BIND DNS server - permission denied
I try today change log directory for my new dns BIND server daemon to /var/log/bind whith this bind9 config statement:
/etc/bind/named.conf
logging {
channel "queries_logging" {
file "/var/log/bind/queries_logging.log" versions 4 size 20m;
severity info;
print-time 1;
print-severity 1;
print-category 1;
};
category queries { "queries_logging"; };
};
And reload configration with rndc reload failed with this error:
root@ns-dmz:/var/log/bind# rndc reload
rndc: 'reload' failed: permission denied
systemctl command show more details:
root@ns-dmz:/var/log/bind# systemctl status bind9.service
● bind9.service - BIND Domain Name Server
Loaded: loaded (/lib/systemd/system/bind9.service; enabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Wed 2020-03-04 14:09:36 CET; 13s ago
Docs: man:named(8)
Process: 1046 ExecStart=/usr/sbin/named $OPTIONS (code=exited, status=1/FAILURE)
Tasks: 0 (limit: 2358)
Memory: 500.0K
CGroup: /system.slice/bind9.service
Mar 04 14:09:36 ns-dmz named[1047]: command channel listening on 127.0.0.1#953
Mar 04 14:09:36 ns-dmz named[1047]: configuring command channel from '/etc/bind/rndc.key'
Mar 04 14:09:36 ns-dmz named[1047]: command channel listening on ::1#953
Mar 04 14:09:36 ns-dmz named[1047]: isc_stdio_open '/var/log/bind/queries_logging.log' failed: permission denied
Mar 04 14:09:36 ns-dmz named[1047]: configuring logging: permission denied
Mar 04 14:09:36 ns-dmz systemd[1]: bind9.service: Control process exited, code=exited, status=1/FAILURE
Mar 04 14:09:36 ns-dmz named[1047]: loading configuration: permission denied
Mar 04 14:09:36 ns-dmz systemd[1]: bind9.service: Failed with result 'exit-code'.
Mar 04 14:09:36 ns-dmz named[1047]: exiting (due to fatal error)
Mar 04 14:09:36 ns-dmz systemd[1]: Failed to start BIND Domain Name Server.
And cat /var/log/syslog show that problem is in apparrmor configuration:
root@ns-dmz:/var/log/bind# cat /var/log/syslog
...
Mar 4 14:09:36 ns-dmz named[1047]: configuring command channel from '/etc/bind/rndc.key'
Mar 4 14:09:36 ns-dmz kernel: [ 5334.203179] audit: type=1400 audit(1583327376.725:35): apparmor="DENIED" operation="open" profile="/usr/sbin/named" name="/var/log/bind/queries_logging.log" pid=1047 comm="isc-worker0000" requested_mask="ac" denied_mask="ac" fsuid=110 ouid=110
...
Solution
The problem is in apparmor security module. Open /etc/apparmor.d/usr.sbin.named file and you can see this config:
/etc/apparmor.d/usr.sbin.named
# some people like to put logs in /var/log/named/ instead of having
# syslog do the heavy lifting.
/var/log/named/** rw,
/var/log/named/ rw,
So, you have a 2 solutions.
First, you must change your bind log directory to /var/log/named, or you must extend /etc/apparmor.d/usr.sbin.named apparmor config file to reflect your new bind log directory:
/etc/apparmor.d/usr.sbin.named
# some people like to put logs in /var/log/named/ instead of having
# syslog do the heavy lifting.
# /var/log/named/** rw,
# /var/log/named/ rw,
/var/log/bind/** rw,
/var/log/bind/ rw,
As last step you must restart apparmor module with systemctl restart apparmor.service or with /etc/init.d./apparmor restart and change ownership to bind user for your log files.
