param: Add 'binddns dir' parameter

This allows to us to have restricted access to the directory by the group
'named' which bind is a member of.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12957

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlet <abartlet@samba.org>

diff --git a/buildtools/wafsamba/samba_patterns.py b/buildtools/wafsamba/samba_patterns.py
index e809f26a095f4cd8a7cda21a2725c50e6de458cc..2b939372fa44db7edcb74e1182ddfef6f7bbe0ec 100644 (file)
--- a/buildtools/wafsamba/samba_patterns.py
+++ b/buildtools/wafsamba/samba_patterns.py
@@ -108,6 +108,7 @@ def write_build_options_header(fp):
     fp.write("       output(screen,\"   PIDDIR: %s\\n\", get_dyn_PIDDIR());\n")
     fp.write("       output(screen,\"   SMB_PASSWD_FILE: %s\\n\",get_dyn_SMB_PASSWD_FILE());\n")
     fp.write("       output(screen,\"   PRIVATE_DIR: %s\\n\",get_dyn_PRIVATE_DIR());\n")
+    fp.write("       output(screen,\"   BINDDNS_DIR: %s\\n\",get_dyn_BINDDNS_DIR());\n")
     fp.write("\n")
 
 def write_build_options_footer(fp):

diff --git a/docs-xml/smbdotconf/generate-file-list.sh b/docs-xml/smbdotconf/generate-file-list.sh
index 4a25f1e6d49dd7647a41421665fb5562ff1afc4e..7ab1b7caf764bb545dedecde81da11da3efce1bc 100755 (executable)
--- a/docs-xml/smbdotconf/generate-file-list.sh
+++ b/docs-xml/smbdotconf/generate-file-list.sh
@@ -11,6 +11,7 @@ echo "<!DOCTYPE section [
 <!ENTITY pathconfig.PIDDIR               '\${prefix}/var/run'>
 <!ENTITY pathconfig.STATEDIR             '\${prefix}/var/locks'>
 <!ENTITY pathconfig.PRIVATE_DIR          '\${prefix}/private'>
+<!ENTITY pathconfig.BINDDNS_DIR          '\${prefix}/bind-dns'>
 <!ENTITY pathconfig.SMB_PASSWD_FILE      '\${prefix}/private/smbpasswd'>
 <!ENTITY pathconfig.WINBINDD_SOCKET_DIR  '\${prefix}/var/run/winbindd'>
 <!ENTITY pathconfig.CACHEDIR             '\${prefix}/var/cache'>

diff --git a/docs-xml/smbdotconf/security/binddnsdir.xml b/docs-xml/smbdotconf/security/binddnsdir.xml
new file mode 100644 (file)
index 0000000..c296a0e
--- /dev/null
+++ b/docs-xml/smbdotconf/security/binddnsdir.xml
@@ -0,0 +1,18 @@
+<samba:parameter name="binddns dir"
+                 context="G"
+                 type="string"
+                 constant="1"
+                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
+<synonym>bind dns directory</synonym>
+<description>
+    <para>
+        This parameters defines the directory samba will use to store the configuration
+        files for bind, such as named.conf.
+
+        NOTE: The bind dns directory needs to be on the same mount point as the private
+        directory!
+    </para>
+</description>
+
+<value type="default">&pathconfig.BINDDNS_DIR;</value>
+</samba:parameter>

diff --git a/dynconfig/dynconfig.c b/dynconfig/dynconfig.c
index e75d7db553ae4d4475b5bad59064e71e04548825..e70a10f8cfe53544740ba0785200669226898c5a 100644 (file)
--- a/dynconfig/dynconfig.c
+++ b/dynconfig/dynconfig.c
@@ -95,6 +95,7 @@ DEFINE_DYN_CONFIG_PARAM(PIDDIR)
 DEFINE_DYN_CONFIG_PARAM(NCALRPCDIR)
 DEFINE_DYN_CONFIG_PARAM(SMB_PASSWD_FILE)
 DEFINE_DYN_CONFIG_PARAM(PRIVATE_DIR)
+DEFINE_DYN_CONFIG_PARAM(BINDDNS_DIR)
 DEFINE_DYN_CONFIG_PARAM(LOCALEDIR)
 DEFINE_DYN_CONFIG_PARAM(NMBDSOCKETDIR)
 DEFINE_DYN_CONFIG_PARAM(DATADIR)

diff --git a/dynconfig/dynconfig.h b/dynconfig/dynconfig.h
index 4d07c103d742bcae038f8e607dd8fd2fd1fad911..bdab2e8f2422be5651788b18dde9588246792f35 100644 (file)
--- a/dynconfig/dynconfig.h
+++ b/dynconfig/dynconfig.h
@@ -46,6 +46,7 @@ DEFINE_DYN_CONFIG_PROTO(PIDDIR)
 DEFINE_DYN_CONFIG_PROTO(NCALRPCDIR)
 DEFINE_DYN_CONFIG_PROTO(SMB_PASSWD_FILE)
 DEFINE_DYN_CONFIG_PROTO(PRIVATE_DIR)
+DEFINE_DYN_CONFIG_PROTO(BINDDNS_DIR)
 DEFINE_DYN_CONFIG_PROTO(LOCALEDIR)
 DEFINE_DYN_CONFIG_PROTO(NMBDSOCKETDIR)
 DEFINE_DYN_CONFIG_PROTO(DATADIR)

diff --git a/dynconfig/wscript b/dynconfig/wscript
index ba0c896b90e8eef288bcbe570e3984f84fbba23b..fee37eaaf5f0eb726b138c2b085ea671bfc604fb 100644 (file)
--- a/dynconfig/wscript
+++ b/dynconfig/wscript
@@ -192,6 +192,12 @@ dynconfig = {
          'OPTION':    '--with-statedir',
          'HELPTEXT':  'Where to put persistent state files',
     },
+    'BINDDNS_DIR' : {
+         'STD-PATH':  '${LOCALSTATEDIR}/lib',
+         'FHS-PATH':  '${LOCALSTATEDIR}/lib/samba/bind-dns',
+         'OPTION':    '--with-bind-dns-dir',
+         'HELPTEXT':  'bind-dns config directory',
+    },
     'CACHEDIR' : {
          'STD-PATH':  '${LOCALSTATEDIR}/cache',
          'FHS-PATH':  '${LOCALSTATEDIR}/cache/samba',
@@ -419,6 +425,7 @@ def build(bld):
     bld.INSTALL_DIR("${LOGFILEBASE}")
     bld.INSTALL_DIR("${PRIVILEGED_SOCKET_DIR}")
     bld.INSTALL_DIR("${PRIVATE_DIR}", 0o700)
+    bld.INSTALL_DIR("${BINDDNS_DIR}", 0o770)
     bld.INSTALL_DIR("${STATEDIR}")
     bld.INSTALL_DIR("${CACHEDIR}")
 

diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c
index a221e879d07ad20fd099af32b868d68db7a965af..b91f9657f1c0f4acd340df5c34788b1f196d8aef 100644 (file)
--- a/lib/param/loadparm.c
+++ b/lib/param/loadparm.c
@@ -2655,6 +2655,7 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
        /* the winbind method for domain controllers is for both RODC
           auth forwarding and for trusted domains */
        lpcfg_do_global_parameter(lp_ctx, "private dir", dyn_PRIVATE_DIR);
+       lpcfg_do_global_parameter(lp_ctx, "binddns dir", dyn_BINDDNS_DIR);
        lpcfg_do_global_parameter(lp_ctx, "registry:HKEY_LOCAL_MACHINE", "hklm.ldb");
 
        /* This hive should be dynamically generated by Samba using

diff --git a/lib/param/param.h b/lib/param/param.h
index 589b8906db5e85db134253f231ac5a0d0b44d597..680c053a6ccc08ff904316dd05bd461475eaf442 100644 (file)
--- a/lib/param/param.h
+++ b/lib/param/param.h
@@ -56,6 +56,7 @@ const char **lpcfg_interfaces(struct loadparm_context *);
 const char *lpcfg_realm(struct loadparm_context *);
 const char *lpcfg_netbios_name(struct loadparm_context *);
 const char *lpcfg_private_dir(struct loadparm_context *);
+const char *lpcfg_binddns_dir(struct loadparm_context *);
 int lpcfg_server_role(struct loadparm_context *);
 int lpcfg_allow_dns_updates(struct loadparm_context *);
 

diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index d5b1c56e21e8d96f53d609611734ed9822a28556..42e579efcfd603cddd0483636e9f8ee6e03f84ea 100644 (file)
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -550,6 +550,8 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals)
                         get_dyn_SMB_PASSWD_FILE());
        lpcfg_string_set(Globals.ctx, &Globals.private_dir,
                         get_dyn_PRIVATE_DIR());
+       lpcfg_string_set(Globals.ctx, &Globals.binddns_dir,
+                        get_dyn_BINDDNS_DIR());
 
        /* use the new 'hash2' method by default, with a prefix of 1 */
        lpcfg_string_set(Globals.ctx, &Globals.mangling_method, "hash2");