1

I am getting my butt kicked by a simple permissions error. Research indicates that is all this is and I'm not sure what proper permissions should be set. Oddly enough BIND indicates success AND resolves queries for the hosts in the zone file. Here is what it looks like:

Primary
Jun 15 23:48:28 dns1 named[1151]: zone 127.in-addr.arpa/IN: loaded serial 1
Jun 15 23:48:28 dns1 named[1151]: zone 255.in-addr.arpa/IN: loaded serial 1
Jun 15 23:48:28 dns1 named[1151]: zone example.com/IN: loaded serial 2017061503
Jun 15 23:48:28 dns1 named[1151]: zone localhost/IN: loaded serial 2
Jun 15 23:48:28 dns1 named[1151]: all zones loaded
Jun 15 23:48:28 dns1 named[1151]: running
Jun 15 23:48:28 dns1 named[1151]: zone 40.0.10.in-addr.arpa/IN: sending notifies (serial 2017061502)
Jun 15 23:48:28 dns1 named[1151]: zone example.com/IN: sending notifies (serial 2017061503)
Jun 15 23:48:28 dns1 named[1151]: client 10.0.40.89#60405 (example.com): transfer of 'example.com/IN': AXFR-style IXFR started (serial 2017061
Jun 15 23:48:28 dns1 named[1151]: client 10.0.40.89#60405 (example.com): transfer of 'example.com/IN': AXFR-style IXFR ended

Secondary
Jun 15 23:48:28 dns2 named[1138]: client 10.0.40.88#59749: received notify for zone 'example.com'
Jun 15 23:48:28 dns2 named[1138]: zone example.com/IN: notify from 10.0.40.88#59749: serial 2017061503
Jun 15 23:48:28 dns2 named[1138]: zone example.com/IN: Transfer started.
Jun 15 23:48:28 dns2 named[1138]: transfer of 'example.com/IN' from 10.0.40.88#53: connected using 10.0.40.89#60405
Jun 15 23:48:28 dns2 named[1138]: zone example.com/IN: transferred serial 2017061503
Jun 15 23:48:28 dns2 named[1138]: zone example.com/IN: transfer: could not set file modification time of '/etc/bind/zones/db.example.com': permission denied
Jun 15 23:48:28 dns2 named[1138]: transfer of 'example.com/IN' from 10.0.40.88#53: Transfer status: success
Jun 15 23:48:28 dns2 named[1138]: transfer of 'example.com/IN' from 10.0.40.88#53: Transfer completed: 1 messages, 7 records, 199 bytes, 0.001 secs (199000 by
Jun 15 23:48:28 dns2 named[1138]: zone example.com/IN: sending notifies (serial 2017061503)
Jun 15 23:48:28 dns2 named[1138]: dumping master file: /etc/bind/zones/tmp-dvJaLDDA7o: open: permission denied

root is the owner, so I am a little perplexed.

chris@dns2:~$ ls -la /etc/bind/zones
total 12
drwxr-sr-x 2 root bind 4096 Jun 16 08:54 .
drwxr-sr-x 3 root bind 4096 Jun 15 23:12 ..
-rw-r--r-- 1 root bind  270 Jun 15 23:05 db.target.lab
chris@dns2:~$
6
  • No, bind is the group. The owner is root.
    – fkraiem
    Jun 16, 2017 at 14:48
  • Yes! Still waking up here. I still don't know who the correct owner should be, this is a brand new, internal only zone, installation. I am pretty new to BIND.
    – Slacker
    Jun 16, 2017 at 14:57
  • The ownership is fine, I would just give write access to the group (chmod g+w /etc/bind/zones/).
    – fkraiem
    Jun 16, 2017 at 15:52
  • Use my pathlldtool. It will explain permissions, mount status, etc. git clone https://github.com/waltinator/pathlld
    – waltinator
    Jun 16, 2017 at 16:21
  • chmod g+w /etc/bind/zones/ was a winner for the forward, but no the reverse zone, which still does not exist. Jun 16 11:47:19 dns2 named[1147]: zone 40.0.10.in-addr.arpa/IN: sending notifies (serial 2017061502) Jun 16 11:47:19 dns2 named[1147]: dumping master file: /etc/bind/zones/tmp-0rvoGnfh0K: open: permission denied
    – Slacker
    Jun 16, 2017 at 16:55

2 Answers 2

2

I solve this problem by changing apparmor rules in /etc/apparmor.d/usr.sbin.named.

I've edit the file and changed the line: /etc/bind/** r, to /etc/bind/** rw,

and then: service apparmor restart service bind9 restart

This change also prevent permission denied errors when saving files to /etc/bind/slave.

1
  • This showed real reason for error. Solution: remove file directive, so bind saves slave zone in cache directory known to apparmor. Feb 7, 2021 at 12:02
-1

You must change the owner to user bind because who is writting over files is the service.

cd /etc
chown -R bind bind

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .