Re: error: /var/named/dynamic/managed-keys.bind.jnl: create: permission denied

No, the OP should start with AppArmor. /var/named is not a standard path (and not FHS) and is not allowed by the default AppArmor profile.

Ondrej
--
Ondřej Surý (He/Him)
[email protected]

ADHD brain at work: I sometimes lose track of my inbox. Please feel free to send a gentle nudge if you're waiting on a reply!

My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.

On 20. 8. 2026, at 07:48, Danilo Godec via bind-users <[email protected]> wrote:



Hi,

I'd start by checking if the file /var/named/dynamic/managed-keys.bind.jnl
already exists and has the correct ownership and permissions.

If that's OK, you might want to check
your audit log (journalctl or /var/log/audit/audit.log), look for
"apparmor.*DENIED'.

Also check that your 'named' process is
actually running as 'bind' user - on my distribution, it's running
as 'named':

# ps auwx | grep named
named 19845 0.4 3.2 966932 63832 ? Ssl avg18 11:31 /usr/sbin/named -u named -4

Permission denied is almost certainly a
message from the operating system, not from named.

D.

On 19.08.26 20:43, Xavier Humbert via
bind-users wrote:

Hi,
my DNS server is working perfectly, passes all the tests, but I
started to notice this in the logs

root@aragorn:/var/named# ll /var/named/dynamic/

total 0

root@aragorn:/var/named# systemctl restart named

root@aragorn:/var/named# systemctl status named

● named.service - BIND Domain Name Server

Loaded: loaded (/usr/lib/systemd/system/named.service;
enabled; preset: enabled)

Active: active (running) since Wed 2026-08-19 20:30:55 CEST;
3s ago

Docs: man:named(8)

Main PID: 178757 (named)

Status: "running"

Tasks: 10 (limit: 2216)

Memory: 25.5M (peak: 26.5M)

CPU: 607ms

CGroup: /system.slice/named.service

└─178757 /usr/sbin/named -f -u bind

Aug 19 20:30:55 aragorn.groumpf.org systemd[1]: Started
named.service - BIND Domain Name Server.

Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.011 general: notice: all zones loaded

Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.012 general: error:
/var/named/dynamic/managed-keys.bind.jnl: create: permission
denied

Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.012 general: error: managed-keys-zone:
sync_keyzone:dns_journal_open -> unexpected error

Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.012 dnssec: error: managed-keys-zone: unable to
synchronize managed keys: unexpected error

Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.012 dnssec: error: failed to initialize managed-keys for
view _default (unexpected error): DNSSEC validation is at risk

Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.013 notify: info: zone amdh-reseaux.fr/IN: sending
notifies (serial 2026028370)

Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.013 general: notice: running

Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.014 notify: info: zone groumpf.org/IN: sending notifies
(serial 2026010801)

Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.014 notify: info: zone amdh-reseaux.net/IN: sending
notifies (serial 2026010801)

root@aragorn:/var/named# ll -a /var/named/

total 12

drwxr-xr-x 3 bind bind 4096 Nov 29 2023 ./

drwxr-xr-x 16 root root 4096 Dec 24 2024 ../

drwxr-xr-x 2 bind bind 4096 Nov 29 2023 dynamic/

Here are my options :

options {

listen-on port 53 { 127.0.0.1; any;};

listen-on-v6 port 53 { ::1; any;};

listen-on { 127.0.0.1; };

directory "/var/named";

dump-file "/var/named/data/cache_dump.db";

statistics-file "/var/named/data/named_stats.txt";

memstatistics-file "/var/named/data/named_mem_stats.txt";

recursing-file "/var/named/data/named.recursing";

secroots-file "/var/named/data/named.secroots";

allow-query { localhost; };

recursion no;

managed-keys-directory "/var/named/dynamic";

pid-file "/run/named/named.pid";

session-keyfile "/run/named/session.key";

auth-nxdomain no; # conform to RFC1035

allow-transfer { none; };

allow-recursion { xavhome; };

version "NS.GROUMPF.ORG GROUMPF L'Internet Asocial";

};

What is the problem ? Permissions seem OK

This is an Ubuntu 22.04.4 Server LTS

Thanks,

Regards,

Xavier

Lep pozdrav / Best regards,

--

Danilo Godec |
Sistemska podpora / System Administration

AGENDA
d.o.o. | Ul. Pohorskega bataljona 49, Sl-2000
Maribor

E:
[email protected] | T:
+386 (0)2 421 61 31

Agenda OpenSystems
| Največji slovenski odprtokodni integrator

Red Hat v Sloveniji
| Red Hat Premier Business Partner

ElasticBox |
Poslovne rešitve v oblaku

<yuLfr5W60LvPgN12.webp>

Izjava
o omejitvi odgovornosti / Legal disclaimer statement

--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.

-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.