Debian Bind9 chroot problems

eentonig · 07-30-2008, 04:10 PM

Hi all,

I have a Bind9 server running that works just fine. However, when I try to make it run in a chroot environment, I always fail to get it running.

Quote:

1 gauloises kernel: [180942.452046] audit(1217451274.744:5): type=1503 operation="inode_permission" requested_mask="::r" denied_mask="::r" name="/var/chroot/named/etc/localtime" pid=14130 profile="/usr/sbin/named" namespace="default"
1 gauloises kernel: [180942.453222] audit(1217451274.748:6): type=1503 operation="inode_permission" requested_mask="::r" denied_mask="::r" name="/var/chroot/named/etc/localtime" pid=14130 profile="/usr/sbin/named" namespace="default"
1 gauloises named: none:0: open: /etc/bind/named.conf: permission denied
1 gauloises named: loading configuration: permission denied
1 gauloises kernel: [180942.460655] audit(1217451274.756:7): type=1503 operation="inode_permission" requested_mask="::r" denied_mask="::r" name="/var/chroot/named/etc/localtime" pid=14131 profile="/usr/sbin/named" namespace="default"
1 gauloises kernel: [180942.460761] audit(1217451274.756:8): type=1503 operation="inode_permission" requested_mask="r::" denied_mask="r::" name="/var/chroot/named/etc/bind/named.conf" pid=14131 profile="/usr/sbin/named" namespace="default"
1 gauloises kernel: [180942.460812] audit(1217451274.756:9): type=1503 operation="inode_permission" requested_mask="::r" denied_mask="::r" name="/var/chroot/named/etc/localtime" pid=14131 profile="/usr/sbin/named" namespace="default"
1 gauloises kernel: [180942.461179] audit(1217451274.756:10): type=1503 operation="inode_permission" requested_mask="::r" denied_mask="::r" name="/var/chroot/named/etc/localtime" pid=14131 profile="/usr/sbin/named" namespace="default"
1 gauloises kernel: [180942.461221] audit(1217451274.756:11): type=1503 operation="inode_permission" requested_mask="::r" denied_mask="::r" name="/var/chroot/named/etc/localtime" pid=14131 profile="/usr/sbin/named" namespace="default"

Anybody any ideas where the problem might be? I've chowned the configuration files within the chroot to 'bind'. So in theory, there shouldn't be a permissions problem.

Update: Adding the config changes I did to get it chrooted.

Quote:

sudo mkdir -p /var/chroot/named
sudo cd /var/chroot/named/
sudo mkdir -p /var/chroot/named/etc
sudo mkdir /var/chroot/named/dev
sudo mkdir -p /var/chroot/named/var/cache/bind
sudo mkdir -p /var/chroot/named/var/run/bind/run
sudo mv /etc/bind /var/chroot/named/etc
sudo ln -s /var/chroot/named/etc/bind /etc/bind
sudo mknod /var/chroot/named/dev/null c 1 3
sudo mknod /var/chroot/named/dev/random c 1 8
sudo chmod 666 /var/chroot/named/dev/null /var/chroot/named/dev/random
sudo chown -R bind:bind /var/chroot/named/var/*
sudo chown -R bind:bind /var/chroot/named/etc/bind
sudo vi /etc/default/bind9
# changed "OPTIONS="-u bind" to
OPTIONS="-u bind -t /var/chroot/named"

0x29a · 09-24-2008, 10:39 AM

Hi ya,

I know you posted this a while ago so you may have already figured it out. I ran in to the same problem and it turned out that the answer here is that it's AppArmor that's causing you grief. Try stopping AppArmor then run named in your chroot environment again. I like to run my name server in /var/lib/named, so given my usr.sbin.named file below, I should be able to edit everything from line 18 down to point to the new locations.

For what it's worth, I haven't completely tinkered with my /etc/apparmor.d/usr.sbin.named file (I'm running ubuntu server 8.04.1), but I did change where bind logs to in named.conf. I had to give named access to that log file in usr.sbin.named. I'm sure I could get the chroot environment working again by more editing. I just haven't found the time.

Here's my /etc/apparmor.d/usr.sbin.named file. I've noted where I think the changes should be made.

Code:

# vim:syntax=apparmor
# Last Modified: Sun Sep 14 23:02:34 2008
#include <tunables/global>

/usr/sbin/named {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  capability net_bind_service,
  capability setgid,
  capability setuid,
  capability sys_chroot,

  # /etc/bind should be read-only for bind
  # /var/lib/bind is for dynamically updated zone (and journal) files.
  # /var/cache/bind is for slave/stub data, since we're not the origin of it.
  # See /usr/share/doc/bind9/README.Debian.gz

### Changing these to the chroot location is part of the solution. ###
  /etc/bind/** r,
  /var/lib/bind/** rw,
  /var/cache/bind/** rw,
###

# added 20080914 --amj to give named access to log file
  /var/log/named.log w,

### As are these, but I haven't tinkered with them yet ###
  /proc/net/if_inet6 r,
  /usr/sbin/named mr,
  /var/run/bind/run/named.pid w,
  # support for resolvconf
  /var/run/bind/named.options r,
###
}

I suspect that none of the edits need to be relative to the chroot environment.

Hope this helps,

Andrew