运行BIND9在Ubuntu 16.04 xenial的chroot中运行

我认为这个问题的核心就是关于如何运行chroot的更普遍的问题。
您准备的chroot目录必须包含运行时所需的所有文件，如果没有很好的文档logging，可以简单地观察chroot进程尝试使用哪些文件。

在这种特定情况下，错误消息表明某个库正在被dynamic加载，但该库不在那里（大概是因为该库是在chroot()调用之后加载的，而是库文件不存在于新的根。

错误消息不清楚细节，但它听起来像是一些encryption相关的扩展或somesuch（可能为openssl），这是在运行时dynamic加载。

由于分发者没有正确logging哪些文件需要被复制，所以我会build议使用strace来查看在错误发生之前它打开哪个文件。

首先，为了重现问题，我启动了一个Ubuntu 16.04实例，禁用了apparmor，并从Ubuntu的指导中完成了链接，并确保我得到了正确的错误：

 # named -g -f -u bind -t /chroot/named 01-Oct-2016 17:36:25.539 starting BIND 9.10.3-P4-Ubuntu <id:ebd72b3> -g -f -u bind -t /chroot/named 01-Oct-2016 17:36:25.539 built with '--prefix=/usr' '--mandir=/usr/share/man' '--libdir=/usr/lib/x86_64-linux-gnu' '--infodir=/usr/share/info' '--sysconfdir=/etc/bind' '--localstatedir=/' '--enable-threads' '--enable-largefile' '--with-libtool' '--enable-shared' '--enable-static' '--with-openssl=/usr' '--with-gssapi=/usr' '--with-gnu-ld' '--with-geoip=/usr' '--with-atf=no' '--enable-ipv6' '--enable-rrl' '--enable-filter-aaaa' '--enable-native-pkcs11' '--with-pkcs11=/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so' 'CFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -fno-strict-aliasing -fno-delete-null-pointer-checks -DNO_VERSION_DATE' 'LDFLAGS=-Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2 -DDIG_SIGCHASE' 01-Oct-2016 17:36:25.539 ---------------------------------------------------- 01-Oct-2016 17:36:25.539 BIND 9 is maintained by Internet Systems Consortium, 01-Oct-2016 17:36:25.539 Inc. (ISC), a non-profit 501(c)(3) public-benefit 01-Oct-2016 17:36:25.539 corporation. Support and training for BIND 9 are 01-Oct-2016 17:36:25.539 available at https://www.isc.org/support 01-Oct-2016 17:36:25.539 ---------------------------------------------------- 01-Oct-2016 17:36:25.539 adjusted limit on open files from 65536 to 1048576 01-Oct-2016 17:36:25.539 found 1 CPU, using 1 worker thread 01-Oct-2016 17:36:25.539 using 1 UDP listener per interface 01-Oct-2016 17:36:25.539 using up to 4096 sockets 01-Oct-2016 17:36:25.541 ENGINE_by_id failed (crypto failure) 01-Oct-2016 17:36:25.541 error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:233: 01-Oct-2016 17:36:25.541 error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:467: 01-Oct-2016 17:36:25.541 error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:390:id=gost 01-Oct-2016 17:36:25.541 initializing DST: crypto failure 01-Oct-2016 17:36:25.541 exiting (due to fatal error) # 

所以，下一步，只需要对它进行调整。 很多的输出，但它的最后一点：

 # strace named -g -f -u bind -t /chroot/named ... open("/usr/lib/ssl/openssl.cnf", O_RDONLY) = -1 ENOENT (No such file or directory) futex(0x7f61561bb0a8, FUTEX_WAKE_PRIVATE, 2147483647) = 0 open("/usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libgost.so", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) gettimeofday({1475343388, 821162}, NULL) = 0 open("/etc/localtime", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) write(2, "01-Oct-2016 17:36:28.821 ENGINE_"..., 6201-Oct-2016 17:36:28.821 ENGINE_by_id failed (crypto failure) ) = 62 gettimeofday({1475343388, 821239}, NULL) = 0 open("/etc/localtime", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) write(2, "01-Oct-2016 17:36:28.821 error:2"..., 11901-Oct-2016 17:36:28.821 error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:233: ) = 119 gettimeofday({1475343388, 821314}, NULL) = 0 open("/etc/localtime", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) write(2, "01-Oct-2016 17:36:28.821 error:2"..., 9801-Oct-2016 17:36:28.821 error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:467: ) = 98 gettimeofday({1475343388, 821376}, NULL) = 0 open("/etc/localtime", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) write(2, "01-Oct-2016 17:36:28.821 error:2"..., 10701-Oct-2016 17:36:28.821 error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:390:id=gost ) = 107 gettimeofday({1475343388, 821604}, NULL) = 0 open("/etc/localtime", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) write(2, "01-Oct-2016 17:36:28.821 initial"..., 5801-Oct-2016 17:36:28.821 initializing DST: crypto failure ) = 58 gettimeofday({1475343388, 821668}, NULL) = 0 open("/etc/localtime", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) write(2, "01-Oct-2016 17:36:28.821 exiting"..., 5401-Oct-2016 17:36:28.821 exiting (due to fatal error) ) = 54 exit_group(1) = ? +++ exited with 1 +++ 

