Home / server / Questions / 715317
Accepted
Don Branson
Asked: 2015-08-20 08:41:50 +0800 CST

named running as root cannot read named.conf

  • 772

Tried running named as my own user on an Ubuntu box, and it couldn't read the named.conf file:

named -d 9 -c named.conf -g
19-Aug-2015 11:33:10.698 starting BIND 9.9.5-3ubuntu0.4-Ubuntu -d 9 -c named.conf -g
19-Aug-2015 11:33:10.698 built with '--prefix=/usr' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--sysconfdir=/etc/bind' '--localstatedir=/var' '--enable-threads' '--enable-largefile' '--with-libtool' '--enable-shared' '--enable-static' '--with-openssl=/usr' '--with-gssapi=/usr' '--with-gnu-ld' '--with-geoip=/usr' '--with-atf=no' '--enable-ipv6' '--enable-rrl' '--enable-filter-aaaa' 'CFLAGS=-fno-strict-aliasing -DDIG_SIGCHASE -O2'
19-Aug-2015 11:33:10.698 ----------------------------------------------------
19-Aug-2015 11:33:10.698 BIND 9 is maintained by Internet Systems Consortium,
19-Aug-2015 11:33:10.698 Inc. (ISC), a non-profit 501(c)(3) public-benefit 
19-Aug-2015 11:33:10.698 corporation.  Support and training for BIND 9 are 
19-Aug-2015 11:33:10.698 available at https://www.isc.org/support
19-Aug-2015 11:33:10.698 ----------------------------------------------------
19-Aug-2015 11:33:10.698 found 8 CPUs, using 8 worker threads
19-Aug-2015 11:33:10.698 using 8 UDP listeners per interface
19-Aug-2015 11:33:10.699 using up to 4096 sockets
19-Aug-2015 11:33:10.699 Registering DLZ_dlopen driver
19-Aug-2015 11:33:10.699 Registering SDLZ driver 'dlopen'
19-Aug-2015 11:33:10.699 Registering DLZ driver 'dlopen'
19-Aug-2015 11:33:10.700 decrement_reference: delete from rbt: 0x7fbd40eb6068 .
19-Aug-2015 11:33:10.703 loading configuration from '/tmp/name/named.conf'
19-Aug-2015 11:33:10.703 open: /tmp/name/named.conf: permission denied
19-Aug-2015 11:33:10.703 load_configuration: permission denied
19-Aug-2015 11:33:10.703 loading configuration: permission denied
19-Aug-2015 11:33:10.703 exiting (due to fatal error)

I opened up the permissions on named.conf:

drwxrwxrwx  2 don  don    4096 Aug 19 11:31 ./
drwxrwxrwt 26 root root 118784 Aug 19 11:35 ../
-rwxrwxrwx  1 don  don     387 Aug 19 11:33 named.conf*

I tried running as root with the same result:

sudo named -d 9 -c named.conf -g

The OS is ubuntu:

uname -a
Linux don-asus 3.16.0-46-generic #62~14.04.1-Ubuntu SMP Tue Aug 11 16:27:16 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

This all works fine on OSX and another Ubuntu box. What else on Linux can block access to open a file?

Edit:

>sudo apparmor_status
apparmor module is loaded.
24 profiles are loaded.
24 profiles are in enforce mode.
   /sbin/dhclient
...

So - it looks like it is active.

linux

1 Answers

  1. Best Answer

    As was found based on the discussion in the comments, AppArmor was found to be loaded (based on sudo apparmor_status output).

    When AppArmor is loaded and has rules in enforce mode it can do things like deny specific processes from accessing anything but specific paths.

    I wouid assume what is happening here is that it has rules for BIND which ensures that the named process can only access something like /etc/bind, /var/cache/bind, /var/lib/bind (the paths that the default Debian/Ubuntu BIND configuration uses).


    If you want to completely disable the profile, Ubuntu's Help Wiki AppArmor page details how to disable a profile:

    sudo ln -s /etc/apparmor.d/profile.name /etc/apparmor.d/disable/
sudo apparmor_parser -R /etc/apparmor.d/profile.name


    Alternatively you can adjust the rules for the BIND profile and reload it:

    sudo apparmor_parser -r /etc/apparmor.d/profile.name
    • 5