named "the working directory is not writable"

[panamajo]

Hi,

obige Meldung sehe ich in /var/log/messages wenn bind9 startet. Lt. Google liegt das an falschen Owner/Group der chroot Umgebung unter /var/lib/named und dort um die var Directorystruktur.

Leider habe ich nichts openSUSE spezifisches gefunden und von der Totschlag "Lösung" alles in dem Verzeichnis per

chown -R named:named var

wird abgeraten.

Kann jemand mit funktionierendem named die Ausgabe mit meiner vergleichen:

root@holos:/var/lib/named/var# ls -aRl .
.:
total 0
drwxr-xr-x  4 root root  36 Oct 19  2012 .
drwxr-xr-x 10 root root 148 Oct 19  2012 ..
drwxr-xr-x  2 root root  18 Oct 19  2012 lib
lrwxrwxrwx  1 root root   6 Oct 19  2012 log -> ../log
drwxr-xr-x  3 root root  18 Oct 11  2012 run

./lib:
total 0
drwxr-xr-x 2 root root 18 Oct 19  2012 .
drwxr-xr-x 4 root root 36 Oct 19  2012 ..
lrwxrwxrwx 1 root root  5 Oct 19  2012 named -> ../..

./run:
total 0
drwxr-xr-x 3 root  root  18 Oct 11  2012 .
drwxr-xr-x 4 root  root  36 Oct 19  2012 ..
drwxr-xr-x 2 named named 40 Feb  3 14:18 named

./run/named:
total 8
drwxr-xr-x 2 named named  40 Feb  3 14:18 .
drwxr-xr-x 3 root  root   18 Oct 11  2012 ..
-rw-r--r-- 1 named named   5 Feb  3 14:18 named.pid
-rw------- 1 named named 102 Feb  3 14:18 session.key

TIA

 

[spoensche]

Mit welchen Parametern startest du den Bind? /var/lib/named/var/log ist ein Symlink auf /var/lib/named/log. Existiert das Verzeichnis /var/lib/named/log?

 

[panamajo]

Mit welchen Parametern startest du den Bind?

Ganz normal über SYSV init, /usr/sbin/rcnamed liest dann die Konfiguration:

jo@holos:/etc/sysconfig$ cat named
[...]
# "-t /var/lib/named/var" is added if NAMED_RUN_CHROOTED is set to yes.
#
# "-u named" is used in any case by the init script to run the named daemon as
# user 'named' after completing privileged operations.
#
NAMED_ARGS=""

/var/lib/named/var/log ist ein Symlink auf /var/lib/named/log. Existiert das Verzeichnis /var/lib/named/log?

Ja

jo@holos:/var/lib/named$ l
total 16
drwxr-xr-x  10 root  root   148 Oct 19  2012 ./
drwxr-xr-x  77 root  root  4096 Feb  7 00:22 ../
-rw-r--r--   1 root  root   192 Nov 19  2009 127.0.0.zone
drwxr-xr-x   2 root  root    40 Feb  3 14:18 dev/
drwxr-xr-x   2 named named    6 Oct 11  2012 dyn/
drwxr-xr-x   3 root  root    93 Feb  3 14:18 etc/
-rw-r--r--   1 root  root   182 Nov 19  2009 localhost.zone
drwxr-xr-x   2 named named   22 Oct 11  2012 log/
drwxr-xr-x   2 root  root    35 Oct 11  2012 master/
dr-xr-xr-x 243 root  root     0 Feb  3 15:17 proc/
-rw-r--r--   1 root  root  3048 Oct 11  2012 root.hint
drwxr-xr-x   2 named named    6 Oct 11  2012 slave/
drwxr-xr-x   4 root  root    36 Oct 19  2012 var/

 

[spoensche]

Starte den Bind mal mit

named -u named -t /var/lib/named -c /named.conf

 

[panamajo]

Starte den Bind mal mit

named -u named -t /var/lib/named -c /named.conf

Das geht natürlich, aber ich will den named openSUSE konform in einer chroot Umgebung laufen lassen.

