Jailing Bind Using Chroot

$ TARGETUSER="binder"

$ addgroup "$TARGETUSER"

$ adduser --system \

          --home /home/"$TARGETUSER" \

          --no-create-home \

          --ingroup "$TARGETUSER" \

          --disabled-password \

          --disabled-login "$TARGETUSER"

start-stop-daemon --start --quiet --exec /usr/sbin/binder -- -g binder -u binder

$ mkdir -p /var/run/binder

$ chown binder:binder /etc/bind/rndc.key

$ chown binder:binder /var/run/binder

options {

        ...

        pid-file "/var/run/binder/binder.pid";

};

reload)

        $0 stop

        sleep 1

        $0 start

dev/null

etc/bind/        - should hold named.conf and all the server zones

sbin/binder-xfer - if you do name transfers

var/run/binder/  - should hold the PID and the name server cache (if any) this directory needs to be writable by named user

var/log/binder   - if you set up logging to a file, needs to be writable for the named user

dev/log          - syslogd should be listening here if named is configured to log through it

etc/bind/named.conf 

etc/localtime

etc/group - with only a single line: "named:x:GID:"

etc/ld.so.cache - generated with ldconfig 

lib/ld-2.3.6.so

lib/libc-2.3.6.so

lib/ld-linux.so.2 - symlinked to ld-2.3.6.so

lib/libc.so.6 - symlinked to libc-2.3.6.so

sbin/ldconfig - may be deleted after setting up the chroot

var/run/