2

Just upgraded debian and named is not starting now. I have 2 log channels configured:

    channel "named_log" {
        file "/var/log/bind/named.log" versions 10 size 2m;
        severity dynamic;
        print-category yes;
        print-severity yes;
        print-time yes;
    };

    channel "query_log" {
        file "/var/log/bind/query.log" versions 2 size 100k;
        severity dynamic;
        print-severity yes;
        print-time yes;
    };

Everything was working till upgrade. Here's the directory:

root@dom:/var/log/bind# ls -la /var/log/bind
total 156
drwxrwsr-x  2 bind bind   4096 Oct 30 17:14 .
drwxr-xr-x 36 root root   4096 Oct 30 15:41 ..
-rw-r-----  1 bind bind 149847 Oct 30 17:45 bind9.log
root@dom:/var/log/bind# id bind
uid=110(bind) gid=118(bind) groups=118(bind)
root@dom:/var/log/bind# ls -lna /var/log/bind
total 156
drwxrwsr-x  2 110 118   4096 Oct 30 17:14 .
drwxr-xr-x 36   0   0   4096 Oct 30 15:41 ..
-rw-r-----  1 110 118 149847 Oct 30 17:45 bind9.log
root@dom:/var/log/bind# named -v
BIND 9.11.5-P4-5.1-Debian (Extended Support Version) <id:998753c>
root@dom:~# ps -eo pid,gid,euid,comm|grep named
 6677   118   110 named

But have this:

Oct 30 17:04:35 dom named[4997]: configuring command channel from '/etc/bind/rndc.key'
Oct 30 17:04:35 dom named[4997]: command channel listening on 127.0.0.1#953
Oct 30 17:04:35 dom named[4997]: isc_stdio_open '/var/log/bind/named.log' failed: permission denied
Oct 30 17:04:35 dom named[4997]: configuring logging: permission denied
Oct 30 17:04:35 dom named[4997]: loading configuration: permission denied
Oct 30 17:04:35 dom named[4997]: exiting (due to fatal error)

I temporary enabled login for user bind and can confirm that this user can create and modify files in the /var/log/bind/

Please help

upd: did chmod 777 /var/log/bind - the same error

5
  • Have you tried to touch those files first and then restart the bind service? : sudo touch /var/log/bind/named.log && chown bind:bind /var/log/bind/named.log – Dmitriy Kupch Oct 30 '19 at 15:57
  • @DmitriyKupch yes, but they're already owned by bind – BbIKTOP Oct 30 '19 at 15:58
  • can you run: ls -l /var/log/bind/named.log – Dmitriy Kupch Oct 30 '19 at 15:59
  • try chmod -R 777 /var/log/bind to see which user owns those files. – Dmitriy Kupch Oct 30 '19 at 16:07
  • thanks to @t3ddftw it's solved. Some "apparmor" linups module did that, I'm not too deep in these new things but after adding this dir to its config, everything works as it should – BbIKTOP Oct 30 '19 at 16:18
4

It sounds as though bind9 may not be allowed to write to the folder for other reasons.

Check to see if AppArmor is running via aa-status.

AppArmor is another mandatory access control mechanism for Linux, comparable to SELinux. In reality, you want it there because it keeps applications from being used maliciously if exploited.

If it is, temporarily disable it to test:

sudo systemctl stop apparmor
sudo systemctl disable apparmor

If that resolves the issue, then you will need to update the bind9 profile in AppArmor to allow it access to the log folder.

For reference, AppArmor profiles are stored in /etc/apparmor.d/

10
  • I have added this a few minutes ago, you probably didn't reload the question, sorry root@dom:~# ps -eo pid,gid,euid,comm|grep named 6677 118 110 named – BbIKTOP Oct 30 '19 at 16:00
  • 1
    @BbIKTOP - Is AppArmor running? That would be the next thing to check. (aa-status) – t3ddftw Oct 30 '19 at 16:03
  • 1
    @BbIKTOP - You probably missed it in my comment -- run: aa-status – t3ddftw Oct 30 '19 at 16:05
  • 1
    @BbIKTOP - Updated -- glad you got it sorted :) – t3ddftw Oct 30 '19 at 16:29
  • 1
    thank you, I'd never find it myself, had no idea it even exists! could you please also add that it's configuration profiles are stored in /etc/apparmor.d and all necessary access rules shall be added there? I see you already did. Thank you! ;) – BbIKTOP Oct 30 '19 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.