 

[TomcatMJ]

Also auf meinem Install,server (opensuse 12.1) läuft der named einwandfrei unter folgenden Einstellungen/Dateirechten:
Verzeichnis+Dateirechte:

mosnis:/var/lib/named/var # ls -aRl .
.:
insgesamt 16
drwxr-xr-x  4 root root 4096  2. Feb 18:06 .
drwxr-xr-x 12 root root 4096  2. Feb 18:56 ..
drwxr-xr-x  2 root root 4096  2. Feb 18:06 lib
lrwxrwxrwx  1 root root    6  2. Feb 18:06 log -> ../log
drwxr-xr-x  3 root root 4096 27. Mär 2013  run

./lib:
insgesamt 8
drwxr-xr-x 2 root root 4096  2. Feb 18:06 .
drwxr-xr-x 4 root root 4096  2. Feb 18:06 ..
lrwxrwxrwx 1 root root    5  2. Feb 18:06 named -> ../..

./run:
insgesamt 12
drwxr-xr-x 3 root  root  4096 27. Mär 2013  .
drwxr-xr-x 4 root  root  4096  2. Feb 18:06 ..
drwxr-xr-x 2 named named 4096  2. Feb 21:13 named

./run/named:
insgesamt 16
drwxr-xr-x 2 named named 4096  2. Feb 21:13 .
drwxr-xr-x 3 root  root  4096 27. Mär 2013  ..
-rw-r--r-- 1 named named    5  2. Feb 21:13 named.pid
-rw------- 1 named named  102  2. Feb 21:13 session.key

Laufender Prozess samt Aufrufoptionen:

mosnis:/var/lib/named/var # ps ax|grep named
 4813 ?        Ssl   23:12 /usr/sbin/named -t /var/lib/named -u named

Sysconfig-Einstellungen:

/
mosnis:/etc/sysconfig # cat named
## Path: Network/DNS/Name Server
## Description: Names server settings
## Type: yesno
## Default: yes
## ServiceRestart: lwresd,named
#
# Shall the DNS server 'named' or the LightWeight RESolver Daemon, lwresd run
# in the chroot jail /var/lib/named/?
#
# Each time you start one of the daemons with the init script, /etc/named.conf,
# /etc/named.conf.include, /etc/rndc.key, and all files listed in
# NAMED_CONF_INCLUDE_FILES will be copied relative to /var/lib/named/.
#
# The pid file will be in /var/lib/named/var/run/named/ and named named.pid
# or lwresd.pid.
#
NAMED_RUN_CHROOTED="yes"

## Type: string
## Default: ""
## ServiceRestart: lwresd,named
#
# Additional arguments when starting the name daemon with the init script
# /etc/init.d/named or rcnamed.
#
# For example "-n 2" to use two CPUs if named is unable to determine the
# number of available CPUs.
#
# See man 8 named for all available commandline options.
#
# "-t /var/lib/named/var" is added if NAMED_RUN_CHROOTED is set to yes.
#
# "-u named" is used in any case by the init script to run the named daemon as
# user 'named' after completing privileged operations.
#
NAMED_ARGS=""
## Type: string
## Default: ""
## ServiceReload: named
#
# All mentioned config files will be copied relativ to /var/lib/named/, when
# 'named' is started in the chroot jail.
#
# /etc/named.conf and /etc/rndc.key are always copied.  Also all files from
# include statements in named.conf.
#
# Filenames can be relative to /etc/named.d/.
#
# Please take care of the order if one file needs a setting of another.
#
# Example: "/etc/named-dhcpd.key ldap.dump rndc-access.conf"
#
NAMED_CONF_INCLUDE_FILES="/etc/named.d/mosnisddnskey"

## Type: string
## Default: "createNamedConfInclude"
## ServiceReload: named
#
# Programms to be executed each time the DNS server 'named' is started or
# reloaded.
#
# Filenames can be relative to /usr/share/bind/.
#
NAMED_INITIALIZE_SCRIPTS="createNamedConfInclude"

 

[panamajo]

@TomcatMJ: THX
Die Einstellungen/Berechtigungen sind bis ins Detail mit meinen identisch. Du nutzt named und die o.g. Fehlermeldung nicht?

