when I try to start bind9; simply fail because of chroot & openssl

/etc/init.d/bind9 start

log messages;

Feb 17 08:26:27 ISTVS2024 named[2440]: initializing DST: openssl failure
Feb 17 08:26:27 ISTVS2024 named[2440]: exiting (due to fatal error)
Feb 17 08:26:27 ISTVS2024 kernel: [   92.091098] type=1400 audit(1361082387.173:14): apparmor="DENIED" operation="file_mmap" parent=2439 profile="/usr/sbin/named" name="/var/named/run-root/usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libgost.so" pid=2440 comm="named" requested_mask="m" denied_mask="m" fsuid=108 ouid=0

If I didnt miss a point Apparmor denies it;

my usr.sbin.named file already contains these lines:

/var/named/run-root/** rw,
/var/named/run-root/usr/** rw,

also I can confirm that this file ;


exist in filesystem.

Literally, I'm stuck, what other options I have, to fix this issue ?

Maybe, removing apparmor completely is a solution, but I didnt wanna do that

1 Answer 1


This is the first hit on "initializing DST: openssl failure", which was the error I got when my DNS broke as a result of upgrading ubuntu from lucid to precise, so I'd like to mention the solution here.

In my case, it was due to bind depending on an ssl library that was not in its chroot jail. The solution was:

mkdir -p /usr/lib/i386-linux-gnu/openssl-1.0.0/engines
cp -a /usr/lib/i386-linux-gnu/openssl-1.0.0/engines /var/lib/named/usr/lib/i386-linux-gnu/openssl-1.0.0/

Of course, now I need to keep those files up to date, and I don't know if there's a better solution.

More info on how I figured this out here: https://darxus.livejournal.com/329621.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .