Ubuntu 8.04 Hardy Heron server: inode_permission” requested_mask=”a::”

Spacetrucker · 10-27-2008, 07:23 PM

I have two questions. And, I'm logged in as root as I do this stuff.

One:
I'm trying to setup logging on our DNS server. I have the following msg in syslog. Can somebody clue me in as to what I may need to do to fix it? I'm guessing it has something to do with umask.

kernel: audit : type=1503 operation=”inode_permission” requested_mask=”a::” name=”/var/log/query.log” pid=5819 profile=”/usr/sbin/named” namespace=”default”

named: logging channel ‘query’ file ‘/var/log/query.log’: permission denied

I searched the forum and found a thread about Apparmor being the culprit so I set it to complain mode, restarted named, but no joy.

Here's my logging statement straight out of Ubuntu's documentation.

logging {
channel query.log {
file "/var/log/query.log";
// Set the severity to dynamic to see all the debug messages.
severity debug 3;
};

category queries { query.log; };
};

ls -al /var/log/query.log
returns
-rw-r--r-- 1 bind bind 0 date time query.log

I've also tried this statement out of Mark Sobell's "A Practical Guide to Ubuntu Linux" book. No joy.
Should either one of these statements work once I have the "permissions denied" problem resolved?

logging {
channel "query" {
file "/var/log/query.log";
// Set the severity to dynamic to see all the debug messages.
severity debug 3;
};

category queries { "query"; };

};

Two:
Why can't I view the contents of usr.sbin.named?
When I run the cmd "more /etc/usr.sbin.named" it returns "No such file or directory."
ls -al /etc/usr.sbin.named
returns
-rw-r--r-- 1 root root 742 date time usr.sbin.named

estabroo · 10-27-2008, 09:26 PM

Shouldn't the usr.bin.named file be in /etc/apparmor.d/ instead of /etc

Spacetrucker · 10-28-2008, 03:07 PM

Yes, my mistake. It is in /etc/apparmor.d.

estabroo · 10-28-2008, 06:48 PM

This is the contents of my /etc/apparmor.d/usr.sbin.named

Code:

# vim:syntax=apparmor
# Last Modified: Fri Jun  1 16:43:22 2007
#include <tunables/global>

/usr/sbin/named {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  capability net_bind_service,
  capability setgid,
  capability setuid,
  capability sys_chroot,

  # /etc/bind should be read-only for bind
  # /var/lib/bind is for dynamically updated zone (and journal) files.
  # /var/cache/bind is for slave/stub data, since we're not the origin of it.
  # See /usr/share/doc/bind9/README.Debian.gz
  /etc/bind/** r,
  /var/lib/bind/** rw,
  /var/cache/bind/** rw,

  /proc/net/if_inet6 r,
  /usr/sbin/named mr,
  /var/run/bind/run/named.pid w,
  # support for resolvconf
  /var/run/bind/named.options r,
}

Spacetrucker · 10-29-2008, 05:56 PM

The problem is with apparmor, with it disabled, no problems. My usr.sbin.named file is almost identical to yours. The exception, I added the line /var/log/** rw,

Do you have logging setup in named.conf.local?

estabroo · 10-29-2008, 07:44 PM

No, mine appears to log through syslog instead of directly to a file. I have no additional logging parameters set up.

Spacetrucker · 10-30-2008, 10:32 AM

I've read that's logging to syslog is the default action if you don't have logging setup. If you have any other idea's or come across a thread or link the might be helpful let me know.