<html class="apple-mail-supports-explicit-dark-mode"><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">No, the OP should start with AppArmor. /var/named is not a standard path (and not FHS) and is not allowed by the default AppArmor profile.<div><br></div><div>Ondrej<br id="lineBreakAtBeginningOfSignature"><div dir="ltr"><span style="background-color: rgba(255, 255, 255, 0);">--<br>Ondřej Surý (He/Him)<br><span dir="ltr">ondrej@isc.org</span><br><br>ADHD brain at work: I sometimes lose track of my inbox. Please feel free to send a gentle nudge if you're waiting on a reply!<br><br>My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.</span><br style="font-size: 17px;"></div><div dir="ltr"><br><blockquote type="cite">On 20. 8. 2026, at 07:48, Danilo Godec via bind-users <bind-users@lists.isc.org> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div class="moz-cite-prefix">Hi,</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">I'd start by checking if the file <b>/var/named/dynamic/managed-keys.bind.jnl</b>
already exists and has the correct ownership and permissions.</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">If that's OK, you might want to check
your audit log (journalctl or /var/log/audit/audit.log), look for
"apparmor.*DENIED'.</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Also check that your 'named' process is
actually running as 'bind' user - on my distribution, it's running
as '<b>named</b>':</div>
<pre># ps auwx | grep named
<b>named</b> 19845 0.4 3.2 966932 63832 ? Ssl avg18 11:31 /usr/sbin/named -u named -4</pre>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Permission denied is almost certainly a
message from the operating system, not from named.</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix"> D.</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">On 19.08.26 20:43, Xavier Humbert via
bind-users wrote:<br>
</div>
<blockquote type="cite" cite="mid:aa94a213-7f36-4aca-9f29-478630592ee7@ac-nancy-metz.fr">Hi,
my DNS server is working perfectly, passes all the tests, but I
started to notice this in the logs
<br>
<br>
root@aragorn:/var/named# ll /var/named/dynamic/
<br>
total 0
<br>
root@aragorn:/var/named# systemctl restart named
<br>
root@aragorn:/var/named# systemctl status named
<br>
● named.service - BIND Domain Name Server
<br>
Loaded: loaded (/usr/lib/systemd/system/named.service;
enabled; preset: enabled)
<br>
Active: active (running) since Wed 2026-08-19 20:30:55 CEST;
3s ago
<br>
Docs: <a class="moz-txt-link-freetext" href="man:named(8)">man:named(8)</a>
<br>
Main PID: 178757 (named)
<br>
Status: "running"
<br>
Tasks: 10 (limit: 2216)
<br>
Memory: 25.5M (peak: 26.5M)
<br>
CPU: 607ms
<br>
CGroup: /system.slice/named.service
<br>
└─178757 /usr/sbin/named -f -u bind
<br>
<br>
Aug 19 20:30:55 aragorn.groumpf.org systemd[1]: Started
named.service - BIND Domain Name Server.
<br>
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.011 general: notice: all zones loaded
<br>
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.012 general: error:
/var/named/dynamic/managed-keys.bind.jnl: create: permission
denied
<br>
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.012 general: error: managed-keys-zone:
sync_keyzone:dns_journal_open -> unexpected error
<br>
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.012 dnssec: error: managed-keys-zone: unable to
synchronize managed keys: unexpected error
<br>
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.012 dnssec: error: failed to initialize managed-keys for
view _default (unexpected error): DNSSEC validation is at risk
<br>
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.013 notify: info: zone amdh-reseaux.fr/IN: sending
notifies (serial 2026028370)
<br>
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.013 general: notice: running
<br>
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.014 notify: info: zone groumpf.org/IN: sending notifies
