working directory not writable

[Steven P Vallière]

>> > (a) If the effective uid/gid is 0 (root), how can the access()
>> >     call be resulting in "access denied"?

MA>                 access() != eaccess()

I think your earlier answer was clearer (at least to me),
when you said the named initially drops most (if not all)
of root's special privileges.  That explains everything I
saw, but doesn't change the fact that the access() test in
named/server.c is being done at the wrong time.  Here's
the sequence that I see (plus the adjustment I think is
needed):

  named starts, running as root w/all privileges
  root privileges dropped
  config file loaded
  cwd to working directory
  access(".", W_OK)?           <== wrong time for this
                                   still limited root
  setgid named/setuid named
  access(".", W_OK)?           <== correct time for this

Obviously I left out many things, but the first access()
call exists in named/server.c and fails when the working
directory is

  drwxr-x--- named named   ...etc...

It works when group write is enabled, because you cannot
(or do not?) drop the root privilege that makes root behave
as if it belongs to all groups, as it were.

This also explains why, later, named has no problem writing
to the working directory.

FWIW, it would also be nice if the message at least indicated
that it was a warning rather than an error in the log, and
if possible, the other relevant info like, what directory,
uid/gid that cannot access it, reason access is not allowed.
Not all sysops like needing to search the sources and then
*MODIFY* them to determine these things, after all.

-- 
Steve Vallière | mailto:bind9 at e-visions.com