[RFC] support for trusted validating resolver configuration

[Rich Felker]

On Thu, Jun 11, 2015 at 09:41:19PM -0400, Carlos O'Donell wrote:
> On 06/11/2015 12:38 PM, Pavel Simerda wrote:
> > Rewriting of /etc/resolv-secure.conf by an unauthorized tool would be
> > an attack on the system's security and should be treated as such, from
> > blocking by mandatory access control to reporting as malware or CVE.
> 
> Here is were we differ in opinion.
> 
> I already consider /etc/resolv.conf to be that file, and only by
> administrative authorization should it be written, either by VPN
> or by Network manager.
> 
> It is the distribution policies that allow untrusted DNS servers
> to be added to that list when connecting to untrusted networks.
> Nothing prevents Network Manager from maintaining a list of
> trusted DNS servers the user has entered by hand, and using those
> instead of what is provided via DHCP.
> 
> Your focus appears to be to fix an unfixable situation, you are
> already on an untrusted network. If anything you need an API to
> describe the network trust level e.g. Can I trust the results from
> DNS? This way applications will know if the results they have from
> any interface are safe.
> 
> Until such an API exists I concede that a /etc/resolv.conf option,
> say `insecure-dns` could be created to remove all security information
> from DNS queries. This way if Network Manager knows it is in a "public"
> network it will set `option insecure-dns` in /etc/resolve.conf.

Agree. I'm with Carlos on all of this.

Rich