今天在ubuntu10.04上配置dns主从区域数据传送时 从服务器学习不到主服务器的配置，查看/var/log/messages时显示为

Aug 1 06:42:45 ubuntu kernel: [ 5397.159601] type=1503 audit(1406900565.661:37): operation="mknod" pid=2351 parent=1 profile="/usr/sbin/named" requested_mask="c::" denied_mask="c::" fsuid=121 ouid=121 name="/etc/bind/slaves/tmp-Gyllksio7F"

一头雾水。。。。

查看/var/log/syslog时 显示

Aug 1 06:45:47 ubuntu named[2350]: reloading configuration succeeded
Aug 1 06:45:47 ubuntu named[2350]: any newly configured zones are now loaded
Aug 1 06:45:47 ubuntu named[2350]: zone langbing.com/IN: Transfer started.
Aug 1 06:45:47 ubuntu named[2350]: transfer of 'langbing.com/IN' from 192.168.1.103#53: connected using 192.168.1.104#35568
Aug 1 06:45:47 ubuntu named[2350]: dumping master file: /etc/bind/slaves/tmp-CKgYPEoetS: open:permission denied
Aug 1 06:45:47 ubuntu named[2350]: transfer of 'langbing.com/IN' from 192.168.1.103#53: failed while receiving responses: permission denied
Aug 1 06:45:47 ubuntu named[2350]: transfer of 'langbing.com/IN' from 192.168.1.103#53: Transfer completed: 0 messages, 7 records, 0 bytes, 0.009 secs (0 bytes/sec)

原来是权限的问题

但是 目录已经给了可写的权限，却仍然被告诉没有写权限，上网查到一篇博客(http://blog.sina.com.cn/s/blog_541a3cf10101c70b.html)说是原始写目录被AppArmor服务保护了(不知道是什么玩意儿。。。)，需要在/etc/apparmor.d/usr.sbin.named目录下添加目录的写权限

/etc/bind/slave/** rw, /etc/bind/slave/ rw,
重启apparmor服务 /etc/init.d/apparmor restart
最后运行rndc reconfig显示Aug 1 06:49:28 ubuntu named[2559]: reloading configuration succeeded
Aug 1 06:49:28 ubuntu named[2559]: any newly configured zones are now loaded
Aug 1 06:49:28 ubuntu named[2559]: zone langbing.com/IN: Transfer started.
Aug 1 06:49:28 ubuntu named[2559]: transfer of 'langbing.com/IN' from 192.168.1.103#53: connected using 192.168.1.104#45509
Aug 1 06:49:28 ubuntu named[2559]: zone langbing.com/IN: transferred serial 10
Aug 1 06:49:28 ubuntu named[2559]: transfer of 'langbing.com/IN' from 192.168.1.103#53: Transfer completed: 1 messages, 7 records, 203 bytes, 0.052 secs (3903 bytes/sec)
Aug 1 06:49:28 ubuntu named[2559]: zone langbing.com/IN: sending notifies (serial 10)


OK...