Fedora Account System
Red Hat Associate
Red Hat Customer
Some SE policy change has blocked BIND name server from accessing /var/named So BIND cannot run. (Unfortunately for me, I didn't notice for a week.) The log is very nice. I even gives the solution Key message: SELinux is preventing isc-net-0000 from write access on the directory /var/named. fix suggested: setsebool -P named_write_master_zones 1 Seems to work. I'm not the only one who has encountered this problem. See https://discussion.fedoraproject.org/t/bind-no-longer-starting-on-boot-with-f37/74978/5 Reproducible: Always Steps to Reproduce: 1.on a Fedora 36 installation that uses BIND 2.upgrade to Fedora 37 or 38 Actual Results: BIND fails each time it tries to start: May 23 03:07:25 XXXX audit[766]: AVC avc: denied { write } for pid=766 comm="isc-net-0000" name="named" dev="sda3" ino=2886559 scontext=system_u:system_r:named_t:s0 tcontext=system_u:object_r:named_zone_t:s0 tclass=dir permissive=0 May 23 03:07:25 XXXX named[766]: directory '/var/named' is not writable May 23 03:07:25 XXXX named[766]: /etc/named.conf:14: parsing failed: permission denied May 23 03:07:25 XXXX named[766]: loading configuration: permission denied May 23 03:07:25 XXXX named[766]: exiting (due to fatal error) Expected Results: BIND loads correctly
I've just installed a fresh F36 system, the named_write_master_zones boolean is turned on. After an update to F38 there is no change. $ rpm -qa bind* bind-license-9.18.15-1.fc38.noarch bind-libs-9.18.15-1.fc38.x86_64 bind-utils-9.18.15-1.fc38.x86_64 bind-dnssec-utils-9.18.15-1.fc38.x86_64 bind-9.18.15-1.fc38.x86_64 bind-chroot-9.18.15-1.fc38.x86_64 Was your system's first installation earlier?
I think that Fedora was first installed on my machine in January 2021. From that, I deduce that it must have been Fedora 31. I don't remember the upgrade steps. At least one other time it was a two-version step.
The named_write_master_zones tunable default value changed to on in 2018, so any system installed after that should have it turned on. Were there any customizations made on your system prior the update? # semanage export
# semanage export boolean -D login -D interface -D user -D port -D node -D fcontext -D module -D ibendport -D ibpkey -D permissive -D boolean -m -1 named_write_master_zones boolean -m -1 virt_sandbox_use_all_caps boolean -m -1 virt_use_nfs #
(In reply to D. Hugh Redelmeier from comment #4) > boolean -m -1 named_write_master_zones Since turning this boolean on is required, I suppose this is the state after manually running setsebool.
yes, #4 reflected the state after the boolean was manually set. I don't have access to the state before I manually set the boolean.
On a numerous tests, no problem appeared during testing F37->F38 upgrade. I've just tried F31->F33->F35->F37->F38 update and did not encounter any issue. If I understand this correctly, such a problem may appear on system installed more than 6 years ago, or when some related customization was made.
(In reply to Zdenek Pytela from comment #7) > On a numerous tests, no problem appeared during testing F37->F38 upgrade. > I've just tried F31->F33->F35->F37->F38 update and did not encounter any > issue. > > If I understand this correctly, such a problem may appear on system > installed more than 6 years ago, or when some related customization was made. Thanks for trying to replicate. The problem is solved for me. I guess there is no need to put more effort into this. Close this if you wish to. This BZ may be useful for others that do stumble into this problem.
Agree it is good we have this bz reported and the issue hopefully is isolated. There is the solution already mentioned by setroubleshoot, so should not be much of a problem. One thing though is that I don't see what other help we could provide in these cases, the other is have it confirmed. You mentioned "it must have been Fedora 31", is it possible it actually was F29 or earlier?
(In reply to Zdenek Pytela from comment #9) > Agree it is good we have this bz reported and the issue hopefully is > isolated. There is the solution already mentioned by setroubleshoot, so > should not be much of a problem. One thing though is that I don't see what > other help we could provide in these cases, the other is have it confirmed. > You mentioned "it must have been Fedora 31", is it possible it actually was > F29 or earlier? BIND was working fine before I did an upgrade from F36 -> F38 via DNF. Since the problem was observed by Jim Hood after an upgrade from F36 -> F37, I inferred that the problem was in that step. My system was moderately customized by me to act as a gateway (router, DNS server, mail server, etc.) for my home. But I probably had not customized SELinux since I don't really know how to do that with finesse.
(In reply to D. Hugh Redelmeier from comment #10) > BIND was working fine before I did an upgrade from F36 -> F38 via DNF. I looked more closely at the logs to check that what I said was precisely correct. BIND was working through the end of F36 on my machine. It worked after the final updates in preparation to the version upgrade. BIND failed on the first boot of F38.
Given the current state of investigation, I am going to close this bz. If any new related information appears, feel free to reopen it or create a new one.