一个简单的权限错误让我大吃一惊。研究表明这就是全部，我不确定应该设置什么适当的权限。奇怪的是，BIND 指示成功并解析区域文件中主机的查询。它看起来像这样：
Primary
Jun 15 23:48:28 dns1 named[1151]: zone 127.in-addr.arpa/IN: loaded serial 1
Jun 15 23:48:28 dns1 named[1151]: zone 255.in-addr.arpa/IN: loaded serial 1
Jun 15 23:48:28 dns1 named[1151]: zone example.com/IN: loaded serial 2017061503
Jun 15 23:48:28 dns1 named[1151]: zone localhost/IN: loaded serial 2
Jun 15 23:48:28 dns1 named[1151]: all zones loaded
Jun 15 23:48:28 dns1 named[1151]: running
Jun 15 23:48:28 dns1 named[1151]: zone 40.0.10.in-addr.arpa/IN: sending notifies (serial 2017061502)
Jun 15 23:48:28 dns1 named[1151]: zone example.com/IN: sending notifies (serial 2017061503)
Jun 15 23:48:28 dns1 named[1151]: client 10.0.40.89#60405 (example.com): transfer of 'example.com/IN': AXFR-style IXFR started (serial 2017061
Jun 15 23:48:28 dns1 named[1151]: client 10.0.40.89#60405 (example.com): transfer of 'example.com/IN': AXFR-style IXFR ended
Secondary
Jun 15 23:48:28 dns2 named[1138]: client 10.0.40.88#59749: received notify for zone 'example.com'
Jun 15 23:48:28 dns2 named[1138]: zone example.com/IN: notify from 10.0.40.88#59749: serial 2017061503
Jun 15 23:48:28 dns2 named[1138]: zone example.com/IN: Transfer started.
Jun 15 23:48:28 dns2 named[1138]: transfer of 'example.com/IN' from 10.0.40.88#53: connected using 10.0.40.89#60405
Jun 15 23:48:28 dns2 named[1138]: zone example.com/IN: transferred serial 2017061503
Jun 15 23:48:28 dns2 named[1138]: zone example.com/IN: transfer: could not set file modification time of '/etc/bind/zones/db.example.com': permission denied
Jun 15 23:48:28 dns2 named[1138]: transfer of 'example.com/IN' from 10.0.40.88#53: Transfer status: success
Jun 15 23:48:28 dns2 named[1138]: transfer of 'example.com/IN' from 10.0.40.88#53: Transfer completed: 1 messages, 7 records, 199 bytes, 0.001 secs (199000 by
Jun 15 23:48:28 dns2 named[1138]: zone example.com/IN: sending notifies (serial 2017061503)
Jun 15 23:48:28 dns2 named[1138]: dumping master file: /etc/bind/zones/tmp-dvJaLDDA7o: open: permission denied
root 是所有者，所以我有点困惑。
chris@dns2:~$ ls -la /etc/bind/zones
total 12
drwxr-sr-x 2 root bind 4096 Jun 16 08:54 .
drwxr-sr-x 3 root bind 4096 Jun 15 23:12 ..
-rw-r--r-- 1 root bind 270 Jun 15 23:05 db.target.lab
chris@dns2:~$
答案1
我通过改变apparmor规则来解决这个问题/etc/apparmor.d/usr.sbin.named。
我编辑了该文件并将行更改
/etc/bind/** r,
为 ：
/etc/bind/** rw,
进而：
service apparmor restart service bind9 restart
此更改还可以防止在将文件保存到时出现权限被拒绝的错误/etc/bind/slave。
答案2
您必须将所有者更改为用户绑定，因为写入文件的人是服务。
cd /etc
chown -R bind bind