DHCPD unable to Add Forward map (SERVFAIL) - dns

Question

I've just setup a home server (Ubuntu Server 14) and have configured DNS and DHCP. It all works fine except DDNS. /var/logs/syslog is reporting the following when a new DHCPREQUEST is made:
Jul 25 23:20:14 ns.lan dhcpd: DHCPREQUEST for 192.168.1.73 from <mac> (<hostname>) via eth0
Jul 25 23:20:14 ns.lan dhcpd: DHCPACK on 192.168.1.73 to <mac> (<hostname>) via eth0
Jul 25 23:20:14 ns.lan dhcpd: Unable to add forward map from <hostname>.lan to 192.168.1.73: SERVFAIL
The zone file is set to root:bind and 664.
-rw-r--r-- 1 root root 2389 Jun 29 20:54 bind.keys
-rw-r--r-- 1 root root 237 Jun 29 20:54 db.0
-rw-r--r-- 1 root root 271 Jun 29 20:54 db.127
-rw-r--r-- 1 root bind 313 Jul 25 21:02 db.192
-rw-r--r-- 1 root root 237 Jun 29 20:54 db.255
-rw-r--r-- 1 root root 353 Jun 29 20:54 db.empty
-rw-rw-r-- 1 root bind 387 Jul 25 17:57 db.lan
-rw-r--r-- 1 bind bind 0 Jul 25 20:04 db.lan.jnl
-rw-r--r-- 1 root root 270 Jun 29 20:54 db.local
-rw-r--r-- 1 root root 3048 Jun 29 20:54 db.root
-rw-r--r-- 1 root bind 463 Jun 29 20:54 named.conf
-rw-r--r-- 1 root bind 490 Jun 29 20:54 named.conf.default-zones
-rw-r--r-- 1 root bind 398 Jul 25 17:14 named.conf.local
-rw-r--r-- 1 root bind 998 Jul 25 02:10 named.conf.options
-rw-r----- 1 bind bind 77 Jul 18 01:39 rndc.key
-rw-r--r-- 1 root root 1317 Jun 29 20:54 zones.rfc1918
And I've added the dhcpd user to the bind group:
$ groups dhcpd
dhcpd : dhcpd bind
I've also configured AppArmor (/etc/apparmor.d/usr.sbin.dhcpd) to allow the access:
# Allow access to bind zone file so that it
# can be updated as new hosts are allocated
/etc/bind/db.lan rw,
The zone file looks like this:
;
; BIND data file for local loopback interface
;
$TTL 604800
# IN SOA ns.lan. hostmaster.localhost. (
2 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;
# IN NS ns
# IN A 127.0.0.1
# IN AAAA ::1
ns IN A 192.168.1.1
server IN A 192.168.1.2
media IN A 192.168.1.3
web IN A 192.168.1.4
dsldevice IN A 192.168.1.254
Any ideas on the "Unable to add forward map" SERVFAIL error or even how I can diagnose the problem?

Answer 1

I ended up re-jigging the file structure a little and something I've done has made it work. I guess that points at a permissions issue, probably apparmor related at a guess.

Answer 2

As #Richard Payne said, it's an issue with apparmor.
Running tail -f /var/log/messages should show messages like this:
kernel: [ss.sss]: audit: type=1400: apparmor="DENIED" operation="mknod" profile="/usr/sbin/named" name="/etc/bind/db.<zone>.jnl" ....
So, to solve this, add the following to /etc/apparmord.d/local/usr.sbin.named:
# Allow dynDNS entries to be written, along with journal ant temporary files
/etc/bind/db.* rw,
/etc/bind/tmp-* rw,
Also, make sure that the file /etc/apparmord.d/usr.sbin.named contains an #include directive for the file with our changes. It is generally at the end, and looks like this:
# Site-specific additions and overrides
#include <local/usr.sbin.named>
Then, restart apparmor and bind
sudo systemctl restart apparmor
sudo systemctl restart bind9