Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

when I try to start bind9; simply fail because of chroot & openssl

/etc/init.d/bind9 start

log messages;

Feb 17 08:26:27 ISTVS2024 named[2440]: initializing DST: openssl failure
Feb 17 08:26:27 ISTVS2024 named[2440]: exiting (due to fatal error)
Feb 17 08:26:27 ISTVS2024 kernel: [   92.091098] type=1400 audit(1361082387.173:14): apparmor="DENIED" operation="file_mmap" parent=2439 profile="/usr/sbin/named" name="/var/named/run-root/usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/" pid=2440 comm="named" requested_mask="m" denied_mask="m" fsuid=108 ouid=0

If I didnt miss a point Apparmor denies it;

my usr.sbin.named file already contains these lines:

/var/named/run-root/** rw,
/var/named/run-root/usr/** rw,

also I can confirm that this file ;


exist in filesystem.

Literally, I'm stuck, what other options I have, to fix this issue ?

Maybe, removing apparmor completely is a solution, but I didnt wanna do that

share|improve this question

I had the same problem this morning.

This guys answer fixed it for me.

share|improve this answer
Welcome to Ask Ubuntu! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – fossfreedom Mar 7 '13 at 21:40

This is the first hit on "initializing DST: openssl failure", which was the error I got when my DNS broke as a result of upgrading ubuntu from lucid to precise, so I'd like to mention the solution here.

In my case, it was due to bind depending on an ssl library that was not in its chroot jail. The solution was:

mkdir -p /usr/lib/i386-linux-gnu/openssl-1.0.0/engines
cp -a /usr/lib/i386-linux-gnu/openssl-1.0.0/engines /var/lib/named/usr/lib/i386-linux-gnu/openssl-1.0.0/

Of course, now I need to keep those files up to date, and I don't know if there's a better solution.

More info on how I figured this out here:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.