Sam Trenholme’s blog

MaraDNS and POSIX

July 3, 2026

I made a 2026-07-03 tag for MaraDNS today. I will go over the changes since yesterday. MaraDNS can now be compiled on a C99 and POSIX 2008 compatible system.

MaraDNS and POSIX

Since there have been issues where code which compiled without warning when -Wall is set no longer compiling with newer versions of the same compilers, I have finally made MaraDNS have the option to be compiled using fully standards compliant code:

MaraDNS programs now compile with the -std=c99 flag
MaraDNS now uses feature test macros to make sure the standards are used when compiling MaraDNS

To compile MaraDNS in strict conformance with C99 and POSIX 2008:

./configure --strict-posix
CC=cc
export CC
make
cd coLunacyDNS
make clean
make -f Makefile.strict

However, in the interests of security, MaraDNS by default uses two functions which are not part of the POSIX 2008 standard. Most of the time, this is the correct way to compile MaraDNS:

./configure --strict-posix
CC=cc
export CC
make
cd coLunacyDNS
make -f Makefile.default

chroot

MaraDNS uses the chroot system call to, in case of a security issue which allows MaraDNS to give an attacker a remote shell, restrict that shell’s access to the underlying filesystem. While there has, as of 2026, never been a remote shell exploit found in MaraDNS—even though MaraDNS has been around for over 25 years—chroot minimizes the impact should such a bug be found in the future.

MaraDNS will run without chroot, but the security implications would be more significant should someone ever be able to get a remote shell with MaraDNS.

chroot is not defined in POSIX because “it was not useful to portable applications” (page 258) since there isn’t a way to make a usable chroot environment in the POSIX spec.

The POSIX developers failed to consider the case of using chroot as a portable and widely implemented way of putting an application in a sandbox—there is no need to have an “environment in which an application could run” in said sandbox, since MaraDNS is started and loads configuration files before entering the chroot jail.

setgroups

The setgroups call is also used to sandbox MaraDNS. Like chroot, this minimizes the impact should one be able to get a remote root shell via a security hole in MaraDNS (again, as of 2026, no security hole with remote shell access has ever been found in MaraDNS, and it has been over 25 years).

setgroups is not defined in POSIX because it requires elevated privileges to run.

Both of these calls are standard UNIX calls

Both chroot and setgroups, while not formally part of the POSIX standard, have been used by MaraDNS for decades. chroot and setgroups have been used, with their API unchanged, by MaraDNS without issue since 2001—some 25 years ago. Considering these two function calls haven’t changed in 25 years, it is highly doubtful they will change in the future.

The chroot call used to be part of the POSIX standard back when it was called the “single UNIX specification”, and setgroups conforms to SVr4 and 4.3BSD. These calls are included with Linux, BSD, and pretty much any UNIX that exists (with rare exceptions; there was a time when QNX didn’t support chroot, although it does now, and the Win32 API doesn’t have chroot either).

That in mind, MaraDNS will continue to support chroot and setgroups unless one asks MaraDNS to compile in strict conformance with POSIX 2008.

Looking forward

MaraDNS is now using the C99 standard to compile all programs, and POSIX 2008 for all system calls, except for chroot and setgroups (the Win32 port of MaraDNS uses Windows specific calls, but Windows—despite its imperfections—has a rock solid unchanging API).

That in mind, if MaraDNS doesn’t compile in the future, it is most likely a bug with the compiler and/or libc library, and probably not a bug with MaraDNS.

MaraDNS is now more future proof—it is now very unlikely a future compiler change will stop MaraDNS from compiling, especially since MaraDNS sets the flag (-std=c99) to compile the code using the C99 standard.