Tendo problemas com o Samba4 / BIND9_DLZ: problema de permissão do AppArmor

Question

(servidor 12.04.5LTS)

Ter um usuário "chamado", configurado no serviço bind9 para iniciar.

Meu arquivo /etc/apparmor.d/local/usr.sbin.named

/usr/local/samba/lib/** rm,
/usr/local/samba/private/dns.keytab r,
/usr/local/samba/private/named.conf r,
/usr/local/samba/private/dns/** rwk,  //seems that this should have given permission?
/var/named/** r,
/var/named/master/** rwk,

O arquivo tail -f / var / log / syslog:

Dec  3 12:40:13 mailhost named[1701]: failed to generate session key for dynamic DNS: permission denied
Dec  3 12:40:13 mailhost named[1701]: sizing zone task pool based on 6 zones
Dec  3 12:40:13 mailhost named[1701]: Loading 'AD DNS Zone' using driver dlopen
Dec  3 12:40:13 mailhost kernel: [ 8953.539920] type=1400 audit(1417635613.809:41): apparmor="DENIED" operation="open" profile="/usr/sbin/named" name="/usr/local/samba/etc/smb.conf" pid=1702 comm="named" requested_mask="r" denied_mask="r" fsuid=25 ouid=0
Dec  3 12:40:13 mailhost named[1701]: samba_dlz: Failed to connect to /usr/local/samba/private/dns/sam.ldb
Dec  3 12:40:13 mailhost named[1701]: dlz_dlopen of 'AD DNS Zone' failed
Dec  3 12:40:13 mailhost named[1701]: SDLZ driver failed to load.
Dec  3 12:40:13 mailhost named[1701]: DLZ driver failed to load.
Dec  3 12:40:13 mailhost named[1701]: loading configuration: failure
Dec  3 12:40:13 mailhost named[1701]: exiting (due to fatal error)

Onde devo resolver o problema a seguir?

    

Answer 1

Descobri que

sudo apparmor_parser --replace /etc/apparmor.d/usr.sbin.named

foi necessário recarregar as alterações que eu fiz no perfil do apparmor