Permission error after upgrade to Debian Buster (10.2)
"Kaulkwappe" <[email protected]> Sun, 24 Nov 2019 16:41:21 +0100
| Newsgroups | gmane.network.dns.nsd.general |
|---|---|
| Message-ID | <[email protected]> |
--197802b873634f5b3407441377c2cfc713dcbe7e59a3c60a61b3d86602753d7d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Dear colleagues,<style>=0A=09=09=09=0A=09=09=09=09body {=0A=09=09=09=09=09f=
ont-family: 'Arial';=0A=09=09=09=09=09font-size: 100% !important;=0A=09=09=
=09=09=09margin: 0;=0A=09=09=09=09=09line-height: 1.2rem;=0A=09=09=09=09=09=
color: #1F497D;=0A=09=09=09=09}=0A=09=09=09=09=0A=09=09=09</style><div><br>=
</div><div>after upgrading from Stretch to Debian Buster (10.2) I get follo=
wing error message which blocks NSD (4.1.26) from starting:</div><div><br><=
/div><div><div>> Nov 24 16:18:40 ns2 nsd[989]: [2019-11-24 16:18:40.030]=
nsd[989]: error: could not open zone list /var/lib/nsd/zone.list: Permissi=
on denied</div><div>> Nov 24 16:18:40 ns2 nsd[989]: [2019-11-24 16:18:40=
.032] nsd[989]: error: could not read zonelist file /var/lib/nsd/zone.list<=
/div></div><div><br></div><div>However, the permissions are all fine; they =
did not change during the update.</div><div><br></div><div>ls -l /var/lib/n=
sd/zone.list</div><div>> -rw-r--r-- 1 nsd nsd 1195 Nov 4 17:3=
3 /var/lib/nsd/zone.list</div><div><br></div><div>I had a look into /l=
ib/systemd/system/nsd.service:</div><div><br></div><div><div>> [Unit]</d=
iv><div>> Description=3DName Server Daemon</div><div>> Documentation=
=3Dman:nsd(8)</div><div>> After=3Dnetwork.target</div><div><br></div><di=
v>> [Service]</div><div>> Type=3Dnotify</div><div>> Restart=3Dalwa=
ys</div><div>> ExecStart=3D/usr/sbin/nsd -d</div><div>> ExecReload=3D=
+/bin/kill -HUP $MAINPID</div><div>> CapabilityBoundingSet=3DCAP_CHOWN C=
AP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT</div>=
<div>> MemoryDenyWriteExecute=3Dtrue</div><div>> NoNewPrivileges=3Dtr=
ue</div><div>> PrivateDevices=3Dtrue</div><div>> PrivateTmp=3Dtrue</d=
iv><div>> ProtectHome=3Dtrue</div><div>> ProtectControlGroups=3Dtrue<=
/div><div>> ProtectKernelModules=3Dtrue</div><div>> ProtectKernelTuna=
bles=3Dtrue</div><div>> ProtectSystem=3Dstrict</div><div>> ReadWriteP=
aths=3D/var/lib/nsd /etc/nsd /run</div><div>> RuntimeDirectory=3Dnsd</di=
v><div>> RestrictRealtime=3Dtrue</div><div>> SystemCallArchitectures=
=3Dnative</div><div>> SystemCallFilter=3D~@clock @cpu-emulation @debug @=
keyring @module mount @obsolete @resources</div><div><br></div><div>> [I=
nstall]</div><div>> WantedBy=3Dmulti-user.target</div></div><div><br></d=
iv><div>Once I remove following line,</div><div><br></div><div>> Ca=
pabilityBoundingSet=3DCAP_CHOWN CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGI=
D CAP_SETUID CAP_SYS_CHROOT</div><div><br></div><div>while it does not help=
to only remove params from it (I need to remove the full line), the error =
message changes to:</div><div><br></div><div><div>> Nov 24 16:37:57 ns2 =
systemd[1]: Starting Name Server Daemon...</div><div>> Nov 24 16:37:57 n=
s2 nsd[1607]: [2019-11-24 16:37:57.144] nsd[1607]: error: Cannot open /var/=
log/nsd.log for appending (Read-only file system), logging to stderr</div><=
div>> Nov 24 16:37:57 ns2 nsd[1607]: [2019-11-24 16:37:57.145] nsd[1607]=
: notice: nsd starting (NSD 4.1.26)</div><div>> Nov 24 16:37:57 ns2 nsd[=
1607]: [2019-11-24 16:37:57.252] nsd[1608]: notice: nsd started (NSD 4.1.26=
), pid 1607</div><div>> Nov 24 16:37:57 ns2 systemd[1]: Started Name Ser=
ver Daemon.</div></div><div><br></div><div>Since nsd-control zonestatus now=
works, NSD now can read the /var/lib/nsd/zone.list. However, it is st=
ill not running fine because now NSD says it cannot open the /var/log/=
nsd.log.</div><div><br></div><div>Does anyone know how to fix that?</div><d=
iv><br></div><div>Kind Regards,</div><div>Kaulkwappe</div>
--197802b873634f5b3407441377c2cfc713dcbe7e59a3c60a61b3d86602753d7d
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
nsd-users mailing list
[email protected]
https://open.nlnetlabs.nl/mailman/listinfo/nsd-users
--197802b873634f5b3407441377c2cfc713dcbe7e59a3c60a61b3d86602753d7d--