From: Arturo Borrero Gonzalez <arturo@debian.org>
bind9: move tools to /usr/bin instead of /usr/sbin

No need to have them in /usr/sbin. They are mostly usable by non-root users.
If they have a particular option which requires root powers, the tool may
inform the user.

This somehow adheres to the principle of least privilege.

Closes: #593940
Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org>
---
 debian/bind9.install                        |   18 +--
 debian/bind9utils.install                   |   52 ++++----
 debian/patches/80_tools_in_usrbin.patch     |  183 +++++++++++++++++++++++++++
 debian/patches/extra-add_native_pkcs11.diff |    4 -
 debian/patches/series                       |    1 
 5 files changed, 221 insertions(+), 37 deletions(-)
 create mode 100644 debian/patches/80_tools_in_usrbin.patch

diff --git a/debian/bind9.install b/debian/bind9.install
index c4305cf7d..d1ce68369 100644
--- a/debian/bind9.install
+++ b/debian/bind9.install
@@ -1,17 +1,17 @@
 etc/bind/bind.keys
 usr/bin/bind9-config
 usr/bin/delv
-usr/sbin/arpaname
-usr/sbin/ddns-confgen
-usr/sbin/dnssec-importkey
-usr/sbin/genrandom
-usr/sbin/isc-hmac-fixup
+usr/bin/arpaname
+usr/bin/ddns-confgen
+usr/bin/dnssec-importkey
+usr/bin/genrandom
+usr/bin/isc-hmac-fixup
 usr/sbin/named
-usr/sbin/named-journalprint
+usr/bin/named-journalprint
 usr/sbin/named-pkcs11
-usr/sbin/named-rrchecker
-usr/sbin/nsec3hash
-usr/sbin/tsig-keygen
+usr/bin/named-rrchecker
+usr/bin/nsec3hash
+usr/bin/tsig-keygen
 usr/share/man/man1/arpaname.1
 usr/share/man/man1/bind9-config.1
 usr/share/man/man1/delv.1
diff --git a/debian/bind9utils.install b/debian/bind9utils.install
index 088b80725..ea2fc2d44 100644
--- a/debian/bind9utils.install
+++ b/debian/bind9utils.install
@@ -1,29 +1,29 @@
-usr/sbin/dnssec-checkds
-usr/sbin/dnssec-coverage
-usr/sbin/dnssec-dsfromkey
-usr/sbin/dnssec-dsfromkey-pkcs11
-usr/sbin/dnssec-importkey-pkcs11
-usr/sbin/dnssec-keyfromlabel
-usr/sbin/dnssec-keyfromlabel-pkcs11
-usr/sbin/dnssec-keygen
-usr/sbin/dnssec-keygen-pkcs11
-usr/sbin/dnssec-revoke
-usr/sbin/dnssec-revoke-pkcs11
-usr/sbin/dnssec-settime
-usr/sbin/dnssec-settime-pkcs11
-usr/sbin/dnssec-signzone
-usr/sbin/dnssec-signzone-pkcs11
-usr/sbin/dnssec-verify
-usr/sbin/dnssec-verify-pkcs11
-usr/sbin/named-checkconf
-usr/sbin/named-checkzone
-usr/sbin/named-compilezone
-usr/sbin/pkcs11-destroy
-usr/sbin/pkcs11-keygen
-usr/sbin/pkcs11-list
-usr/sbin/pkcs11-tokens
-usr/sbin/rndc
-usr/sbin/rndc-confgen
+usr/bin/dnssec-checkds
+usr/bin/dnssec-coverage
+usr/bin/dnssec-dsfromkey
+usr/bin/dnssec-dsfromkey-pkcs11
+usr/bin/dnssec-importkey-pkcs11
+usr/bin/dnssec-keyfromlabel
+usr/bin/dnssec-keyfromlabel-pkcs11
+usr/bin/dnssec-keygen
+usr/bin/dnssec-keygen-pkcs11
+usr/bin/dnssec-revoke
+usr/bin/dnssec-revoke-pkcs11
+usr/bin/dnssec-settime
+usr/bin/dnssec-settime-pkcs11
+usr/bin/dnssec-signzone
+usr/bin/dnssec-signzone-pkcs11
+usr/bin/dnssec-verify
+usr/bin/dnssec-verify-pkcs11
+usr/bin/named-checkconf
+usr/bin/named-checkzone
+usr/bin/named-compilezone
+usr/bin/pkcs11-destroy
+usr/bin/pkcs11-keygen
+usr/bin/pkcs11-list
+usr/bin/pkcs11-tokens
+usr/bin/rndc
+usr/bin/rndc-confgen
 usr/share/man/man8/dnssec-checkds.8
 usr/share/man/man8/dnssec-dsfromkey.8
 usr/share/man/man8/dnssec-keyfromlabel.8
diff --git a/debian/patches/80_tools_in_usrbin.patch b/debian/patches/80_tools_in_usrbin.patch
new file mode 100644
index 000000000..20c67026a
--- /dev/null
+++ b/debian/patches/80_tools_in_usrbin.patch
@@ -0,0 +1,183 @@
+From: Arturo Borrero Gonzalez <arturo@debian.org>
+Subject: bind9: move tools to /usr/bin instead of /usr/sbin
+ No need to have them in /usr/sbin. They are mostly usable by non-root users.
+ If they have a particular option which requires root powers, the tool may
+ inform the user.
+ .
+ This somehow adheres to the principle of least privilege.
+Forwarded: desired
+Last-Update: 2017-09-29
+--- a/bin/rndc/Makefile.in
++++ b/bin/rndc/Makefile.in
+@@ -79,12 +79,12 @@
+ 	rm -f ${MANOBJS}
+ 
+ installdirs:
+-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
