[Bug 2106729] Re: Restore UseDomains=true in Plucky and later

[Launchpad Bug Tracker]

This bug was fixed in the package livecd-rootfs - 25.04.26

---------------
livecd-rootfs (25.04.26) plucky; urgency=medium

  * cpc: Restore UseDomains=true in cloud images (LP: #2106729)

 -- Tomáš Virtus <tomas.virtus at canonical.com>  Thu, 10 Apr 2025 13:07:25
+0000

** Changed in: livecd-rootfs (Ubuntu)
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to livecd-rootfs in Ubuntu.
https://bugs.launchpad.net/bugs/2106729

Title:
  Restore UseDomains=true in Plucky and later

Status in cloud-images:
  New
Status in cloud-images oracular series:
  New
Status in livecd-rootfs package in Ubuntu:
  Fix Released

Bug description:
  ubuntu-cpc: Restore UseDomains=true

  Also see https://bugs.launchpad.net/cloud-images/+bug/2106729.

  Since Oracular[1]:

      Ubuntu’s systemd-networkd no longer sets UseDomains=true for managed
      network interfaces. In effect, this means that search domains
      configured in DHCP leases will not be reflected in /etc/resolv.conf
      by default. This change aligns Ubuntu’s default behavior with that
      of upstream. System administrators may choose to override this
      default on a global, or per-interface basis. See systemd.network 4
      for details.

  The default in systemd is UseDomains=false. From
  systemd.network(5)[2]:

      DHCP=
      
          Furthermore, note that by default the domain name specified
          through DHCP is not used for name resolution. See option
          UseDomains= below.
      
      UseDomains=
      
          It is recommended to enable this option only on trusted
          networks, as setting this affects resolution of all hostnames,
          in particular of single-label names. It is generally safer to
          use the supplied domain only as routing domain, rather than as
          search domain, in order to not have it affect local resolution
          of single-label names.
      
  It has been reported to us by few clouds that this break local name
  resolution. For instance, in Google Cloud Compute, users can no longer
  reach instances in the same zone[3] nor Google Cloud services[4] by
  their names.

  Arguably, the security concerns for having this option disabled are not
  valid in cloud environments. As one of our partners said:

      IIUC, the motivation to disable UseDomains by default is that a
      laptop might be used on an untrusted network where the domains
      provided by DHCP can be a security issue, directing users to places
      they don't intend.

      But it's not possible for a cloud instance to be connected to an
      untrusted network (barring a breached account).

      The way I'm looking at this is that DHCP option 119 exists for the
      express purpose of allowing a network administrator to configure the
      DNS search path for computers on that network. I understand there's
      a security concern if that network isn't a datacenter. But in the
      cloud there's no concern (in some clouds, it's not even possible for
      DHCP response packets to come from anywhere but the cloud's own
      DHCP).

  We should restore this setting in cloud images.

  [1] https://discourse.ubuntu.com/t/oracular-oriole-release-notes/44878
  [2] https://manpages.ubuntu.com/manpages/plucky/en/man5/systemd.network.5.html
  [3] https://cloud.google.com/compute/docs/internal-dns
  [4] https://cloud.google.com/compute/docs/metadata/overview

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-images/+bug/2106729/+subscriptions