 

[TomcatMJ]

Ich nutze named hier mit den genannten Einstellungen und ein grep auf /var/log/messages nach "writeable" ergbit null komma gar nix und named meldet sich da nur wenn er eine Domain trotz Abfrage der forwarders nicht finden kann bzw. ein dadrüber angefragter Nameserver mal wieder abgetaucht ist. Also ganz normaler Betrieb der hier damit funktioniert.

Edit:Nutzt du auch die dyndns-Fähigkeiten des named? Vielleicht hakt es da ja bei den Dateirechten der zu verwendenden Zonefiles?
Edit2: Mal zum gegenchecken(Zonefiles in /var/lib/named/dyn gehören auch alle named.named):

mosnis:/var/lib/named # ls -al
insgesamt 56
drwxr-xr-x  12 root  root  4096  2. Feb 18:56 .
drwxr-xr-x 108 root  root  4096 18. Feb 16:00 ..
-rw-r--r--   1 root  root   192 19. Nov 2009  127.0.0.zone
drwxr-xr-x   2 root  root  4096  2. Feb 21:08 dev
drwxr-xr-x   2 named named 4096 27. Mär 2013  dyn
drwxr-xr-x   4 root  root  4096  2. Feb 21:13 etc
drwxr-xr-x   3 root  root  4096  3. Dez 2011  lib
drwxr-xr-x   3 root  root  4096  3. Dez 2011  lib64
-rw-r--r--   1 root  root   182 19. Nov 2009  localhost.zone
drwxr-xr-x   2 named named 4096 27. Mär 2013  log
drwxr-xr-x   2 root  root  4096 27. Mär 2013  master
dr-xr-xr-x 207 root  root     0  2. Feb 22:08 proc
-rw-r--r--   1 root  root  3048 27. Mär 2013  root.hint
drwxr-xr-x   2 named named 4096 27. Mär 2013  slave
drwxr-xr-x   4 root  root  4096  2. Feb 18:06 var

Edit3:Hier noch die relevanten Pakete die auf meinem Installserver (opensuse 12.1 64 Bit) installiert sind (vielleicht fehlt da was bei deinem Server):

bind-doc-9.8.4P2-4.32.1.noarch
bind-9.8.4P2-4.32.1.x86_64
bind-chrootenv-9.8.4P2-4.32.1.x86_64
bind-libs-9.8.4P2-4.32.1.x86_64
bind-utils-9.8.4P2-4.32.1.x86_64
bind-libs-32bit-9.8.4P2-4.32.1.x86_64

 

[panamajo]

Die Pakete passen soweit bis auf die -32bit Version. Daran dürfte es ja nicht liegen.

Aber ich habe in /var/lib/named keine Verzeichnisse lib*. Von welchem Paket werden die bei dir angelegt und was ist da drin?

 

[TomcatMJ]

Dadrin sind ein paar Libraries die von libopenssl angelegt werden.

mosnis:/var/lib/named # ls -lR lib
lib:
insgesamt 4
drwxr-xr-x 2 root root 4096  3. Dez 2011  engines

lib/engines:
insgesamt 284
-r-xr-xr-x 1 root root 18300  2. Feb 21:13 lib4758cca.so
-r-xr-xr-x 1 root root 14384  2. Feb 21:13 libaep.so
-r-xr-xr-x 1 root root 14300  2. Feb 21:13 libatalla.so
-r-xr-xr-x 1 root root  5452  2. Feb 21:13 libcapi.so
-r-xr-xr-x 1 root root 22712  2. Feb 21:13 libchil.so
-r-xr-xr-x 1 root root 18468  2. Feb 21:13 libcswift.so
-r-xr-xr-x 1 root root  5448  2. Feb 21:13 libgmp.so
-r-xr-xr-x 1 root root 94660  2. Feb 21:13 libgost.so
-r-xr-xr-x 1 root root 10156  2. Feb 21:13 libnuron.so
-r-xr-xr-x 1 root root 13932  2. Feb 21:13 libpadlock.so
-r-xr-xr-x 1 root root 22604  2. Feb 21:13 libsureware.so
-r-xr-xr-x 1 root root 18468  2. Feb 21:13 libubsec.so
mosnis:/var/lib/named # ls -lR lib64
lib64:
insgesamt 4
drwxr-xr-x 2 root root 4096  3. Dez 2011  engines

