RE: error: /var/named/dynamic/managed-keys.bind.jnl: create: permission denied

Xavier,

I believe Danilo Godec has given good advice,

Ultimately, rather than updating apparmor, which was an issue at my site, I moved all zone information into /var/bind/* but dynamic and static files.
I did something as well with error messages, but I don’t recall what, currently all log files are under /var/log/named/ don’t recall if that was an apparmor change or I moved the files, perhaps the former but didn’t have any issues bringing up a new DNS primary without changes, so I may have just been lucky when I’d picked the patch originally.

Brian Cuttler
Pronouns: he, him, his (What’s This<https://oer.ny.gov/system/files/documents/2023/11/personal-pronouns.pdf>?)
System and Network Administration
Wadsworth Center, New York State Department of Health
Room D280, Biggs Laboratory
Empire State Plaza, Albany, NY 12201
(518) 486-1697 | [email protected]<mailto:[email protected]>

[Wadsworth Center's logo thumbnail]

www.wadsworth.org<http://www.wadsworth.org/>


From: bind-users <[email protected]> On Behalf Of Danilo Godec via bind-users
Sent: Thursday, August 20, 2026 1:48 AM
To: [email protected]
Subject: Re: error: /var/named/dynamic/managed-keys.bind.jnl: create: permission denied

Attention: This email came from an external source. Do not open attachments or click on links from unknown senders or unexpected emails.
Hi,

I'd start by checking if the file /var/named/dynamic/managed-keys.bind.jnl already exists and has the correct ownership and permissions.

If that's OK, you might want to check your audit log (journalctl or /var/log/audit/audit.log), look for "apparmor.*DENIED'.

Also check that your 'named' process is actually running as 'bind' user - on my distribution, it's running as 'named':

# ps auwx | grep named

named    19845  0.4  3.2 966932 63832 ?        Ssl  avg18  11:31 /usr/sbin/named -u named -4

Permission denied is almost certainly a message from the operating system, not from named.

     D.



On 19.08.26 20:43, Xavier Humbert via bind-users wrote:
Hi, my DNS server is working perfectly, passes all the tests, but I started to notice this in the logs

root@aragorn:/var/named# ll /var/named/dynamic/
total 0
root@aragorn:/var/named# systemctl restart named
root@aragorn:/var/named# systemctl status named
● named.service - BIND Domain Name Server
     Loaded: loaded (/usr/lib/systemd/system/named.service; enabled; preset: enabled)
     Active: active (running) since Wed 2026-08-19 20:30:55 CEST; 3s ago
       Docs: man:named(8)
   Main PID: 178757 (named)
     Status: "running"
      Tasks: 10 (limit: 2216)
     Memory: 25.5M (peak: 26.5M)
        CPU: 607ms
     CGroup: /system.slice/named.service
             └─178757 /usr/sbin/named -f -u bind

Aug 19 20:30:55 aragorn.groumpf.org systemd[1]: Started named.service - BIND Domain Name Server.
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.011 general: notice: all zones loaded
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.012 general: error: /var/named/dynamic/managed-keys.bind.jnl: create: permission denied
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.012 general: error: managed-keys-zone: sync_keyzone:dns_journal_open -> unexpected error
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.012 dnssec: error: managed-keys-zone: unable to synchronize managed keys: unexpected error
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.012 dnssec: error: failed to initialize managed-keys for view _default (unexpected error): DNSSEC validation is at risk
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.013 notify: info: zone amdh-reseaux.fr/IN: sending notifies (serial 2026028370)
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.013 general: notice: running
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.014 notify: info: zone groumpf.org/IN: sending notifies (serial 2026010801)
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026 20:30:55.014 notify: info: zone amdh-reseaux.net/IN: sending notifies (serial 2026010801)


root@aragorn:/var/named# ll -a /var/named/
total 12
drwxr-xr-x  3 bind bind 4096 Nov 29  2023 ./
drwxr-xr-x 16 root root 4096 Dec 24  2024 ../
drwxr-xr-x  2 bind bind 4096 Nov 29  2023 dynamic/

Here are my options :

options {
    listen-on port 53 { 127.0.0.1; any;};
    listen-on-v6 port 53 { ::1; any;};
    listen-on { 127.0.0.1; };

    directory     "/var/named";
    dump-file     "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    recursing-file  "/var/named/data/named.recursing";
    secroots-file   "/var/named/data/named.secroots";
    allow-query     { localhost; };
    recursion no;

    managed-keys-directory "/var/named/dynamic";

    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";

    auth-nxdomain no;    # conform to RFC1035
    allow-transfer   { none; };
    allow-recursion    { xavhome; };
    version "NS.GROUMPF.ORG GROUMPF L'Internet Asocial";
};

What is the problem ? Permissions seem OK

This is an Ubuntu 22.04.4 Server LTS

Thanks,

Regards,

Xavier



Lep pozdrav / Best regards,
--
Danilo Godec | Sistemska podpora / System Administration
AGENDA d.o.o. | Ul. Pohorskega bataljona 49, Sl-2000 Maribor
E: [email protected] <mailto:[email protected]> | T: +386 (0)2 421 61 31
Agenda OpenSystems <https://www.agenda.si/> | Največji slovenski odprtokodni integrator
Red Hat v Sloveniji <http://www.redhat.si/> | Red Hat Premier Business Partner
ElasticBox <http://elasticbox.eu/> | Poslovne rešitve v oblaku
[Agenda d.o.o.]<https://www.agenda.si/>
Izjava o omejitvi odgovornosti / Legal disclaimer statement <https://www.agenda.si/index.php?id=228>

-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.