Re: error: /var/named/dynamic/managed-keys.bind.jnl: create: permission denied

> This is an Ubuntu 22.04.4 Server LTS

FTR that's EOL in May 2027

> What is the problem ? Permissions seem OK


Most likely AppArmor

Ondrej
--
Ondřej Surý (He/Him)
[email protected]

ADHD brain at work: I sometimes lose track of my inbox. Please feel free to send a gentle nudge if you're waiting on a reply!

My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.

> On 19. 8. 2026, at 20:43, Xavier Humbert via bind-users <[email protected]> wrote:
> 
> Hi, my DNS server is working perfectly, passes all the tests, but I started to notice this in the logs
> 
> root@aragorn:/var/named# ll /var/named/dynamic/
> total 0
> root@aragorn:/var/named# systemctl restart named
> root@aragorn:/var/named# systemctl status named
> ● named.service - BIND Domain Name Server
>      Loaded: loaded (/usr/lib/systemd/system/named.service; enabled; preset: enabled)
>      Active: active (running) since Wed 2026-08-19 20:30:55 CEST; 3s ago
>        Docs: man:named(8)
>    Main PID: 178757 (named)
>      Status: "running"
>       Tasks: 10 (limit: 2216)
>      Memory: 25.5M (peak: 26.5M)
>         CPU: 607ms
>      CGroup: /system.slice/named.service
>              └─178757 /usr/sbin/named -f -u bind
> 
> Aug 19 20:30:55 aragorn.groumpf.org systemd[1]: Started named.service - BIND Domain Name Server.
> Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.011 general: notice: all zones loaded
> Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.012 general: error: /var/named/dynamic/managed-keys.bind.jnl: create: permission denied
> Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.012 general: error: managed-keys-zone: sync_keyzone:dns_journal_open -> unexpected error
> Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.012 dnssec: error: managed-keys-zone: unable to synchronize managed keys: unexpected error
> Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.012 dnssec: error: failed to initialize managed-keys for view _default (unexpected error): DNSSEC validation is at risk
> Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.013 notify: info: zone amdh-reseaux.fr/IN: sending notifies (serial 2026028370)
> Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.013 general: notice: running
> Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.014 notify: info: zone groumpf.org/IN: sending notifies (serial 2026010801)
> Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.014 notify: info: zone amdh-reseaux.net/IN: sending notifies (serial 2026010801)
> 
> 
> root@aragorn:/var/named# ll -a /var/named/
> total 12
> drwxr-xr-x  3 bind bind 4096 Nov 29  2023 ./
> drwxr-xr-x 16 root root 4096 Dec 24  2024 ../
> drwxr-xr-x  2 bind bind 4096 Nov 29  2023 dynamic/
> 
> Here are my options :
> 
> options {
>     listen-on port 53 { 127.0.0.1; any;};
>     listen-on-v6 port 53 { ::1; any;};
>     listen-on { 127.0.0.1; };
> 
>     directory     "/var/named";
>     dump-file     "/var/named/data/cache_dump.db";
>     statistics-file "/var/named/data/named_stats.txt";
>     memstatistics-file "/var/named/data/named_mem_stats.txt";
>     recursing-file  "/var/named/data/named.recursing";
>     secroots-file   "/var/named/data/named.secroots";
>     allow-query     { localhost; };
>     recursion no;
> 
>     managed-keys-directory "/var/named/dynamic";
> 
>     pid-file "/run/named/named.pid";
>     session-keyfile "/run/named/session.key";
> 
>     auth-nxdomain no;    # conform to RFC1035
>     allow-transfer   { none; };
>     allow-recursion    { xavhome; };
>     version "NS.GROUMPF.ORG GROUMPF L'Internet Asocial";
> };
> 
> What is the problem ? Permissions seem OK
> 
> This is an Ubuntu 22.04.4 Server LTS
> 
> Thanks,
> 
> Regards,
> 
> Xavier
> 
> -- 
> Xavier Humbert
> CRT Supervision et Exploitation de Niveau 1
> Direction Régionale Académique des Systèmes d’Information Grand Est
> Rectorat de l'Académie de Nancy-Metz
> Ministère de l'Éducation Nationale, de l'Enseignement Supérieur et de la Recherche
> 03 83 86 27 39
> 
> -- 
> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.

-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.