0

i see in the named data file the zone i created will not load because of a permssion error:

[root@office1 tmp]# cat /var/named/data/named.run
info: managed-keys-zone: loaded serial 11
info: zone 0.in-addr.arpa/IN: loaded serial 0
info: zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0
info: zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0
info: zone localhost.localdomain/IN: loaded serial 0
info: zone localhost/IN: loaded serial 0
notice: all zones loaded
notice: running
info: received control channel command 'stop'
info: shutting down: flushing changes
notice: stopping command channel on 127.0.0.1#953
notice: stopping command channel on ::1#953
info: no longer listening on 127.0.0.1#53
info: no longer listening on 10.73.111.72#53
info: no longer listening on 192.168.122.1#53
notice: exiting
info: managed-keys-zone: journal file is out of date: removing journal file
info: managed-keys-zone: loaded serial 12
info: zone 0.in-addr.arpa/IN: loaded serial 0
info: zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0
info: zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0
info: zone localhost.localdomain/IN: loaded serial 0
info: zone localhost/IN: loaded serial 0
error: zone example.vm/IN: loading from master file db.example failed: permission denied
error: zone example.vm/IN: not loaded due to errors.
notice: all zones loaded
notice: running
info: received control channel command 'stop'
info: shutting down: flushing changes
notice: stopping command channel on 127.0.0.1#953
notice: stopping command channel on ::1#953
info: no longer listening on 127.0.0.1#53
info: no longer listening on 10.73.111.72#53
info: no longer listening on 192.168.122.1#53
notice: exiting
info: managed-keys-zone: journal file is out of date: removing journal file
info: managed-keys-zone: loaded serial 13
info: zone 0.in-addr.arpa/IN: loaded serial 0
info: zone localhost.localdomain/IN: loaded serial 0
info: zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0
info: zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0
info: zone localhost/IN: loaded serial 0
error: zone example.vm/IN: loading from master file db.example failed: **permission denied**
error: zone example.vm/IN: not loaded due to errors.
notice: all zones loaded
notice: running

I have the group permission on the zone file db.example set the same as the group:

[root@office1 named]# ls -l
total 24
drwxrwx---. 2 named named   49 Nov 25 03:48 data
-rw-r-----. 1 root  root   246 Nov 28 14:08 db.example
-rw-r-----. 1 root  named  234 Nov 28 08:20 db.office1
drwxrwx---. 2 named named   31 Nov 29 10:37 dynamic
-rw-r-----. 1 root  named 2281 May 22  2017 named.ca
-rw-r-----. 1 root  named  152 Dec 15  2009 named.empty
-rw-r-----. 1 root  named  152 Jun 21  2007 named.localhost
-rw-r-----. 1 root  named  168 Dec 15  2009 named.loopback
drwxrwx---. 2 named named    6 Aug 27 08:40 slaves

any ideas?

  • 1
    perhaps it's as simple as the named daemon running as the named user and thus unable to access db.example as the permissions do not allow it? – Jeff Schaller Nov 29 '18 at 19:14
3

You distribution probably runs bind as user named and group named, otherwise the directories in /var/lib/named wouldn't by owner by that user and group.

Your db.example is owned by root:root and has mode 640, therefor permission denied.

  • i chmod on the db.example to -rwxr-xr-x. 1 named root 246 Nov 28 14:08 db.example but same error – colonuts panics Nov 29 '18 at 20:27
  • 1
    @colonutspanics chmod on the file may not be enough; the user needs at least "execute" (+x) on each directory in the path in order to be able to descend into it. – Patrick Mevzek Jan 1 '19 at 20:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.