[10.9 Mavericks] richtig Sandboxing - sandboxd tmp Datei von BIND named

[FritzS]

Ich habe BIND named kompiliert und er läuft gut - nun aktivierte ich die openSSL Unterstützung.
Die Datei Sandbox Datei named.sb passte ich dementsprechend (laut den Fehlermeldungen) an.
BIND named läuft unter root

Nur eine Fehlermeldung bringe ich nicht weg:
mbp.local sandboxd[79] ([1231]): named(1231) deny file-write-create /private/var/named/tmp-8AEvZ48D00

Warum will hier sandboxd auf das Verzeichnis /private/var/named/ schreiben - sonst war es nur der User root der Logs, Sessionskeys, etc. schreiben wollte und ich die named.sb Datei entsprechend anpasste.
Die Rechte von /private/var/named/ sind auf root/wheel 755 gesetzt.
Es existiert auch eine _sandbox (60) Gruppe - muss ich diese hier mit Schreibrechten einbeziehen?
Oder kann man den tmp-Pfad des sandboxd irgendwo auf einen anderen Ort umleiten?

Das named default.log meldet:
12-Mar-2014 14:02:02.285 dumping master file: tmp-cAwtA4272g: open: permission denied
12-Mar-2014 14:14:48.664 dumping master file: tmp-Hsbohuzwn6: open: permission denied

COMMAND=/bin/launchctl load -w /System/Library/LaunchDaemons/org.isc.named.plist
Mar 12 13:08:47 mbp.local named[1231]: starting BIND 9.9.5-W1 -f
Mar 12 13:08:47 mbp.local named[1231]: built with defaults
Mar 12 13:08:47 mbp.local named[1231]: ----------------------------------------------------
Mar 12 13:08:47 mbp.local named[1231]: BIND 9 is maintained by Internet Systems Consortium,
Mar 12 13:08:47 mbp.local named[1231]: Inc. (ISC), a non-profit 501(c)(3) public-benefit
Mar 12 13:08:47 mbp.local named[1231]: corporation.  Support and training for BIND 9 are
Mar 12 13:08:47 mbp.local named[1231]: available at https://www.isc.org/support
Mar 12 13:08:47 mbp.local named[1231]: ----------------------------------------------------
Mar 12 13:08:47 mbp.local named[1231]: using built-in root key for view _default
Mar 12 13:08:47 mbp.local named[1231]: command channel listening on 127.0.0.1#953
Mar 12 13:08:51 mbp.local sudo[1232]: mbp-admin : TTY=ttys001 ; PWD=/Users/mbp-admin ; USER=root ; COMMAND=/bin/launchctl start org.isc.named
Mar 12 13:09:14 mbp.local sandboxd[79] ([1231]): named(1231) deny file-write-create /private/var/named/tmp-8AEvZ48D00

In der Datei named.sb befinden sich sicherlich etliche fehlerhafte und redundante Zeilen. Gibt es irgendwo eine gute Beschreibung mit Beispielen für Sandbox Konfigurationsdateien?

;;
;; named - sandbox profile
;; Copyright (c) 2006-2007 Apple Inc.  All Rights reserved.
;;
;; WARNING: The sandbox rules in this file currently constitute
;; Apple System Private Interface and are subject to change at any time and
;; without notice. The contents of this file are also auto-generated and not
;; user editable; it may be overwritten at any time.
;;
(version 1)
(debug deny)

(import "bsd.sb")

(deny default)
(allow process*)
(deny signal)
(allow sysctl-read)
(allow network*)

;; Allow named-specific files
(allow file-write* file-read-data file-read-metadata
   (regex "^(/private)?/var/run/named\\.pid$")
   (regex "^/var/run/named\\.pid$")
   (regex "^/var/run/named/session\\.key$")
   (regex "^/Library/Logs/named\\default.log$")
   (regex "^/Library/Logs/named\\.log$")
   (regex "^/Library/Logs/named\\.log.0$")
   (regex "^/Library/Logs/named\\.log.1$")
   (regex "^/Library/Logs/named\\.log.2$")
   (regex "^/Library/Logs/named\\.log.3$")
   (regex "^/Library/Logs/named/")
   (regex "^/Library/Logs/named/*")
   (regex "^/private/var/named/managed-keys.bind.jnl$")
   (regex "^/private/var/named$")
   (regex "^/private/var/named/*$")
   (regex "^/private/var/named\\tmp*$")
   (regex "^/private/var/named\\tmp\\$")
   (regex "^/private/var/named\\tmp*\\$")
   (regex "^/private/var/named/tmp\\$")
   (regex "^/private/var/named/tmp*$")
;; ------- 
   (regex "^/var/run/named/session.key$")
   (regex "^/var/run/named\\.key$")
   (regex "^/var/run/named/named.pid$")
   (regex "^/var/run/named\\.pid$")
   (regex "^/var/run/named$")
   (regex "^/var/run/named/*$")
;; ------- 
   (regex "^/private/var/run/named/session.key$")
   (regex "^/private/var/run/named\\.key$")
   (regex "^/private/var/run/named/named.pid$")
   (regex "^/private/var/run/named\\.pid$")
   (regex "^/private/var/run/named$")
   (regex "^/private/var/run/named/*$"))

;; /var/run/named/named.pid
;; /var/run/named/session.key
;; /private/var/run/named/named.pid
;; /private/var/run/named/session.key
;; /private/var/named/tmp-p51D91DA3p

(allow file-read-data file-read-metadata
  (regex "^(/private/etc/rndc.key$")
  (regex "^(/private)?/etc/rndc\\.key$")
  (regex "^(/private)?/etc/resolv\\.conf$")
  (regex "^(/private)?/etc/named\\.conf$")
  (regex  "^(/private)?/var/named/"))

 

[FritzS]

Ich vermute, dass sandboxed sich an diesen Pfad hält /var/named/ ist mit /private/var/named/ verlinkt

named.conf

options {
    directory "/var/named";
    /*
     * If there is a firewall between you and nameservers you want
     * to talk to, you might need to uncomment the query-source
     * directive below.  Previous versions of BIND always asked
     * questions using port 53, but BIND 8.1 uses an unprivileged
     * port by default.
     */
    // query-source address * port 53;
    dnssec-enable yes;
    dnssec-validation auto;
};

Laut Einträgen (DNSKEY) in named default.log funktioniert dnssec