/etc/resolv.conf overwritten by what?

[starikarp at yandex.com]

On Fri, 28 Dec 2018 10:15:54 -0500
"James B. Byrne via freebsd-questions" <freebsd-questions at freebsd.org>
wrote:

> At 09:12EST this morning:
> 
> ls -l resolv*
> -rw-r--r--  1 root  wheel  46 Dec 28 09:12 resolv.conf_empty_problem
> 
> 
> Something changed the contents of /etc/resolv.conf from this:
> 
> search hamilton.harte-lyne.ca harte-lyne.ca
> # nameserver ::216:33
> # nameserver ::216:34
> # nameserver 127.0.0.1
> nameserver 216.185.71.33
> nameserver 216.185.71.34
> options edns0 timeout:5 attempts:3
> 
> to this:
> 
> # Generated by resolvconf
> search localdomain
> 
> Now /sbin/resolvconf says that it has not been accessed recently:
> 
> # ls -lu /sbin/resolvconf
> -r-xr-xr-x  1 root  wheel  21803 Apr  3  2018 /sbin/resolvconf
> 
> And this change was immediately noticed at ~19:13EST by people
> accessing that host when all of their dns queries stopped resolving. 
> So, I am reasonably certain that whatever overwrote the existing file
> did so at 09:12 as shown on the mtime-stamp.
> 
> There are no crontab entries for root on this system:
> 
> # crontab -l
> crontab: no crontab for root
> 
> I have never encountered this problem before.  Has anyone any idea of
> why this happened?
> 

I have in /etc/ file dhclient-enter-hooks which has:
add_new_resolv_conf() {
        # We don't want /etc/resolv.conf changed
        # So this is an empty function
        return 0
}

and I do not have problems.