++	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man5
+ 
+ install:: rndc@EXEEXT@ installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} rndc@EXEEXT@ ${DESTDIR}${sbindir}
++	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} rndc@EXEEXT@ ${DESTDIR}${bindir}
+ 	${INSTALL_DATA} ${srcdir}/rndc.8 ${DESTDIR}${mandir}/man8
+ 	${INSTALL_DATA} ${srcdir}/rndc.conf.5 ${DESTDIR}${mandir}/man5
+ 
+--- a/bin/check/Makefile.in
++++ b/bin/check/Makefile.in
+@@ -86,13 +86,13 @@
+ 	rm -f ${MANOBJS}
+ 
+ installdirs:
+-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
++	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
+ 
+ install:: named-checkconf@EXEEXT@ named-checkzone@EXEEXT@ installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkconf@EXEEXT@ ${DESTDIR}${sbindir}
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkzone@EXEEXT@ ${DESTDIR}${sbindir}
+-	(cd ${DESTDIR}${sbindir}; rm -f named-compilezone@EXEEXT@; ${LINK_PROGRAM} named-checkzone@EXEEXT@ named-compilezone@EXEEXT@)
++	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkconf@EXEEXT@ ${DESTDIR}${bindir}
++	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkzone@EXEEXT@ ${DESTDIR}${bindir}
++	(cd ${DESTDIR}${bindir}; rm -f named-compilezone@EXEEXT@; ${LINK_PROGRAM} named-checkzone@EXEEXT@ named-compilezone@EXEEXT@)
+ 	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8; done
+ 	(cd ${DESTDIR}${mandir}/man8; rm -f named-compilezone.8; ${LINK_PROGRAM} named-checkzone.8 named-compilezone.8)
+ 
+--- a/bin/confgen/Makefile.in
++++ b/bin/confgen/Makefile.in
+@@ -93,15 +93,15 @@
+ 	rm -f ${MANOBJS}
+ 
+ installdirs:
+-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
++	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
+ 
+ install:: rndc-confgen@EXEEXT@ ddns-confgen@EXEEXT@ installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} rndc-confgen@EXEEXT@ ${DESTDIR}${sbindir}
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} ddns-confgen@EXEEXT@ ${DESTDIR}${sbindir}
++	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} rndc-confgen@EXEEXT@ ${DESTDIR}${bindir}
++	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} ddns-confgen@EXEEXT@ ${DESTDIR}${bindir}
+ 	${INSTALL_DATA} ${srcdir}/rndc-confgen.8 ${DESTDIR}${mandir}/man8
+ 	${INSTALL_DATA} ${srcdir}/ddns-confgen.8 ${DESTDIR}${mandir}/man8
+-	(cd ${DESTDIR}${sbindir}; rm -f tsig-keygen@EXEEXT@; ${LINK_PROGRAM} ddns-confgen@EXEEXT@ tsig-keygen@EXEEXT@)
++	(cd ${DESTDIR}${bindir}; rm -f tsig-keygen@EXEEXT@; ${LINK_PROGRAM} ddns-confgen@EXEEXT@ tsig-keygen@EXEEXT@)
+ 	(cd ${DESTDIR}${mandir}/man8; rm -f tsig-keygen.8; ${LINK_PROGRAM} ddns-confgen.8 tsig-keygen.8)
+ 
+ clean distclean maintainer-clean::
+--- a/bin/dnssec/Makefile.in
++++ b/bin/dnssec/Makefile.in
+@@ -113,11 +113,11 @@
+ 	rm -f ${MANOBJS}
+ 
+ installdirs:
+-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
++	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
+ 
+ install:: ${TARGETS} installdirs
+-	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir}; done
++	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${bindir}; done
+ 	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8; done
+ 
+ clean distclean::
+--- a/bin/pkcs11/Makefile.in
++++ b/bin/pkcs11/Makefile.in
+@@ -73,18 +73,18 @@
+ 	rm -f ${MANOBJS}
+ 
+ installdirs:
+-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
++	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
+ 
+ install:: ${TARGETS} installdirs
+ 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-list@EXEEXT@ \
+-		${DESTDIR}${sbindir}
++		${DESTDIR}${bindir}
+ 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-destroy@EXEEXT@ \
+-		${DESTDIR}${sbindir}
++		${DESTDIR}${bindir}
+ 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-keygen@EXEEXT@ \
+-		${DESTDIR}${sbindir}
++		${DESTDIR}${bindir}
+ 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} pkcs11-tokens@EXEEXT@ \
+-		${DESTDIR}${sbindir}
++		${DESTDIR}${bindir}
+ 	${INSTALL_DATA} ${srcdir}/pkcs11-list.8 ${DESTDIR}${mandir}/man8
