meta data for this page
  •  

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision		Previous revision
linux:sw:named [2021/05/16 14:46] – created niziaklinux:sw:named [2021/05/16 15:56] (current) – niziak
Line 19: Line 19:
 ... ...
 </file> </file>
 +
 +Test update:
 +<code bash>
 +nsupdate
 +zone int.example.com
 +update add kupa.int.example.com. 300 A 1.2.3.4
 +show
 +send
 +</code>
 +
 +==== Issue: error: journal open failed ====
 +
 +<code>
 +named[22943]: client @0x7f1d14623b10 192.168.64.100#19403: view internal: updating zone 'int.example.com/IN': adding an RR at 'kupa.int.example.com' A 1.2.3.4
 +audit[22943]: AVC apparmor="DENIED" operation="mknod" profile="/usr/sbin/named" name="/etc/bind/master/zone-int.example.com.jnl" pid=22943 comm="isc-worker0000" requested_mask="c" denied_mask="c" fsuid=106 ouid=106
 +named[22943]: master/zone-int.example.com.jnl: create: permission denied
 +named[22943]: client @0x7f1d14623b10 192.168.64.100#19403: view internal: updating zone 'int.example.com/IN': error: journal open failed: unexpected error
 +kernel: audit: type=1400 audit(1621169400.739:27): apparmor="DENIED" operation="mknod" profile="/usr/sbin/named" name="/etc/bind/master/zone-int.example.com.jnl" pid=22943 comm="isc-worker0000" requested_mask="c" denied_mask="c" fsuid=106 ouid=106
 +</code>
 +
 +  * Reason: by design app armor blocks modification of persistent cofnfig dir ''/etc''. It should be done inside ''/var/lib/bind''. In Debian, app armor is configured as:
 +    * /etc/bind should be read-only for bind
 +    * /var/lib/bind is for dynamically updated zone (and journal) files.
 +    * /var/cache/bind is for slave/stub data, since we're not the origin of it.
 +  * Solutions:
 +    * Create symbolic links (see [[https://wiki.debian.org/DDNS#DNS_Server_Configuration|DNS Server Configuration]]
 +    * modify app armor:
 +<file | /etc/apparmor.d/local/usr.sbin.named>
 +/etc/bind/zones/** rw,
 +</file>
 +
 +
 +