3

I'm following the instructions at the Samba wiki to set up BIND9 DLZ as the DNS backend for my Active Directory Domain Controller. However, I can't even get named to start. It wants write access to a file, but can't get it...

named[886]: /etc/bind/named.conf:9: open: /var/lib/samba/private/named.conf: permission denied
named[886]: loading configuration: permission denied
named[886]: exiting (due to fatal error)
systemd[1]: bind9.service: Main process exited, code=exited, status=1/FAILURE
kernel: [    5.004922] audit: type=1400 audit(1502211678.138:9): apparmor="DENIED" operation="open" profile="/usr/sbin/named" name="/var/lib/samba/private/named.conf" pid=906 comm="named" requested_mask="r" denied_mask="r" fsuid=114 ouid=0
systemd[1]: bind9.service: Control process exited, code=exited status=1
systemd[1]: bind9.service: Unit entered failed state.
systemd[1]: bind9.service: Failed with result 'exit-code'.

I thought I must have messed up the permissions somehow, but running ls -l /var/lib/samba/private/named.conf gives me:

-rw-rw-r-- 1 root root 678 Aug  8 17:56 /var/lib/samba/private/named.conf

Since the permissions were 664, any user should have been able to access the file. Even doing chown bind:bind (definitely the correct user, see kernel log), or setting permissions to 777 doesn't fix the problem.

The puzzling part is apparmor="DENIED" operation="open" profile="/usr/sbin/named" name="/var/lib/samba/private/named.conf" pid=906 comm="named" requested_mask="r" denied_mask="r" fsuid=114 ouid=0.

What am I missing/don't understand?

  • 1
    From that message, apparmor is denying read permission. Edit your apparmor profile and give write permission. – Panther Aug 8 '17 at 18:11
  • 2
    chmod 777 is never the correct answer. Never. – Rinzwind Aug 8 '17 at 18:22
  • @Rinzwind I wasn't trying to imply it was, I was using 777 to confirm that permissions were not the issue. – Alex V-P Aug 8 '17 at 18:23
  • @bodhi.zazen Thanks, I'm editing my config now. EDIT: Fixed, thanks. – Alex V-P Aug 8 '17 at 18:24
3

AppArmor was blocking the read. I went to /etc/apparmor.d/usr.sbin.named and added the line:

/var/lib/samba/private/named.conf r,

which allowed named to read the file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.