chroot - help

[Bill Larson]

On Jan 5, 2005, at 11:21 PM, saravanan ganapathy wrote:

>   If I want to write querylog in /var/log/querylog, I
> have to give this in named.conf.Assume my chroot path
> is /opt/named.So that it writes on
> /opt/named/var/log/querylog.
>
> But I want to have log files on /var/named (not
> /opt/dns/var/named). How to do it?

You are missing the point of a "chroot" environment.  Once you start 
"named" in a chroot environment then it no longer has access to any of 
the file system outside of the chroot environment.

My suggestion would be to create a symbolic link from 
"/opt/dns/var/named", the location where you will be performing your 
logging while in the chroot environment, to "/var/named" where you want 
to see these log files while in the normal environment.  This can be 
done with:

	ln -s /opt/dns/var /var/named

Be aware that you can't have a "/var/named" directory or file already 
existing when you create this link.

Now, to forestall future problems and questions, you need to insure 
that your "named.conf" file resides inside the chroot environment.  
This is necessary to allow "named" to re-read the configuration file 
when you do an "rndc reload".  Assuming that your version of "named" 
uses the standard "/etc/named.conf" for the configuration file, you 
need to copy this to "/opt/named/etc/named.conf".  To make this simple 
to manage from outside the chroot environment environment, create a 
symbolic link from /opt/named/etc/named.conf to /etc/named.conf.  With 
this link you can still manipulate the configuration by editing 
/etc/named.conf as you would normally.

Notice that this link can't function in reverse.  I.e., you can't have 
the actual "named.conf" file in /etc and have a symbolic link from the 
chroot environment pointing to it.  If you were to try and do this, 
named would not be able to access the file because it resides outside 
of the chroot environment.  Remember that the chroot environment 
prevents any access to outside the environment from functioning, 
including symbolic links.

As a suggestion, I would create your chroot directory structure to 
mimic the real directory structure as much as possible.  For example, 
rather than using "/var" as the directory to save your named data 
files, I would suggest using "/var/named" instead.  Then, with a 
symbolic link between "/opt/named/var/named" and "/var/named", you 
would have complete transparency to manipulate your named data files 
from inside and outside the chroot environment.  I.e., the 'directory 
"/var/named";' specification in named.conf would identify what would 
appear to be the same "/var/named" directory in both the chroot and 
real environment.

Bill Larson

P.S.

Personally, I would never suggest using syslog for query logging.  This 
type of logging is bad enough on the system that you shouldn't want to 
add the additional overhead of using syslog too.  Do query logging to a 
file and only running query logging when necessary to troubleshoot a 
specific problem.  Don't run query logging with "named" by default.