(serial 2026010801)
<br>
Aug 19 20:30:55 aragorn.groumpf.org named[178757]: 19-Aug-2026
20:30:55.014 notify: info: zone amdh-reseaux.net/IN: sending
notifies (serial 2026010801)
<br>
<br>
<br>
root@aragorn:/var/named# ll -a /var/named/
<br>
total 12
<br>
drwxr-xr-x 3 bind bind 4096 Nov 29 2023 ./
<br>
drwxr-xr-x 16 root root 4096 Dec 24 2024 ../
<br>
drwxr-xr-x 2 bind bind 4096 Nov 29 2023 dynamic/
<br>
<br>
Here are my options :
<br>
<br>
options {
<br>
listen-on port 53 { 127.0.0.1; any;};
<br>
listen-on-v6 port 53 { ::1; any;};
<br>
listen-on { 127.0.0.1; };
<br>
<br>
directory "/var/named";
<br>
dump-file "/var/named/data/cache_dump.db";
<br>
statistics-file "/var/named/data/named_stats.txt";
<br>
memstatistics-file "/var/named/data/named_mem_stats.txt";
<br>
recursing-file "/var/named/data/named.recursing";
<br>
secroots-file "/var/named/data/named.secroots";
<br>
allow-query { localhost; };
<br>
recursion no;
<br>
<br>
managed-keys-directory "/var/named/dynamic";
<br>
<br>
pid-file "/run/named/named.pid";
<br>
session-keyfile "/run/named/session.key";
<br>
<br>
auth-nxdomain no; # conform to RFC1035
<br>
allow-transfer { none; };
<br>
allow-recursion { xavhome; };
<br>
version "NS.GROUMPF.ORG GROUMPF L'Internet Asocial";
<br>
};
<br>
<br>
What is the problem ? Permissions seem OK
<br>
<br>
This is an Ubuntu 22.04.4 Server LTS
<br>
<br>
Thanks,
<br>
<br>
Regards,
<br>
<br>
Xavier
<br>
<br>
</blockquote>
<p><br>
</p>
<div class="moz-signature">
<div><br>
Lep pozdrav / Best regards,<br>
--<br>
<table cellpadding="0" cellspacing="0" border="0" style="background: none; border-width: 0px; border: 0px; margin: 0; padding: 0;">
<tbody>
<tr>
<td valign="top" style="vertical-align: top; color: #666666; font-size: 12px; font-family: Arial, Helvetica, sans-serif;">
<span style="font-weight: bold;">Danilo Godec</span> |
Sistemska podpora / System Administration </td>
</tr>
<tr>
<td valign="top" style="vertical-align: top; color: #666666; font-size: 12px; font-family: Arial, Helvetica, sans-serif;">
<span style="font-weight: bold; color: #ed1c24">AGENDA
d.o.o.</span> | Ul. Pohorskega bataljona 49, Sl-2000
Maribor </td>
</tr>
<tr>
<td valign="top" style="vertical-align: top; color: #666666; font-size: 12px; font-family: Arial, Helvetica, sans-serif;">
<span style="font-weight: bold; color: #ed1c24">E:</span>
<a href="mailto:danilo.godec@agenda.si" class="moz-txt-link-freetext"> danilo.godec@agenda.si
</a> | <span style="font-weight: bold; color: #ed1c24">T:</span>
+386 (0)2 421 61 31 </td>
</tr>
<tr>
<td valign="top" style="vertical-align: top; color: #666666; font-size: 12px; font-family: Arial, Helvetica, sans-serif; padding-top: 12px;">
<a href="https://www.agenda.si/"> Agenda OpenSystems </a>
| Največji slovenski odprtokodni integrator </td>
</tr>
<tr>
<td valign="top" style="vertical-align: top; color: #666666; font-size: 12px; font-family: Arial, Helvetica, sans-serif;">
<a href="http://www.redhat.si/"> Red Hat v Sloveniji </a>
| Red Hat Premier Business Partner </td>
</tr>
<tr>
<td valign="top" style="vertical-align: top; color: #666666; font-size: 12px; font-family: Arial, Helvetica, sans-serif;">
<a href="http://elasticbox.eu/"> ElasticBox </a> |
Poslovne rešitve v oblaku </td>
</tr>
<tr>
<td valign="top" style="vertical-align: top; color: #666666; font-size: 12px; font-family: Arial, Helvetica, sans-serif; padding-top: 22px; padding-bottom: 22px;">
<a style="border: 0" href="https://www.agenda.si/"> <div><yuLfr5W60LvPgN12.webp></div> </a> </td>
</tr>
<tr>
<td valign="top" style="vertical-align: top; color: #666666; font-size: 12px; font-family: Arial, Helvetica, sans-serif;">
<a href="https://www.agenda.si/index.php?id=228"> Izjava
o omejitvi odgovornosti / Legal disclaimer statement </a>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<span>-- </span><br><span>Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.</span><br></div></blockquote></div></body></html>