Re: [libvirt] [RFC PATCH] network: add an option to disable dnsmasq's bind-dynamic

On 05/07/2015 05:58 AM, Michal Privoznik wrote: The problem is that we started using --bind-dynamic in response to CVE-2012-3411: https://bugzilla.redhat.com/show_bug.cgi?id=833033 For more history, look at commit 753ff83a (when --bind-dynamic was originally added, resolving the CVE), d66eb786 (which re-removed listening on localhost, accidentally removed in the previous commit), then finally commit 4b31da34 (which made a similar fix available for older dnsmasq versions that don't have bind-dynamic and don't require it). I think using --bind-dynamic is too big a stick for this problem - instead maybe we should see if there's a reasonable way to update the interface list to add and remove the veth interfaces as the lxc domains are started and stopped (the complication here is that dnsmasq would probably need to be restarted after changing the interface list, since it drops all capabilities and changes to user "nobody" immediately after its initialization. I also remember somebody asking about the behavior that is caused by bind-dynamic, but can't find it right now via google or in my irc logs. So likely it would be good to add such an option anyway, just not named "binddynamic" (the name of that option doesn't make any sense even in the context of dnsmasq! :-P). Instead, it should be called something like "publiclyAccessible" (that's a bit long, but you get the idea), so: <dns publiclyAccessible='yes'/> Again, though, I don't think users of LXC domains should be forced to throw such a big switch just to get DNS working for their guests.