lib64/engines:
insgesamt 288
-r-xr-xr-x 1 root root 19440  2. Feb 21:13 lib4758cca.so
-r-xr-xr-x 1 root root 19672  2. Feb 21:13 libaep.so
-r-xr-xr-x 1 root root 15424  2. Feb 21:13 libatalla.so
-r-xr-xr-x 1 root root  6104  2. Feb 21:13 libcapi.so
-r-xr-xr-x 1 root root 24120  2. Feb 21:13 libchil.so
-r-xr-xr-x 1 root root 23808  2. Feb 21:13 libcswift.so
-r-xr-xr-x 1 root root  6104  2. Feb 21:13 libgmp.so
-r-xr-xr-x 1 root root 97312  2. Feb 21:13 libgost.so
-r-xr-xr-x 1 root root 15328  2. Feb 21:13 libnuron.so
-r-xr-xr-x 1 root root  6104  2. Feb 21:13 libpadlock.so
-r-xr-xr-x 1 root root 23960  2. Feb 21:13 libsureware.so
-r-xr-xr-x 1 root root 19648  2. Feb 21:13 libubsec.so
mosnis:/var/lib/named # rpm -q --whatprovides  libgost.so
libopenssl1_0_0-32bit-1.0.0k-34.20.1.x86_64
mosnis:/var/lib/named # rpm -q --whatprovides  libaep.so
libopenssl1_0_0-32bit-1.0.0k-34.20.1.x86_64
mosnis:/var/lib/named # rpm -q --whatprovides  libatalla.so
libopenssl1_0_0-32bit-1.0.0k-34.20.1.x86_64
...

 

[larsm]

/usr/share/doc/packages/bind/README.SUSE aus dem Paket bind-utils sagt unter anderem:

### Zitat Anfang

File permissions
----------------

The BIND daemon process 'named' runs by default in a chroot jail,
/var/lib/named/ and as user 'named'. You could disable the chroot behaviour by
setting NAMED_RUN_CHROOTED with the YaST sysconfig or any editor in
/etc/sysconfig/named to "no".

The BIND package uses by default /var/lib/named/ to store its zone files.

For security reasons 'named' runs as user 'named' and the name server
directory is owned by user and group root. Therefore slave zone files can only
be stored at /var/lib/named/slave/, because this directory is owned by user
'named'.

The same applies to dynamically updated zones. Here the zone and the journal
files must be owned by 'named' to allow the 'named' process to write these
files. From time to time as an intermediate step 'named' dumps the current
content of the journal to a new created temporary file.

If you use dynamic updated zones, you must change the file definition of the
concerned zone to use the subdirectory /var/lib/named/dyn/ like in the
following example.

zone "example.net" IN {
type master;
file "dyn/example.net.zone";
#[ other unlisted options ]
};

The owner of /etc/named.conf is set to root:named and to permissions 0640 by
default. By this only root can change the file, user named and the 'named'
process can read, but others can't access the file. This is indispensable if
the configuration file contains shared secrets for zone updates. Ensure that
all 'named' configuration files are readable either by the user or group
'named'.

### Zitat Ende

Die beschränkenden Rechte von /var/lib/named/ auf 0755 root:root sind absichtlich
gewählt.

Für dynamisch zu aktualisierende Zonen gibt es /var/lib/named/dyn/ mit 0755 und
user:group named:named bzw für sekundär gehaltene Zonen /var/lib/named/slave.