NAME

       resolvconf-admin - a setuid program for setting up DNS resolution

SYNOPSIS

       resolvconf-admin add NETIF [-s SEARCH] [-d DOMAIN] NAMESERVER [...]

       resolvconf-admin del NETIF

DESCRIPTION

       This  setuid  program  allows specific non-privileged users to invoke /sbin/resolvconf (if it is present)
       with a constrained argument to add or remove DNS resolvers; or, if /sbin/resolvconf is not executable, it
       can replace /etc/resolv.conf.

       This is useful, for example, for running a DHCP client as a non-privileged user.

       When the non-privileged user wants to set up the  DNS  resolvers  due  to  information  it  learned  from
       interface NETIF, it should invoke:

              resolvconf-admin add NETIF [-s SEARCH] [-d DOMAIN] NAMESERVER [...]

       Note that DNS search path and domain name are optional.  However, at least one nameserver is required.

       When  the  non-privileged user wants to tear down the DNS resolver information that it had previously set
       for interface NETIF, it should invoke:

              resolvconf-admin del NETIF

WARNING

       A better (non-suid) approach for setting up the DNS in a non-privileged way is to make  an  authenticated
       IPC  call  to  some  running  daemon  that  already manages the local DNS resolution configuration (e.g.,
       systemd-resolved(8)).  However, some systems do not run such a daemon, so we offer this  setuid  approach
       instead, for those limited systems only.

       This  setuid  program  should  not  be installed on systems that already run such a daemon, because every
       setuid program increases the attack surface of the operating system.

       DO NOT INSTALL THIS TOOL IF YOU HAVE BETTER OPTIONS AVAILABLE TO YOU!

INTERLEAVED OPERATION WITHOUT RESOLVCONF(8)

       On a system where resolvconf(8) is not installed, the behavior  is  not  very  sophisticated.   On  these
       systems:

       • The   first   time  resolvconf-admin  add  is  invoked,  the  old  /etc/resolv.conf  is  backed  up  to
         /etc/resolv.conf.bak.resolvconf-admin.

       • The first time resolvconf-admin del is invoked, the backed up file is restored.

       If multiple daemons (or a single daemon monitoring multiple sources of DNS resolver information)  invokes
       resolvconf-admin  in  an interleaved fashion (e.g. two adds before a del), this will almost certainly not
       be the behavior that you want.  If your system is likely to have this kind of interleaved  operation,  it
       should also have resolvconf(8) installed.

SEE ALSO

       resolvconf(8), resolv.conf(5), systemd-resolved(8)

AUTHORS

       Daniel Kahn Gillmor dkg@fifthhorseman.net

                                                 2017 September                              RESOLVCONF-ADMIN(1)