所以，这一点似乎是什么问题的完美匹配，在此之后它开始打印错误消息。

 open("/usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libgost.so", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) 

那么，如果我们简单地将/usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/目录复制到设置为绑定的chroot目录下呢？

 # mkdir -p /chroot/named/usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines # cp -a /usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/* /chroot/named/usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/ 

（你可能想要考虑一些不同的方法，也许是一个绑定挂载？但是这些似乎是这种或那种方式需要在chroot中存在的文件）

在这一点上，我从named本身得到了完全自我解释的错误，通过将所有/etc/bind/而不是仅仅其中一个文件以及/var/cache/bind/目录复制到绑定chroot中，很容易解决。

在这之后：

 # named -g -f -u bind -t /chroot/named 01-Oct-2016 17:51:01.159 starting BIND 9.10.3-P4-Ubuntu <id:ebd72b3> -g -f -u bind -t /chroot/named 01-Oct-2016 17:51:01.159 built with '--prefix=/usr' '--mandir=/usr/share/man' '--libdir=/usr/lib/x86_64-linux-gnu' '--infodir=/usr/share/info' '--sysconfdir=/etc/bind' '--localstatedir=/' '--enable-threads' '--enable-largefile' '--with-libtool' '--enable-shared' '--enable-static' '--with-openssl=/usr' '--with-gssapi=/usr' '--with-gnu-ld' '--with-geoip=/usr' '--with-atf=no' '--enable-ipv6' '--enable-rrl' '--enable-filter-aaaa' '--enable-native-pkcs11' '--with-pkcs11=/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so' 'CFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -fno-strict-aliasing -fno-delete-null-pointer-checks -DNO_VERSION_DATE' 'LDFLAGS=-Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2 -DDIG_SIGCHASE' 01-Oct-2016 17:51:01.159 ---------------------------------------------------- 01-Oct-2016 17:51:01.159 BIND 9 is maintained by Internet Systems Consortium, 01-Oct-2016 17:51:01.159 Inc. (ISC), a non-profit 501(c)(3) public-benefit 01-Oct-2016 17:51:01.159 corporation. Support and training for BIND 9 are 01-Oct-2016 17:51:01.159 available at https://www.isc.org/support 01-Oct-2016 17:51:01.159 ---------------------------------------------------- 01-Oct-2016 17:51:01.159 adjusted limit on open files from 65536 to 1048576 01-Oct-2016 17:51:01.159 found 1 CPU, using 1 worker thread 01-Oct-2016 17:51:01.159 using 1 UDP listener per interface 01-Oct-2016 17:51:01.159 using up to 4096 sockets 01-Oct-2016 17:51:01.163 loading configuration from '/etc/bind/named.conf' 01-Oct-2016 17:51:01.164 reading built-in trusted keys from file '/etc/bind/bind.keys' 01-Oct-2016 17:51:01.164 GeoIP Country (IPv4) (type 1) DB not available 01-Oct-2016 17:51:01.164 GeoIP Country (IPv6) (type 12) DB not available 01-Oct-2016 17:51:01.164 GeoIP City (IPv4) (type 2) DB not available 01-Oct-2016 17:51:01.164 GeoIP City (IPv4) (type 6) DB not available 01-Oct-2016 17:51:01.164 GeoIP City (IPv6) (type 30) DB not available 01-Oct-2016 17:51:01.164 GeoIP City (IPv6) (type 31) DB not available 01-Oct-2016 17:51:01.164 GeoIP Region (type 3) DB not available 01-Oct-2016 17:51:01.164 GeoIP Region (type 7) DB not available 01-Oct-2016 17:51:01.164 GeoIP ISP (type 4) DB not available 01-Oct-2016 17:51:01.164 GeoIP Org (type 5) DB not available 01-Oct-2016 17:51:01.164 GeoIP AS (type 9) DB not available 01-Oct-2016 17:51:01.164 GeoIP Domain (type 11) DB not available 01-Oct-2016 17:51:01.164 GeoIP NetSpeed (type 10) DB not available 01-Oct-2016 17:51:01.164 using default UDP/IPv4 port range: [1024, 65535] 01-Oct-2016 17:51:01.165 using default UDP/IPv6 port range: [1024, 65535] 01-Oct-2016 17:51:01.165 listening on IPv6 interfaces, port 53 01-Oct-2016 17:51:01.166 listening on IPv4 interface lo, 127.0.0.1#53 01-Oct-2016 17:51:01.166 listening on IPv4 interface eth0, 172.31.2.127#53 01-Oct-2016 17:51:01.167 generating session key for dynamic DNS 01-Oct-2016 17:51:01.167 sizing zone task pool based on 5 zones 01-Oct-2016 17:51:01.169 using built-in root key for view _default 01-Oct-2016 17:51:01.169 set up managed keys zone for view _default, file 'managed-keys.bind' 01-Oct-2016 17:51:01.170 automatic empty zone: 10.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 16.172.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 17.172.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 18.172.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 19.172.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 20.172.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 21.172.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 22.172.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 23.172.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 24.172.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 25.172.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 26.172.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 27.172.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 28.172.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 29.172.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 30.172.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 31.172.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 168.192.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 64.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 65.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.170 automatic empty zone: 66.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 67.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 68.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 69.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 70.