☰

由于 apparmor 错误，BIND9 未启动

tag-icon • tag-icon linux ubuntu dns
由于 apparmor 错误，BIND9 未启动

我的 Ubuntu 服务器上安装了 BIND 版本 9.19.16。但是，它不会启动 BIND 服务。当我尝试时，systemctl start bind9需要一分钟左右的时间，然后返回并出现以下错误：

Job for named.service failed because a timeout was exceeded.

当我使用 查看状态时systemctl status bind9，我会看到：

● named.service - BIND Domain Name Server
     Loaded: loaded (/lib/systemd/system/named.service; enabled; vendor preset: enabled)
     Active: activating (start) since Tue 2023-09-05 11:30:19 BST; 3s ago
       Docs: man:named(8)
   Main PID: 10461 (named)
      Tasks: 3 (limit: 1096)
     Memory: 3.5M
     CGroup: /system.slice/named.service
             └─10461 /usr/sbin/named -f -u bind

Sep 05 11:30:19 ip-xxx-xxx-xxx-xxx named[10461]: command channel listening on ::1#953
Sep 05 11:30:19 ip-xxx-xxx-xxx-xxx named[10461]: managed-keys-zone: loaded serial 135
Sep 05 11:30:19 ip-xxx-xxx-xxx-xxx named[10461]: zone localhost/IN: loaded serial 2
Sep 05 11:30:19 ip-xxx-xxx-xxx-xxx named[10461]: zone 0.in-addr.arpa/IN: loaded serial 1
Sep 05 11:30:19 ip-xxx-xxx-xxx-xxx named[10461]: zone 127.in-addr.arpa/IN: loaded serial 1
Sep 05 11:30:19 ip-xxx-xxx-xxx-xxx named[10461]: zone 255.in-addr.arpa/IN: loaded serial 1
Sep 05 11:30:19 ip-xxx-xxx-xxx-xxx named[10461]: all zones loaded
Sep 05 11:30:19 ip-xxx-xxx-xxx-xxx named[10461]: FIPS mode is disabled
Sep 05 11:30:19 ip-xxx-xxx-xxx-xxx named[10461]: running
Sep 05 11:30:19 ip-xxx-xxx-xxx-xxx named[10461]: managed-keys-zone: Key 20326 for zone . is now trusted (acceptance timer complete)

无论我等待多久，状态都保持为正在激活。当我输入时，journalctl -xe我可以看到 apparmor 有错误：

audit[10470]: AVC apparmor="DENIED" operation="sendmsg" profile="/usr/sbin/named" name="/run/systemd/notify" pid=10470 comm="named" requested_mask="w" denied_mask="w" fsuid=113 ouid=0

因此，我编辑/etc/apparmor.d/usr.sbin.named文件以包含以下行：/run/systemd/notify w,并重新启动 apparmor 和 BIND9，但仍然出现相同的错误。知道出了什么问题吗？

答案1

这种情况下的问题是 /etc/apparmor.d/usr.sbin.named文件中配置文件的定义错误。按以下方式更改文件：

-profile named /usr/sbin/named flags=(attach_disconnected, complain) {
+profile /usr/sbin/named flags=(attach_disconnected) {

并运行apparmor_parser -r /etc/apparmor.d/usr.sbin.named

有关 apparmor 中配置文件的更多信息：
https://doc.opensuse.org/documentation/leap/security/html/book-security/cha-apparmor-profiles.html

相关内容