Estou recebendo meu traseiro chutado por um erro de permissão simples. A pesquisa indica que isso é tudo e não tenho certeza de quais permissões adequadas devem ser definidas. Estranhamente, o BIND indica sucesso E resolve consultas para os hosts no arquivo de zona. Aqui está o que parece:
Primary
Jun 15 23:48:28 dns1 named[1151]: zone 127.in-addr.arpa/IN: loaded serial 1
Jun 15 23:48:28 dns1 named[1151]: zone 255.in-addr.arpa/IN: loaded serial 1
Jun 15 23:48:28 dns1 named[1151]: zone example.com/IN: loaded serial 2017061503
Jun 15 23:48:28 dns1 named[1151]: zone localhost/IN: loaded serial 2
Jun 15 23:48:28 dns1 named[1151]: all zones loaded
Jun 15 23:48:28 dns1 named[1151]: running
Jun 15 23:48:28 dns1 named[1151]: zone 40.0.10.in-addr.arpa/IN: sending notifies (serial 2017061502)
Jun 15 23:48:28 dns1 named[1151]: zone example.com/IN: sending notifies (serial 2017061503)
Jun 15 23:48:28 dns1 named[1151]: client 10.0.40.89#60405 (example.com): transfer of 'example.com/IN': AXFR-style IXFR started (serial 2017061
Jun 15 23:48:28 dns1 named[1151]: client 10.0.40.89#60405 (example.com): transfer of 'example.com/IN': AXFR-style IXFR ended
Secondary
Jun 15 23:48:28 dns2 named[1138]: client 10.0.40.88#59749: received notify for zone 'example.com'
Jun 15 23:48:28 dns2 named[1138]: zone example.com/IN: notify from 10.0.40.88#59749: serial 2017061503
Jun 15 23:48:28 dns2 named[1138]: zone example.com/IN: Transfer started.
Jun 15 23:48:28 dns2 named[1138]: transfer of 'example.com/IN' from 10.0.40.88#53: connected using 10.0.40.89#60405
Jun 15 23:48:28 dns2 named[1138]: zone example.com/IN: transferred serial 2017061503
Jun 15 23:48:28 dns2 named[1138]: zone example.com/IN: transfer: could not set file modification time of '/etc/bind/zones/db.example.com': permission denied
Jun 15 23:48:28 dns2 named[1138]: transfer of 'example.com/IN' from 10.0.40.88#53: Transfer status: success
Jun 15 23:48:28 dns2 named[1138]: transfer of 'example.com/IN' from 10.0.40.88#53: Transfer completed: 1 messages, 7 records, 199 bytes, 0.001 secs (199000 by
Jun 15 23:48:28 dns2 named[1138]: zone example.com/IN: sending notifies (serial 2017061503)
Jun 15 23:48:28 dns2 named[1138]: dumping master file: /etc/bind/zones/tmp-dvJaLDDA7o: open: permission denied
root é o dono, então estou um pouco perplexo.
chris@dns2:~$ ls -la /etc/bind/zones
total 12
drwxr-sr-x 2 root bind 4096 Jun 16 08:54 .
drwxr-sr-x 3 root bind 4096 Jun 15 23:12 ..
-rw-r--r-- 1 root bind 270 Jun 15 23:05 db.target.lab
chris@dns2:~$
Eu resolvo esse problema alterando as regras apparmor em /etc/apparmor.d/usr.sbin.named .
Eu editei o arquivo e mudei a linha:
%código%
para
/etc/bind/** r,
e depois:
/etc/bind/** rw,
Essa alteração também impede a permissão de erros negados ao salvar arquivos em
service apparmor restart
service bind9 restart
.