From 113e33794a37efc5f4abda46e9046b5d2af3b5b8 Mon Sep 17 00:00:00 2001
From: Paul Wouters <pwouters@redhat.com>
Date: Fri, 31 May 2013 23:53:15 -0400
Subject: [PATCH] * Sat Jun 01 2013 Paul Wouters <pwouters@redhat.com> -
 1.4.20-13 - Run unbound-anchor as user unbound in unbound.service

---
 unbound.service | 2 +-
 unbound.spec    | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/unbound.service b/unbound.service
index c79b1ac..a4cf3f3 100644
--- a/unbound.service
+++ b/unbound.service
@@ -9,7 +9,7 @@ Wants=nss-lookup.target
 [Service]
 Type=simple
 EnvironmentFile=-/etc/sysconfig/unbound
-ExecStartPre=/usr/sbin/unbound-anchor -a /var/lib/unbound/root.key -c /etc/unbound/icannbundle.pem
+ExecStartPre=/sbin/runuser --shell /bin/sh -c "/usr/sbin/unbound-anchor -a /var/lib/unbound/root.key -c /etc/unbound/icannbundle.pem" unbound
 ExecStartPre=/usr/sbin/unbound-checkconf
 ExecStart=/usr/sbin/unbound -d $UNBOUND_OPTIONS
 
diff --git a/unbound.spec b/unbound.spec
index 4974992..b120c91 100644
--- a/unbound.spec
+++ b/unbound.spec
@@ -11,7 +11,7 @@
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
 Version: 1.4.20
-Release: 12%{?dist}
+Release: 13%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/
 Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
@@ -280,6 +280,9 @@ exit 0
 /bin/systemctl try-restart unbound-keygen.service >/dev/null 2>&1 || :
 
 %changelog
+* Sat Jun 01 2013 Paul Wouters <pwouters@redhat.com> - 1.4.20-13
+- Run unbound-anchor as user unbound in unbound.service
+
 * Tue May 28 2013 Paul Wouters <pwouters@redhat.com> - 1.4.20-12
 - Enable round-robin (with noths() patch)
 - Change cron and systemd service to use root.key, not root.anchor