Unable to start bind or apparmor warnings on Plesk Ubuntu/Debian server: loading configuration from ‘/etc/named.conf’ loading configuration: permission denied

Symptoms

• Unable to start bind9

• Errors like the following in the system log /var/log/syslog:

  named[8362]: loading configuration from '/etc/named.conf'
  named[8362]: open: /etc/named.conf: permission denied
  named[8362]: loading configuration: permission denied
  named[8362]: exiting (due to fatal error)
  kernel: [34074.383056] type=1400 audit(1494212104.678:254): apparmor="DENIED" operation="open" profile="/usr/sbin/named" name="/var/named/run-root/etc/named.conf" pid=8363 comm="named" requested_mask="r" denied_mask="r" fsuid=107 ouid=0

Cause

AppArmor prevent bind9/named from reading DNS server configuration files

Resolution

1. Connect to the server via SSH

2. Edit file /etc/apparmor.d/local/usr.sbin.named file in any text editor

3. Add the following into /etc/apparmor.d/local/usr.sbin.named file:

   /var/named/run-root/** rwm,

4. Ensure that include <local/usr.sbin.named> directive is not commented with # in /etc/apparmor.d/usr.sbin.named

   # tail -3 /etc/apparmor.d/usr.sbin.named
   # Site-specific additions and overrides. See local/README for details.
   include <local/usr.sbin.named>
   }

5. Reload AppArmor:

   # systemctl reload apparmor

6. Start bind9 service:

   # systemctl restart bind9