Sven, thanks for the tip about AppArmor. Yet another presumably complicated system I've avoided learning about til now. I guess it's time.
As to why bind is trying to open /run/named/named.resolvers: that is a customized integration with resolvconf. It is not the default, but it is something I want to work. Or I need an alternate way to achieve the same functionality, which is that when resolvconf gets info on nameservers it passes that on to bind. Lee, I don't think this is a vanilla permission problem. As I thought the comments in the original indicated, ownership and permissions look as if they should be good for the bind user, and I even su'd to bind and was able to access one of the files that the bind daemon said it couldn't access. Ross
