Skip to contentSkip to conversation

resolv.conf.5: DESCRIPTION: Mention that the data is trusted.

PATCH In review Carlos O'Donell 2 participants 3 messages Feb 18, 2014 – Feb 26, 2014 2 messages not in the archive Man-pages: manual pages for Linux -- Sections 2, 3, 4, 5, and 7

lore
Share & tools
lore

Carlos O'Donell

author
#0 lore raw

PATCH 1/1 resolv.conf.5: DESCRIPTION: Mention that the data is trusted.

In a recent discussion about DNSSEC it was brought to my attention that not all system administrators may understand that the information in /etc/resolv.conf is fully trusted. The resolver implementation in glibc treats /etc/resolv.conf as a fully trusted source of DNS information and passes on the AD-bit for DNSSEC as trusted.

Would it be possible to add a clarifying setence to the man page for resolv.conf.5 to make it absolutely clear that indeed this source of information is trusted?

Signed-off-by Carlos O'Donell <[email protected]>
man5/resolv.conf.5 +3 -0
index f398724..2dfccdf 100644
@@ -35,6 +35,9 @@ The resolver configuration file contains information that is read
 by the resolver routines the first time they are invoked by a process.
 The file is designed to be human readable and contains a list of
 keywords with values that provide various types of resolver information.
+The configuration file is considered a trusted source of DNS information
+e.g. DNSSEC AD-bit information will be returned unmodified from these
+sources.
 .LP
 If this file does not exist,
 only the name server on the local machine will be queried;

---

Cheers,
Carlos.
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

A message that is not in the archive (sent off-list or not yet received): [email protected]

#2 lore raw
Quoted 18 lines · Carlos O'Donell

In a recent discussion about DNSSEC it was brought to my attention that not all system administrators may understand that the information in /etc/resolv.conf is fully trusted. The resolver implementation in glibc treats /etc/resolv.conf as a fully trusted source of DNS information and passes on the AD-bit for DNSSEC as trusted.

Would it be possible to add a clarifying setence to the man page for resolv.conf.5 to make it absolutely clear that indeed this source of information is trusted?

Signed-off-by Carlos O'Donell <[email protected]>
man5/resolv.conf.5 +0 -0
index f398724..2dfccdf 100644

man5/resolv.conf.5 The resolver configuration file contains information that is read · line 43

Quoted 9 lines
man5/resolv.conf.5 +3 -0
@@ -35,6 +35,9 @@ The resolver configuration file contains information that is read
 by the resolver routines the first time they are invoked by a process.
 The file is designed to be human readable and contains a list of
 keywords with values that provide various types of resolver information.
+The configuration file is considered a trusted source of DNS information
+e.g. DNSSEC AD-bit information will be returned unmodified from these
+sources.
 .LP
 If this file does not exist,
 only the name server on the local machine will be queried;

Carlos,

Thanks. I've applied this, but made one small change. You wrote plural "these sources", but the context seems to indicate a singular is required, so I changed it to "this source". Okay?

Cheers,

Michael

Signature · 7 lines
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

A message that is not in the archive (sent off-list or not yet received): [email protected]

author
#4 lore raw
Quoted 31 lines · Michael Kerrisk (man-pages)
Quoted 18 lines · Carlos O'Donell

In a recent discussion about DNSSEC it was brought to my attention that not all system administrators may understand that the information in /etc/resolv.conf is fully trusted. The resolver implementation in glibc treats /etc/resolv.conf as a fully trusted source of DNS information and passes on the AD-bit for DNSSEC as trusted.

Would it be possible to add a clarifying setence to the man page for resolv.conf.5 to make it absolutely clear that indeed this source of information is trusted?

Signed-off-by Carlos O'Donell <[email protected]>
man5/resolv.conf.5 +0 -0
index f398724..2dfccdf 100644

man5/resolv.conf.5 The resolver configuration file contains information that is read · line 43

Quoted 9 lines
man5/resolv.conf.5 +3 -0
@@ -35,6 +35,9 @@ The resolver configuration file contains information that is read
 by the resolver routines the first time they are invoked by a process.
 The file is designed to be human readable and contains a list of
 keywords with values that provide various types of resolver information.
+The configuration file is considered a trusted source of DNS information
+e.g. DNSSEC AD-bit information will be returned unmodified from these
+sources.
 .LP
 If this file does not exist,
 only the name server on the local machine will be queried;

Carlos,

Quoted 3 lines

Thanks. I've applied this, but made one small change. You wrote plural "these sources", but the context seems to indicate a singular is required, so I changed it to "this source". Okay?

I wrote "sources" because the singular /etc/resolv.conf may have between 1 and 3 DNS servers listed as the source or sources of trusted DNS information. What you wrote is perfectly fine though, the point is to get across that this is at present a trusted source of information that NetworkManager and other tools should treat as trusted. If you don't trust the DNS server or DHCP then you need to take other drastic measures.

Cheers,
Carlos.

--
To unsubscribe from this list: send the line "unsubscribe linux-man" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html