Page MenuHomeSolus

Update dnsmasq to 2.82
ClosedPublic

Authored by livingsilver94 on Mar 12 2020, 11:05 PM.
Tags
None
Referenced Files
F11071214: D8476.id20308.diff
Sat, Aug 12, 1:17 AM
F11071213: D8476.id22249.diff
Sat, Aug 12, 1:17 AM
F11052954: D8476.diff
Thu, Aug 10, 10:20 PM
F11018047: D8476.id.diff
Sun, Aug 6, 9:03 AM
F11003918: D8476.id22834.diff
Mon, Jul 31, 8:20 PM
F11002664: D8476.diff
Mon, Jul 31, 3:05 AM
F10992125: D8476.diff
Tue, Jul 25, 6:47 AM
F10878854: D8476.id22834.diff
Jun 21 2023, 3:16 PM

Details

Summary

Changelog available here, read versions from to 2.82.

Package changes:

  • Make dnsmasq stateless
  • Enable dbus
  • Add systemd service

Fixes T1720, T7032.

Test Plan
  • Systemd starts, restarts and stops dnsmasq
  • Removing --enable-dbus from .service file makes systemctl wait indefinitely. That means that the dnsmasq actually acquires a name on the dbus bus.
  • dnsmasq reads /etc/resolv.conf when /etc/dnsmasq.conf does not exists, and /tmp/resolv.conf when it does (and resolv-file is set, obviously). You can check that by running sudo dnsmasq -d --enable-dbus.
  • mar 13 19:31:17 phoenix NetworkManager[30496]: <info> [1584124277.5005] dnsmasq: starting /usr/bin/dnsmasq When launching NetworkManager with dnsmasq added

Diff Detail

Repository
R645 dnsmasq
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

Do you want to enable dbus for dnsmasq? Most distros have it enabled, though I'm not sure what's useful for. Configuration maybe?

EDIT ah yes, here it is: https://github.com/imp/dnsmasq/blob/master/dbus/DBus-interface

Make it stateless and enable dbus

livingsilver94 edited the test plan for this revision. (Show Details)EditedMar 13 2020, 6:33 PM

You can review now. There's still a little issue to fix imho: dnsmasq is launched with nobody user, in fact I get mar 13 19:31:17 phoenix dnsmasq[30598]: chown of PID file /var/run/NetworkManager/dnsmasq.pid failed: Operation not permitted when NetworkManager launches dnsmasq. Other distros add a system user dedicated to it, let me say what you want me to do.

Also, I think that putting dnsmasq inside /usr/bin is incorrect. It requires to create sockets in order to work, so I think the default path, /usr/sbin, is better.

I don't really understand why we need it to be dbus enabled. I have this running on my server without dbus enabling and it is integrated into NetworkManager without issue. The dnsmasq binary (/usr/sbin/dnsmasq) is run as dnsmasq user, however our NetworkManager is run as root (it is on my Fedora Server box as well) so I don't really see a need for a dedicated user instead of running it as root.

DataDrake added a subscriber: DataDrake.

Waiting for feedback.

This revision now requires changes to proceed.May 13 2020, 4:29 PM

@JoshStrobl you sure DBUS is not needed? By adding /etc/NetworkManager/conf.d/00-enable-dnsmasq.conf with the following content:

[main]
dns=dnsmasq

I get, with sudo systemctl status NetworkManager.service:

mag 14 22:43:43 phoenix NetworkManager[2937]: dnsmasq: DBus not available: set HAVE_DBUS in src/config.h
mag 14 22:43:43 phoenix dnsmasq[2937]: DBus not available: set HAVE_DBUS in src/config.h
mag 14 22:43:43 phoenix dnsmasq[2937]: FAILED to start up
mag 14 22:43:43 phoenix NetworkManager[2742]: <warn>  [1589489023.3626] dnsmasq: spawn: dnsmasq process 2937 exited with error: Configuration problem (1)
mag 14 22:43:43 phoenix NetworkManager[2742]: <info>  [1589489023.3628] dnsmasq: starting /usr/bin/dnsmasq
mag 14 22:43:43 phoenix NetworkManager[2938]: dnsmasq: DBus not available: set HAVE_DBUS in src/config.h
mag 14 22:43:43 phoenix dnsmasq[2938]: DBus not available: set HAVE_DBUS in src/config.h
mag 14 22:43:43 phoenix dnsmasq[2938]: FAILED to start up
mag 14 22:43:43 phoenix NetworkManager[2742]: <warn>  [1589489023.3646] dnsmasq: spawn: dnsmasq process 2938 exited with error: Configuration problem (1)
mag 14 22:43:43 phoenix NetworkManager[2742]: <warn>  [1589489023.3648] dnsmasq[196fd76a30cab2df]: dnsmasq dies and gets respawned too quickly. Back off.

Which is the exact error reported in T7032.

Yea I looked into it further on the Fedora side of things and I was indeed incorrect. Still not entirely sure if we should opt to have dnsmasq via sysusers, if that's something you want to tinker with so it has access to that PID you're more than welcome to.

livingsilver94 retitled this revision from Update dnsmasq to 2.80 to Update dnsmasq to 2.81.EditedJul 12 2020, 8:42 PM
livingsilver94 edited the summary of this revision. (Show Details)

If that's something you want to tinker with so it has access to that PID you're more than welcome to.

Yeah I figured out how to change the user @JoshStrobl. So you want root, right?

Although I think it's a better practice to create a dedicated user. dnsmasq starts as root and then falls back to nobody for security reasons (?). Giving it a dedicated user would allow it to behave while not being exposed to too many privileges.

I don't have a strong preference on the matter. A sysuser is probably sufficient.

livingsilver94 retitled this revision from Update dnsmasq to 2.81 to Update dnsmasq to 2.82.Aug 11 2020, 1:36 PM
livingsilver94 edited the summary of this revision. (Show Details)

Update to 2.82 and fix TOCTOU bug in stateless patch. Also add sysusers.

Additionally can the test plan be re-validated and updated against these changes? Otherwise LGTM, nice work!

package.yml
30

Does this example file only exist after the build step? If not, it would make more sense for this to be after the other sed calls during setup.

This revision now requires changes to proceed.Aug 11 2020, 4:47 PM

Calm down Phab, I still have to test the patch.

Test plan succeeds as before. Patch ready to be reviewed.

This revision was not accepted when it landed; it landed in state Needs Review.Aug 18 2020, 7:11 PM
Closed by commit R645:40f7905f1179: Update dnsmasq to 2.82 (authored by livingsilver94, committed by JoshStrobl). · Explain Why
This revision was automatically updated to reflect the committed changes.