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 71.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 72.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 73.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 74.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 75.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 76.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 77.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 78.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 79.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 80.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 81.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 82.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 83.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 84.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 85.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 86.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 87.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.171 automatic empty zone: 88.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 89.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 90.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 91.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 92.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 93.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 94.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 95.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 96.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 97.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 98.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 99.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 100.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 101.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 102.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 103.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 104.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 105.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 106.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 107.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 108.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.172 automatic empty zone: 109.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 110.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 111.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 112.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 113.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 114.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 115.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 116.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 117.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 118.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 119.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 120.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 121.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 122.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 123.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 124.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 125.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 126.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 127.100.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 254.169.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 2.0.192.IN-ADDR.ARPA 01-Oct-2016 17:51:01.173 automatic empty zone: 100.51.198.IN-ADDR.ARPA 01-Oct-2016 17:51:01.174 automatic empty zone: 113.0.203.IN-ADDR.ARPA 01-Oct-2016 17:51:01.174 automatic empty zone: 255.255.255.255.IN-ADDR.ARPA 01-Oct-2016 17:51:01.174 automatic empty zone: 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA 01-Oct-2016 17:51:01.174 automatic empty zone: 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA 01-Oct-2016 17:51:01.174 automatic empty zone: DFIP6.ARPA 01-Oct-2016 17:51:01.174 automatic empty zone: 8.EFIP6.ARPA 01-Oct-2016 17:51:01.174 automatic empty zone: 9.EFIP6.ARPA 01-Oct-2016 17:51:01.174 automatic empty zone: AEFIP6.ARPA 01-Oct-2016 17:51:01.174 automatic empty zone: BEFIP6.ARPA 01-Oct-2016 17:51:01.174 automatic empty zone: 8.BD0.1.0.0.2.IP6.ARPA 01-Oct-2016 17:51:01.174 automatic empty zone: EMPTY.AS112.ARPA 01-Oct-2016 17:51:01.176 configuring command channel from '/etc/bind/rndc.key' 01-Oct-2016 17:51:01.176 command channel listening on 127.0.0.1#953 01-Oct-2016 17:51:01.176 configuring command channel from '/etc/bind/rndc.key' 01-Oct-2016 17:51:01.176 command channel listening on ::1#953 01-Oct-2016 17:51:01.176 the working directory is not writable 01-Oct-2016 17:51:01.176 not using config file logging statement for logging due to -g option 01-Oct-2016 17:51:01.176 managed-keys.bind.jnl: create: permission denied 01-Oct-2016 17:51:01.176 managed-keys-zone: sync_keyzone:dns_journal_open -> unexpected error 01-Oct-2016 17:51:01.176 managed-keys-zone: unable to synchronize managed keys: unexpected error 01-Oct-2016 17:51:01.177 zone 0.in-addr.arpa/IN: loaded serial 1 01-Oct-2016 17:51:01.178 zone 127.in-addr.arpa/IN: loaded serial 1 01-Oct-2016 17:51:01.179 zone localhost/IN: loaded serial 2 01-Oct-2016 17:51:01.180 zone 255.in-addr.arpa/IN: loaded serial 1 01-Oct-2016 17:51:01.181 all zones loaded 01-Oct-2016 17:51:01.181 running