Skip to content

feat: switch DNS resolver to Unbound from systemd-resolved#1335

Merged
RoyalOughtness merged 2 commits intosecureblue:stagingfrom
alexvojproc:unbound-p1
Sep 18, 2025
Merged

feat: switch DNS resolver to Unbound from systemd-resolved#1335
RoyalOughtness merged 2 commits intosecureblue:stagingfrom
alexvojproc:unbound-p1

Conversation

@alexvojproc
Copy link
Copy Markdown
Collaborator

@alexvojproc alexvojproc commented Sep 14, 2025 •
edited
Loading

This PR switches the local DNS stub resolver to Unbound, due to systemd-resolved's unreliable DNSSEC validation and broader concerns. See #1174.

Changelog:

  • Remove systemd-resolved and install dnsconfd-unbound
    • dnsconfd implements a dbus interface for NetworkManager and applies DNS settings dynamically to Unbound
    • Configured NetworkManager to use dnsconfd dbus interface
  • Harden unbound.service and configure Unbound
    • Run unprivileged, no capabilities, no setuid/setgid/chroot
    • Use systemd network and UNIX sockets
    • Lock down other syscalls, namespaces, filesystem
    • Fedora bug opened, hopefully will upstream a subset
    • Add non-default hardening and performance configuration
  • Harden dnsconfd.service
    • Will try to upstream
  • Migrate existing configuration to NetworkManager with secureblue-migrate-dns.service
    • Seamless for all users of the bash ujust dns-selector
  • Refactor ujust dns-selector and rewrite in Python using sandboxing framework
    • Pre-defined servers from bash now stored in JSON at /usr/share/secureblue
  • Rewrite ujust audit-secureblue audit_dns()
    • Checks for global DNS, DNSSEC validation, Trivalent DoT
    • Wrapper around new ujust dns-selector status
  • Update i18n for ujust audit-secureblue
    • Some translatable strings have changed
  • Add workaround for unapplied dnsconfd SELinux type
    • Upstream has a bug in v1.7.2 that causes dnsconfd to run unconfined by SELinux.
    • Fixed in v1.7.3, pinged maintainer so now on Bodhi, autopushes in 1-2 days?

Not included in this PR:

  • Per-connection DNS, to simplify configuration of DNS with VPNs and work/public networks
    • Also VPN-enlightened ujust audit-secureblue
  • Zero-trust DNS even in Anaconda by setting kargs, so no leaks (possible from F43)
  • Investigation needed for GNOME's overly strict GUI DNS validation
  • DNS allowlisting

@alexvojproc alexvojproc force-pushed the unbound-p1 branch 8 times, most recently from bc95a3e to 7b1d93a Compare September 15, 2025 16:08
@alexvojproc alexvojproc marked this pull request as ready for review September 15, 2025 16:37
HastD
HastD requested changes Sep 15, 2025
View reviewed changes
Copy link
Copy Markdown
Collaborator

@HastD HastD left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your work on this. Haven't tested it out on my system, just a few minor comments from reading through the code.

RoyalOughtness
RoyalOughtness reviewed Sep 15, 2025
View reviewed changes
RoyalOughtness
RoyalOughtness reviewed Sep 15, 2025
View reviewed changes
RoyalOughtness
RoyalOughtness reviewed Sep 15, 2025
View reviewed changes
RoyalOughtness
RoyalOughtness reviewed Sep 15, 2025
View reviewed changes
RoyalOughtness
RoyalOughtness reviewed Sep 15, 2025
View reviewed changes
@alexvojproc alexvojproc force-pushed the unbound-p1 branch 2 times, most recently from a4f2016 to 370be4f Compare September 15, 2025 21:45
HastD
HastD reviewed Sep 15, 2025
View reviewed changes
@alexvojproc alexvojproc changed the base branch from live to staging September 16, 2025 19:47
@alexvojproc alexvojproc marked this pull request as draft September 16, 2025 19:56
@alexvojproc alexvojproc marked this pull request as ready for review September 16, 2025 19:57
@alexvojproc alexvojproc marked this pull request as draft September 16, 2025 19:57
@RoyalOughtness RoyalOughtness deleted the branch secureblue:staging September 16, 2025 22:46
@alexvojproc alexvojproc marked this pull request as ready for review September 18, 2025 02:19
@alexvojproc
Copy link
Copy Markdown
Collaborator Author

alexvojproc commented Sep 18, 2025

Changes:

  • Hopefully all review points addressed
  • Added integration test, including for /usr/bin/dnsconfd SELinux type
  • Reverted SELinux stub policy in favour of dnsconfd v1.7.3 which was recently pushed to F42 stable
  • Use files module for resolv.conf installation to overwrite symlink
  • General style, consistency, clarificatory comments

This PR should be ready (pending re-review) but if v1.7.3 hasn't hit mirrors by the time it's merged, then the integration test will fail.

@RoyalOughtness RoyalOughtness merged commit b7cb8cb into secureblue:staging Sep 18, 2025
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@HastD HastD HastD approved these changes

@RoyalOughtness RoyalOughtness RoyalOughtness approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@alexvojproc @HastD @RoyalOughtness