I'm having a problem when starting BIND9 using sudo systemctl start bind9
. I get a random error and when I examine it with sudo systemctl status bind9
, I get this:
bind9.service: Failed with result 'exit-code'.
Failed to start BIND Domain Name Server.
bind9.service: Schedule restart job, restart counter is at 20.
Stopped BIND Domain Name Server.
bind9.service: Start request repeated too quickly.
I set DefaultStartLimitIntervalSec
and DefaultStartLimitBurst
to 40s and 20 respectively on /etc/systemd/system.conf
, so I know it's not because the start requests are coming too quickly (I reloaded with sudo systemctl daemon-reload
afterwards).
This is what the logs on /var/log/kern.log
show but I'm new to Linux so I don't know how to recognize and solve the error based on that:
...apparmor="ALLOWED" operation="open profile="named" name="/proc/cmdline" pid=8226 comm="named" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
...apparmor="ALLOWED" operation="open profile="named" name="/proc/sys/kernel/osrelease" pid=8232 comm="named" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
And this is is my /etc/systemd/system/bind9.service
file:
[Unit]
Description=BIND Domain Name Server
Documentation=man:named(8)
After=network.target
Wants=nss-lookup.target
Before=nss-lookup.target
[Service]
Type=forking
EnvironmentFile=-/etc/default/named
ExecStart=/usr/sbin/named $OPTIONS
ExecReload=/usr/sbin/rndc reload
ExecStop=/usr/sbin/rndc stop
Restart=on-failure
[Install]
WantedBy=multi-user.target
Alias=bind9.service
Any help would be very much appreciated!
Thanks!
EDIT: Taking as a guidance the denied_mask=r
from the logs, I added to the named
profile on apparmor
(/etc/apparmor.d/usr.sbin.named
), the two path from the errors with the masks where they were denied for (r):
/proc/cmdline
as @{PROC}/cmdline r
/proc/sys/kernel/osrelease
as @{PROC}/sys/kernel/osrelease r
And now the error that I get in the logs is:
...appamor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="syslog-ng" pid=9486 common="apparmor_parser"
And stopping or disabling apparmor
with sudo systemctl stop|disable apparmor
doesn't solve the issue either.
(In case I wasn't supposed to do this modification, please let me know and I'll revert the changes)