named the working directory is not writable

Question

I am trying to setup Bind9 on Debian Jessie as described by Debian's Wiki. When I finish, and attempt to start BIND (service bind9 start), I get the dreaded FAIL message. Below is the tail of my /var/log/syslog:

...
Jul  5 20:23:16 debian named[8309]: command channel listening on 127.0.0.1#953
Jul  5 20:23:16 debian named[8309]: the working directory is not writable
Jul  5 20:23:16 debian named[8309]: isc_stdio_open '/var/log/update_debug.log' failed: permission denied
Jul  5 20:23:16 debian named[8309]: configuring logging: permission denied
Jul  5 20:23:16 debian named[8309]: loading configuration: permission denied
Jul  5 20:23:16 debian named[8309]: exiting (due to fatal error)

I can't seem to get passed here. I created the chroot directory structure, double-checked the permissions and commands were run in order, but no change.

What can I do to continue? I do not have SELinux enabled on this system.

Solution 1

The "working directory is not writable" message is a warning, not really related to the fatal errors that follow. You can silence that message by fixing the permissions on the base directory (which appears to be set to /var/bind9/chroot/var/cache/bind by the directions on that wiki page) but there's no real need to and it's safer to NOT fix it.

The fatal error is the inability to create the file that named thinks is /var/log/update_debug.log but is in fact /var/bind9/chroot/var/log/update_debug.log. I expect this will solve that problem:

mkdir /var/bind9/chroot/var/log
chown bind:bind /var/bind9/chroot/var/log

Solution 2

The correct directory on standard debian bind9 builds is: /var/cache/bind

chown -R bind:root /var/cache/bind
rndc reload or service bind9 reload
tail -f /var/log/syslog

No more errors.

If running chrooted it will depend where you set your directories to, but the principle is the same.  

Comments

[Bill Cole]

1. /var/named/ and /etc/mtree/BIND.chroot.dist are FreeBSD-isms. The OP is using a Debian Wiki How-To that puts the chroot at /var/bind9/ and describes the entirely manual chroot setup one must do on Linux. 2. "working directory is not writable" is a warning, not a fatal error. The fatal error is in the logging setup. 3. The base directory is not writable by the 'bind' user for a sound security reason: a RCE bug in named would put the whole tree under it at risk.