<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal>Hello,<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I’m having a bit of difficulty setting up bind on FC11
(x64) which I’m using in a standalone network environment (i.e. no
external network connectivity; essentially a closed dev network). I
loaded the package from Red Hat and started it running as a service after building
my zone files and /etc/named.conf. I’m not using chroot, just
vanilla bind. I’ve read a number of posts about conflicts with bind
and SELinux which seems to be the issue here. When I set the
named_write_master_zones flag in SELinux, any actions related to starting or
stopping the named service seem to set the flag back to false.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>> restorecon –R –v /var/named<o:p></o:p></p>
<p class=MsoNormal>> setsebool -P named_write_master_zones=1<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Message log entry:<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:11 netmgr setsebool: The
named_write_master_zones policy boolean was changed to 1 by root<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>> service named restart<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Message log entry:<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:19 netmgr setsebool: The
named_write_master_zones policy boolean was changed to 0 by root<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:19 netmgr named[3198]: received control channel
command 'stop'<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:19 netmgr named[3198]: shutting down: flushing
changes<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:19 netmgr named[3198]: stopping command channel
on 127.0.0.1#953<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:19 netmgr named[3198]: stopping command channel
on ::1#953<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:19 netmgr named[3198]: no longer listening on
127.0.0.1#53<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:19 netmgr named[3198]: no longer listening on
192.168.2.0#53<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:19 netmgr named[3198]: no longer listening on
::1#53<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:19 netmgr named[3198]: exiting<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: starting BIND
9.6.1-P1-RedHat-9.6.1-4.P1.fc11 -u named<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: built with
'--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu'
'--target=x86_64-redhat-linux-gnu' '--program-prefix=' '--prefix=/usr'
'--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc'
'--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64'
'--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib'
'--mandir=/usr/share/man' '--infodir=/usr/share/info' '--with-libtool'
'--localstatedir=/var' '--enable-threads' '--enable-ipv6' '--with-pic'
'--disable-static' '--disable-openssl-version-check' '--with-dlz-ldap=yes'
'--with-dlz-postgres=yes' '--with-dlz-mysql=yes' '--with-dlz-filesystem=yes'
'--with-gssapi=yes' '--disable-isc-spnego' 'build_alias=x86_64-redhat-linux-gnu'
'host_alias=x86_64-redhat-linux-gnu' 'target_alias=x86_64-redhat-linux-gnu'
'CFLAGS= -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions
-fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic' 'CPPFLAGS=
-DDIG_SIGCHASE'<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: adjusted limit on open
files from 1024 to 1048576<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: found 4 CPUs, using 4
worker threads<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: using up to 4096 sockets<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: loading configuration
from '/etc/named.conf'<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: using default UDP/IPv4
port range: [1024, 65535]<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: using default UDP/IPv6
port range: [1024, 65535]<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: listening on IPv4
interface lo, 127.0.0.1#53<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: listening on IPv4
interface eth0, 192.168.2.0#53<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: listening on IPv6
interface lo, ::1#53<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: automatic empty zone:
127.IN-ADDR.ARPA<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: automatic empty zone:
254.169.IN-ADDR.ARPA<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: automatic empty zone:
2.0.192.IN-ADDR.ARPA<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: automatic empty zone:
255.255.255.255.IN-ADDR.ARPA<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: automatic empty zone:
0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: automatic empty zone:
D.F.IP6.ARPA<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: automatic empty zone:
8.E.F.IP6.ARPA<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: automatic empty zone:
9.E.F.IP6.ARPA<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: automatic empty zone:
A.E.F.IP6.ARPA<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: automatic empty zone:
B.E.F.IP6.ARPA<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: command channel
listening on 127.0.0.1#953<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: command channel
listening on ::1#953<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: the working directory is
not writable<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: zone 0.in-addr.arpa/IN:
NS '0.in-addr.arpa' has no address records (A or AAAA)<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: zone 0.in-addr.arpa/IN:
loaded serial 0<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: zone
1.0.0.127.in-addr.arpa/IN: NS '1.0.0.127.in-addr.arpa' has no address records
(A or AAAA)<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: zone
1.0.0.127.in-addr.arpa/IN: loaded serial 0<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: zone
2.168.192.in-addr.arpa/IN: NS 'netmgr.2.168.192.in-addr.arpa' has no address
records (A or AAAA)<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: zone
2.168.192.in-addr.arpa/IN: loaded serial 9091101<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: zone
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: NS
'1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa' has
no address records (A or AAAA)<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: zone
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN:
loaded serial 0<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: zone
localhost.localdomain/IN: loaded serial 0<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: zone localhost/IN:
loaded serial 0<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: zone u-giif.af.mil/IN:
loaded serial 9091103<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:20 netmgr named[3270]: running<o:p></o:p></p>
<p class=MsoNormal>Sep 11 17:13:22 netmgr setroubleshoot: SELinux is preventing
the named daemon from writing to the zone directory For complete SELinux
messages. run sealert -l d8456462-ce0f-4372-89ac-fafae8a6be35<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Thoughts as to how to convince SELinux that I wasn’t
kidding? Thanks.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>-Andy<o:p></o:p></p>
</div>
</body>
</html>