Well, I don't know what I have done exactly, but now when I start named as root it seems to be working properly, as far as the pipe goes. I am getting data via the fstrm_capture process written to the "example.dnstap" file. I see a number of startup queries when I decode the file.
I can't get it to do the same when I start it with "systemctl start isc-bind-named.service" though. So it is clearly a problem with the environment named is running in when launched by systemd.
My procedure so far (not production worthy, obviously) looks like this for those who may see this in the future:
1) run '/opt/isc/isc-bind/root/usr/bin/fstrm_capture -t protobuf:dnstap.Dnstap -u /var/opt/isc/scls/isc-bind/log/named/dnstap.sock -w /var/tmp/example.dnstap"
2) "chown named.named
/var/opt/isc/scls/isc-bind/log/named/dnstap.sock"
3) run "/opt/isc/isc-bind/root/usr/sbin/named -u named" from a root shell
4) go look at "example.dnstap" and see queries.
Following that process but replacing step #3 with "systemctl start isc-bind-named.service" results in everything otherwise working properly, but nothing getting added to "example.dnstap".
"ps auwwwwx | grep named" shows the same user owning the "named" process in both cases. here is the output when run in by root:
# ps auwwwxZ | grep named
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 7606 0.0 0.0 11060 1104 pts/0 S+ 10:05 0:00 /opt/isc/isc-bind/root/usr/bin/fstrm_capture -t protobuf:dnstap.Dnstap -u /var/opt/isc/scls/isc-bind/log/named/dnstap.sock -w /var/tmp/example.dnstap
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 named 7745 0.0 1.0 531520 41720 ? Ssl 10:23 0:00 /opt/isc/isc-bind/root/usr/sbin/named -u named
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 7757 0.0 0.0 12116 972 pts/3 S+ 10:24 0:00 grep --color=auto named
And here is the output when run by "systemctl start isc-bind-named.service":
# ps auwwwxZ | grep named
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 7606 0.0 0.0 11060 1104 pts/0 S+ 10:05 0:00 /opt/isc/isc-bind/root/usr/bin/fstrm_capture -t protobuf:dnstap.Dnstap -u /var/opt/isc/scls/isc-bind/log/named/dnstap.sock -w /var/tmp/example.dnstap
system_u:system_r:named_t:s0 named 7781 0.0 1.0 531516 40860 ? Ssl 10:25 0:00 /opt/isc/isc-bind/root/usr/sbin/named -u named
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 7793 0.0 0.0 12116 1084 pts/3 S+ 10:26 0:00 grep --color=auto named
m_capture -t protobuf:dnstap.Dnstap -u /var/opt/isc/scls/isc-bind/log/named/dnstap.sock -w /var/tmp/example.dnstap
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 named 7745 0.0 1.0 531520 41720 ? Ssl 10:23 0:00 /opt/isc/isc-bind/root/usr/sbin/named -u named
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 7757 0.0 0.0 12116 972 pts/3 S+ 10:24 0:00 grep --color=auto named
So clearly it is an SELinux permissions problem. And now I am seeing denies in the /var/log/audit/audit.log.... grrr. I know there was nothing there before, so it must have been hung up on regular unix permissions or something and once I fixed that it was the SELinux permissions issue.
Sorry for wasting everyone's time. I appreciate you being there as a sounding board though. Thanks Mark for looking beyond my initial concern.
I would like to see that sort of permissions error get logged in the dnstap logs at some severity level though. I am still not clear what I am doing wrong on that front.
Thanks again.
ISC funds the development of this software with paid support subscriptions. Contact us at
Locked
