Package: bind9 Version: 1:9.9.5.dfsg-12.1 When freeipa-server is setup, it configures Bind9 for dynamic zones from LDAP using GSSAPI bind. Unfortunately these actions are not allowed in Apparmor policy.
These rules needs to be added: # gssapi /var/lib/sss/pubconf/krb5.include.d/** r, /var/lib/sss/pubconf/krb5.include.d/ r, /var/lib/sss/mc/initgroups r, /etc/gss/mech.d/ r, # ldap /etc/ldap/ldap.conf r, /run/slapd-*.socket rw, # dynamic updates /var/tmp/DNS_* rw, I have submitted fixed package to mentors here: http://mentors.debian.net/package/bind9 Filip
signature.asc
Description: Digital signature
