From d7247512a904f1dd74125859d8da66166c2a6933 Mon Sep 17 00:00:00 2001 From: Martin Pitt Date: Fri, 16 Sep 2016 08:27:39 +0200 Subject: nss-resolve: return NOTFOUND instead of UNAVAIL on resolution errors It needs to be possible to tell apart "the nss-resolve module does not exist" (which can happen when running foreign-architecture programs) from "the queried DNS name failed DNSSEC validation" or other errors. So return NOTFOUND for these cases too, and only keep UNAVAIL for the cases where we cannot handle the given address family. This makes it possible to configure a fallback to "dns" without breaking DNSSEC, with "resolve [!UNAVAIL=return] dns". Add this to the manpage. This does not change behaviour if resolved is not running, as that already falls back to the "dns" glibc module. Fixes #4157 --- man/nss-resolve.xml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'man') diff --git a/man/nss-resolve.xml b/man/nss-resolve.xml index 33f1f28a8c..d66e8ba521 100644 --- a/man/nss-resolve.xml +++ b/man/nss-resolve.xml @@ -85,7 +85,7 @@ group: compat mymachines systemd shadow: compat -hosts: files mymachines resolve +hosts: files mymachines resolve [!UNAVAIL=return] dns networks: files protocols: db files @@ -95,6 +95,8 @@ rpc: db files netgroup: nis + This keeps the dns module as a fallback for cases where the nss-resolve + module is not installed. -- cgit v1.2.3-54-g00ecf