Information
The following instructions outline the changes that must be made to run the BIND service as a non-root account, named, within a Solaris 10 zone. REW
Rationale:
The changes discussed below are needed in order to permit the named account to write configuration, log or other related files. Note that when run within a Solaris 10 zone, the BIND service, by default, will not be able to write to any files or directories under /usr, /lib, /sbin, or /platform as their directory trees are mounted read-only from the global zone. Further restrictions are implemented using standard Unix permissions and ACLs. The changes noted below apply specifically to BIND directories and files.
Solution
Adjust the BIND configuration file, /etc/named.conf, to ensure that it does not refer to directories that are not writable by the named account.
It is recommended that directories be created under the /var/named hierarchy (similar to what is accomplished in the chroot case). Therefore, references to /var/log/named.log would become /var/named/log/named.log and references to /var/log/secure.log would become /var/named/log/secure.log.
# mkdir -p /var/named/data.
# mkdir -p /var/named/log.