Re: error: /var/named/dynamic/managed-keys.bind.jnl: create: permission denied

Hi,

I'd start by checking if the file 
*/var/named/dynamic/managed-keys.bind.jnl* already exists and has the 
correct ownership and permissions.

If that's OK, you might want to check your audit log (journalctl or 
/var/log/audit/audit.log), look for "apparmor.*DENIED'.

Also check that your 'named' process is actually running as 'bind' user 
- on my distribution, it's running as '*named*':

# ps auwx | grep named
*named*    19845  0.4  3.2 966932 63832 ?        Ssl  avg18  11:31 /usr/sbin/named -u named -4


Permission denied is almost certainly a message from the operating 
system, not from named.

      D.



On 19.08.26 20:43, Xavier Humbert via bind-users wrote:
> Hi, my DNS server is working perfectly, passes all the tests, but I 
> started to notice this in the logs
>
> root@aragorn:/var/named# ll /var/named/dynamic/
> total 0
> root@aragorn:/var/named# systemctl restart named
> root@aragorn:/var/named# systemctl status named
> ● named.service - BIND Domain Name Server
>      Loaded: loaded (/usr/lib/systemd/system/named.service; enabled; 
> preset: enabled)
>      Active: active (running) since Wed 2026-08-19 20:30:55 CEST; 3s ago
>        Docs: man:named(8)
>    Main PID: 178757 (named)
>      Status: "running"
>       Tasks: 10 (limit: 2216)
>      Memory: 25.5M (peak: 26.5M)
>         CPU: 607ms
>      CGroup: /system.slice/named.service
>              └─178757 /usr/sbin/named -f -u bind
>
> Aug 19 20:30:55 aragorn.groumpf.org systemd[1]: Started named.service 
> - BIND Domain Name Server.
> Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 
> 20:30:55.011 general: notice: all zones loaded
> Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 
> 20:30:55.012 general: error: /var/named/dynamic/managed-keys.bind.jnl: 
> create: permission denied
> Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 
> 20:30:55.012 general: error: managed-keys-zone: 
> sync_keyzone:dns_journal_open -> unexpected error
> Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 
> 20:30:55.012 dnssec: error: managed-keys-zone: unable to synchronize 
> managed keys: unexpected error
> Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 
> 20:30:55.012 dnssec: error: failed to initialize managed-keys for view 
> _default (unexpected error): DNSSEC validation is at risk
> Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 
> 20:30:55.013 notify: info: zone amdh-reseaux.fr/IN: sending notifies 
> (serial 2026028370)
> Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 
> 20:30:55.013 general: notice: running
> Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 
> 20:30:55.014 notify: info: zone groumpf.org/IN: sending notifies 
> (serial 2026010801)
> Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 
> 20:30:55.014 notify: info: zone amdh-reseaux.net/IN: sending notifies 
> (serial 2026010801)
>
>
> root@aragorn:/var/named# ll -a /var/named/
> total 12
> drwxr-xr-x  3 bind bind 4096 Nov 29  2023 ./
> drwxr-xr-x 16 root root 4096 Dec 24  2024 ../
> drwxr-xr-x  2 bind bind 4096 Nov 29  2023 dynamic/
>
> Here are my options :
>
> options {
>     listen-on port 53 { 127.0.0.1; any;};
>     listen-on-v6 port 53 { ::1; any;};
>     listen-on { 127.0.0.1; };
>
>     directory     "/var/named";
>     dump-file     "/var/named/data/cache_dump.db";
>     statistics-file "/var/named/data/named_stats.txt";
>     memstatistics-file "/var/named/data/named_mem_stats.txt";
>     recursing-file  "/var/named/data/named.recursing";
>     secroots-file   "/var/named/data/named.secroots";
>     allow-query     { localhost; };
>     recursion no;
>
>     managed-keys-directory "/var/named/dynamic";
>
>     pid-file "/run/named/named.pid";
>     session-keyfile "/run/named/session.key";
>
>     auth-nxdomain no;    # conform to RFC1035
>     allow-transfer   { none; };
>     allow-recursion    { xavhome; };
>     version "NS.GROUMPF.ORG GROUMPF L'Internet Asocial";
> };
>
> What is the problem ? Permissions seem OK
>
> This is an Ubuntu 22.04.4 Server LTS
>
> Thanks,
>
> Regards,
>
> Xavier
>


Lep pozdrav / Best regards,
--
Danilo Godec | Sistemska podpora / System Administration
AGENDA d.o.o. | Ul. Pohorskega bataljona 49, Sl-2000 Maribor
E: [email protected] | T: +386 (0)2 421 61 31
Agenda OpenSystems <https://www.agenda.si/> | Največji slovenski 
odprtokodni integrator
Red Hat v Sloveniji <http://www.redhat.si/> | Red Hat Premier Business 
Partner
ElasticBox <http://elasticbox.eu/> | Poslovne rešitve v oblaku
Agenda d.o.o. <https://www.agenda.si/>
Izjava o omejitvi odgovornosti / Legal disclaimer statement 
<https://www.agenda.si/index.php?id=228>

-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.