Glenn English wrote: > apparmor. Ah! I would not have thought of that one. > In the recent Debians (Wheezy++, I think), there is a directory > /etc/apparmor.d. In there is a file called user.sbin.named. That Yes. But it isn't enabled by default. On a recently installed Debian Jessie 8 system: $ dpkg -l | grep apparmor $ Usually nothing is installed to start it. Perhaps something you installed pulled it in as a dependency? Looking I see one of my systems has libapparmor1 but it is still not enabled. So the presense of that one library would not be enough to start it. > After reboot, and after waiting a few minutes, there are no new > permission error entries in the log. I realize this is kind of far > fetched, seeing how there was no apparmor startup in init.d, but > this has been making me crazy, and I've tried many things that > should have fixed it, so I'd do anything. I really don't know very much about apparmor. > I found a note in the Debian wiki saying apparmor is installed by > default on Wheezy and that it's started by GRUB. That might explain > why I didn't find anything in init.d. I don't see it installed by default on the recently installed Jessie 8 system here. Just a data point. I wouldn't be surprised to find that something else (GNOME for example?) might pull it in as a dependency. > I don't know when Bind slaves try to update the mod times on their > zone files, but I'm pretty sure the master sends out refreshes to > the slaves when the master restarts, so I restarted the master. Lots > of entries in ns2's log about receiving notifies, but no permission > errors. Everything depends upon the DNS zone serial number. When the master restarts it will send a notify. The slaves will get the notify and check the serial number against their cached copy. If the serial number is the same or older then nothing further happens. If the serial number is newer than their cached copy they will request a scheduled zone transfer. It won't happen immediately to prevent a storm of activity all at once synchronized by the notify. But within a randomized short time a scheduled zone transfer will then occur. Bob
Attachment:
signature.asc
Description: Digital signature