+ 	${INSTALL_DATA} ${srcdir}/pkcs11-destroy.8 ${DESTDIR}${mandir}/man8
+ 	${INSTALL_DATA} ${srcdir}/pkcs11-keygen.8 ${DESTDIR}${mandir}/man8
+--- a/bin/tools/Makefile.in
++++ b/bin/tools/Makefile.in
+@@ -90,23 +90,23 @@
+ 	rm -f ${MANOBJS}
+ 
+ installdirs:
+-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
++	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
+ 
+ install:: ${TARGETS} installdirs
+ 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} arpaname@EXEEXT@ \
+-		${DESTDIR}${sbindir}
++		${DESTDIR}${bindir}
+ 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-journalprint@EXEEXT@ \
+-		${DESTDIR}${sbindir}
++		${DESTDIR}${bindir}
+ 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-rrchecker@EXEEXT@ \
+-		${DESTDIR}${sbindir}
++		${DESTDIR}${bindir}
+ 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} nsec3hash@EXEEXT@ \
+-		${DESTDIR}${sbindir}
++		${DESTDIR}${bindir}
+ 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} genrandom@EXEEXT@ \
+-		${DESTDIR}${sbindir}
++		${DESTDIR}${bindir}
+ 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} isc-hmac-fixup@EXEEXT@ \
+-		${DESTDIR}${sbindir}
++		${DESTDIR}${bindir}
+ 	${INSTALL_DATA} ${srcdir}/arpaname.1 ${DESTDIR}${mandir}/man1
+ 	${INSTALL_DATA} ${srcdir}/isc-hmac-fixup.8 ${DESTDIR}${mandir}/man8
+ 	${INSTALL_DATA} ${srcdir}/named-journalprint.8 ${DESTDIR}${mandir}/man8
+--- a/bin/python/dnssec-checkds.py.in
++++ b/bin/python/dnssec-checkds.py.in
+@@ -286,10 +286,6 @@
+     parser = argparse.ArgumentParser(description=prog + ': checks DS coverage')
+ 
+     bindir = 'bin'
+-    if os.name == 'nt':
+-        sbindir = 'bin'
+-    else:
+-        sbindir = 'sbin'
+ 
+     parser.add_argument('zone', type=str, help='zone to check')
+     parser.add_argument('-f', '--file', dest='masterfile', type=str,
+@@ -300,7 +296,7 @@
+                         default=os.path.join(prefix(bindir), 'dig'),
+                         type=str, help='path to \'dig\'')
+     parser.add_argument('-D', '--dsfromkey', dest='dsfromkey',
+-                        default=os.path.join(prefix(sbindir),
++                        default=os.path.join(prefix(bindir),
+                                              'dnssec-dsfromkey'),
+                         type=str, help='path to \'dig\'')
+     parser.add_argument('-v', '--version', action='version', version='9.9.1')
+--- a/bin/python/Makefile.in
++++ b/bin/python/Makefile.in
+@@ -45,12 +45,12 @@
+ 	rm -f ${MANOBJS}
+ 
+ installdirs:
+-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
++	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
+ 
+ install:: ${TARGETS} installdirs
+-	${INSTALL_SCRIPT} dnssec-checkds@EXEEXT@ ${DESTDIR}${sbindir}
+-	${INSTALL_SCRIPT} dnssec-coverage@EXEEXT@ ${DESTDIR}${sbindir}
++	${INSTALL_SCRIPT} dnssec-checkds@EXEEXT@ ${DESTDIR}${bindir}
++	${INSTALL_SCRIPT} dnssec-coverage@EXEEXT@ ${DESTDIR}${bindir}
+ 	${INSTALL_DATA} ${srcdir}/dnssec-checkds.8 ${DESTDIR}${mandir}/man8
+ 	${INSTALL_DATA} ${srcdir}/dnssec-coverage.8 ${DESTDIR}${mandir}/man8
+ 
diff --git a/debian/patches/extra-add_native_pkcs11.diff b/debian/patches/extra-add_native_pkcs11.diff
index 07b481c5b..b6fdacad6 100644
--- a/debian/patches/extra-add_native_pkcs11.diff
+++ b/debian/patches/extra-add_native_pkcs11.diff
@@ -104,11 +104,11 @@ Date:   Wed Jan 14 11:47:51 2015 UTC
 @@ -114,11 +114,9 @@ docclean manclean maintainer-clean::
  
  installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
 -	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
  
  install:: ${TARGETS} installdirs
- 	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir}; done
+ 	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${bindir}; done
 -	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8; done
  
  clean distclean::
diff --git a/debian/patches/series b/debian/patches/series
index 00a5c503b..affc5cfc5 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -10,6 +10,7 @@
 34_prepare_native_pkcs11.diff
 70_precise_time.diff
 75_ctxstart_no_sighandling.diff
+80_tools_in_usrbin.patch
 
 CVE-2016-2775.patch
 CVE-2016-2776.patch
