Description of problem: This looks to be an SELinux policy issue. #============= named_t ============== allow named_t dnssec_trigger_var_run_t:file write; type=AVC msg=audit(1419349428.210:456): avc: denied { write } for pid=1777 comm="unbound-control" path="/run/dnssec-trigger/lock" dev="tmpfs" ino=19158 scontext=system_u:system_r:named_t:s0 tcontext=system_u:object_r:dnssec_trigger_var_run_t:s0 tclass=file permissive=0 Version-Release number of selected component: dnssec-trigger-0.12-15.fc21 Additional info: reporter: libreport-2.3.0 cmdline: /usr/bin/python /usr/libexec/dnssec-trigger-script --update dso_list: python-libs-2.7.8-7.fc21.x86_64 executable: /usr/libexec/dnssec-trigger-script kernel: 3.17.3-300.fc21.x86_64 runlevel: N 5 type: Python uid: 0 Truncated backtrace: subprocess.py:540:check_call:CalledProcessError: Command '['unbound-control', 'flush_zone', '.']' returned non-zero exit status 1 Traceback (most recent call last): File "/usr/libexec/dnssec-trigger-script", line 480, in <module> Application(sys.argv).run() File "/usr/libexec/dnssec-trigger-script", line 379, in run self.method() File "/usr/libexec/dnssec-trigger-script", line 427, in run_update self.run_update_global_forwarders() File "/usr/libexec/dnssec-trigger-script", line 439, in run_update_global_forwarders subprocess.check_call(["unbound-control", "flush_zone", "."]) File "/usr/lib64/python2.7/subprocess.py", line 540, in check_call raise CalledProcessError(retcode, cmd) CalledProcessError: Command '['unbound-control', 'flush_zone', '.']' returned non-zero exit status 1 Local variables in innermost frame: cmd: ['unbound-control', 'flush_zone', '.'] retcode: 1 popenargs: (['unbound-control', 'flush_zone', '.'],) kwargs: {}
Created attachment 972535 [details] File: backtrace
Created attachment 972536 [details] File: environ
Running selinux-policy-3.13.1-103.fc21
c3a68da7f1ca09c95747480655044857ac46f452 allows this in git.
selinux-policy-3.13.1-105.fc21 has been submitted as an update for Fedora 21. https://admin.fedoraproject.org/updates/selinux-policy-3.13.1-105.fc21
Package selinux-policy-3.13.1-105.fc21: * should fix your issue, * was pushed to the Fedora 21 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.13.1-105.fc21' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2015-1337/selinux-policy-3.13.1-105.fc21 then log in and leave karma (feedback).
selinux-policy-3.13.1-105.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.