd as the
>> daemon needs
>> >  > to write to that file.
>> > After changing the owner to nsd:nsd I believe this problem is
>> fixed. Thanks!
>> 
>> Glad to hear that!
>> 
>> Regards,
>> Simon
>> _______________________________________________
>> nsd-users mailing list
>> nsd-users at NLnetLabs.nl
>> https://open.nlnetlabs.nl/mailman/listinfo/nsd-users
>> _______________________________________________
>> nsd-users mailing list
>> nsd-users at NLnetLabs.nl
>> https://open.nlnetlabs.nl/mailman/listinfo/nsd-users
> 
> 
> _______________________________________________
> nsd-users mailing list
> nsd-users at NLnetLabs.nl
> https://open.nlnetlabs.nl/mailman/listinfo/nsd-users
>