RESOLVCONF-ADMIN(1)

📦
version 0.3 · 3 versions
, in ubuntu jammy, ubuntu noble

✨ RESOLVCONF-ADMIN(1) ✨

okay bestie, so this is the resolvconf-admin manual page and honestly it's a whole mood — it's a little setuid program for setting up DNS resolution 💅

🌸 NAME 🌸

resolvconf-admin — a setuid program for setting up DNS resolution

🎀 SYNOPSIS 🎀

resolvconf-admin add NETIF [-s SEARCH] [-d DOMAIN] NAMESERVER [...]
resolvconf-admin del NETIF

🦋 DESCRIPTION 🦋

So here's the tea: this is a setuid program, and what it does is let specific non-privileged users invoke /sbin/resolvconf (if it's actually present, that is) with a constrained argument so they can add or remove DNS resolvers. And if /sbin/resolvconf is not executable? No worries bestie, it can just replace /etc/resolv.conf instead. iconic behavior honestly.

Where is this useful, you ask? Think running a DHCP client as a non-privileged user. that's the vibe. 💫

When your non-privileged user wants to set up the DNS resolvers based on info it learned from interface NETIF, it should invoke:

resolvconf-admin add NETIF [-s SEARCH] [-d DOMAIN] NAMESERVER [...]

Quick heads up: the DNS search path and the domain name are optional. but at least one nameserver is required, no exceptions. 🌈

And when that same non-privileged user wants to tear down the DNS resolver info it had previously set for interface NETIF, it should invoke:

resolvconf-admin del NETIF

⚠️ WARNING ⚠️

okay listen. a better (non-suid) approach for setting up DNS in a non-privileged way is to make an authenticated IPC call to some running daemon that already manages the local DNS resolution configuration — like, say, systemd-resolved(8), iykyk. But some systems just don't run a daemon like that, so this setuid approach is offered instead, for those limited systems only. that's the whole point. 💀

Do NOT install this setuid program on systems that already run such a daemon, because every single setuid program increases the attack surface of the operating system. it's giving risk. 🙈
DO NOT INSTALL THIS TOOL IF YOU HAVE BETTER OPTIONS AVAILABLE TO YOU! like, genuinely. periodt. 👑

🔥 INTERLEAVED OPERATION WITHOUT RESOLVCONF(8) 🔥

On a system where resolvconf(8) is not installed, the behavior is not very sophisticated, ngl. On these systems:

  • The first time resolvconf-admin add is invoked, the old /etc/resolv.conf is backed up to /etc/resolv.conf.bak.resolvconf-admin.
  • The first time resolvconf-admin del is invoked, the backed up file is restored.

Now, if multiple daemons (or even a single daemon monitoring multiple sources of DNS resolver information) invokes resolvconf-admin in an interleaved fashion (e.g. two adds before a del), this will almost certainly not be the behavior that you want. 😭 If your system is likely to have this kind of interleaved operation, it should also have resolvconf(8) installed. that's the fix, bestie. 🫶

💜 SEE ALSO 💜

👑 AUTHORS 👑

Daniel Kahn Gillmor <dkg@fifthhorseman.net>. a legend, fr fr. 🌟

and that's the whole page, bestie — this one came from the 2017 September era of the resolvconf-admin source, so shoutout to the past for this absolute classic. slay, stay safe, and please don't install setuid stuff you don't need 💖✨🎀

📦 where this page comes from