NAME

       resolvconf-admin - a setuid program for setting up DNS resolution

SYNOPSIS

       resolvconf-admin add NETIF [-s SEARCH] [-d DOMAIN] NAMESERVER [...]

       resolvconf-admin del NETIF

DESCRIPTION

       This  setuid  program  allows specific non-privileged users to invoke /sbin/resolvconf (if it is present)
       with a constrained argument to add or remove DNS resolvers; or, if /sbin/resolvconf is not executable, it
       can replace /etc/resolv.conf.

       This is useful, for example, for running a DHCP client as a non-privileged user.

       When  the  non-privileged  user  wants  to  set  up  the DNS resolvers due to information it learned from
       interface NETIF, it should invoke:

              resolvconf-admin add NETIF [-s SEARCH] [-d DOMAIN] NAMESERVER [...]

       Note that DNS search path and domain name are optional.  However, at least one nameserver is required.

       When the non-privileged user wants to tear down the DNS resolver information that it had  previously  set
       for interface NETIF, it should invoke:

              resolvconf-admin del NETIF

WARNING

       A  better  (non-suid) approach for setting up the DNS in a non-privileged way is to make an authenticated
       IPC call to some running daemon that already  manages  the  local  DNS  resolution  configuration  (e.g.,
       systemd-resolved(8)).   However,  some systems do not run such a daemon, so we offer this setuid approach
       instead, for those limited systems only.

       This setuid program should not be installed on systems that already run  such  a  daemon,  because  every
       setuid program increases the attack surface of the operating system.

       DO NOT INSTALL THIS TOOL IF YOU HAVE BETTER OPTIONS AVAILABLE TO YOU!

INTERLEAVED OPERATION WITHOUT RESOLVCONF(8)

       On  a  system  where  resolvconf(8)  is  not installed, the behavior is not very sophisticated.  On these
       systems:

       • The  first  time  resolvconf-admin add  is  invoked,  the  old  /etc/resolv.conf  is   backed   up   to
         /etc/resolv.conf.bak.resolvconf-admin.

       • The first time resolvconf-admin del is invoked, the backed up file is restored.

       If  multiple daemons (or a single daemon monitoring multiple sources of DNS resolver information) invokes
       resolvconf-admin in an interleaved fashion (e.g.  two adds before a del), this will almost certainly  not
       be  the  behavior that you want.  If your system is likely to have this kind of interleaved operation, it
       should also have resolvconf(8) installed.

SEE ALSO

       resolvconf(8), resolv.conf(5), systemd-resolved(8)

AUTHORS

       Daniel Kahn Gillmor <dkg@fifthhorseman.net>.

                                                 2017 September                              RESOLVCONF-ADMIN(1)