Articles in this section

Unable to start bind or apparmor warnings on Plesk Ubuntu/Debian server: loading configuration from '/etc/named.conf' loading configuration: permission denied

Renan Poss Moreira
Updated
Plesk for Linux kb: technical ABT: Group B

Applicable to:

  • Plesk for Linux

Symptoms

  • Unable to start bind9

  • Errors like the following in the system log /var/log/syslog:

    CONFIG_TEXT: named[8362]: loading configuration from '/etc/named.conf'
    named[8362]: open: /etc/named.conf: permission denied
    named[8362]: loading configuration: permission denied
    named[8362]: exiting (due to fatal error)
    kernel: [34074.383056] type=1400 audit(1494212104.678:254): apparmor="DENIED" operation="open" profile="/usr/sbin/named" name="/var/named/run-root/etc/named.conf" pid=8363 comm="named" requested_mask="r" denied_mask="r" fsuid=107 ouid=0

Cause

AppArmor prevent bind9/named from reading DNS server configuration files

Resolution

  1. Connect to the server via SSH

  2. Edit file /etc/apparmor.d/local/usr.sbin.named file in any text editor

  3. Add the following into /etc/apparmor.d/local/usr.sbin.named file:

    CONFIG_TEXT: /var/named/run-root/** rwm,

  4. Ensure that include <local/usr.sbin.named> directive is not commented with # in /etc/apparmor.d/usr.sbin.named

    # tail -3 /etc/apparmor.d/usr.sbin.named
    # Site-specific additions and overrides. See local/README for details.
    include <local/usr.sbin.named>
    }

  5. Reload AppArmor:

    # systemctl reload apparmor

  6. Start bind9 service:

    # systemctl restart bind9

Was this article helpful?

Comments

2 comments
Date Votes
  • Avatar
    Andrii Balytskyi

    The better solution is

    apt install apparmor-utils
    aa-disable named

     

    0
  • Avatar
    LRob.fr Web Hosting
    (Edited )

    I've been googling but didn't find this... Until I started opening an issue and used the support's search engine. Instead I found the solution on my own, losing an hour.

    But... if the issue is known, why isn't it fixed natively? Couldn't Plesk tweak Apparmor itself upon setting up the chroot version of named?

    0

Please sign in to leave a comment.