bind chroot setting

1.stop bind9 service
#/etc/init.d/bind9 stop

2.modify /etc/default/bind9 and add -t agrument
#vim /etc/default/bind9
OPTIONS="-u bind -t /var/lib/named"


3.create necessary folder
#mkdir -p /var/lib/named/etc
#mkdir /var/lib/named/dev
#mkdir -p /var/lib/named/var/cache/bind
#mkdir -p /var/lib/named/var/run/bind/run

4.move /etc/bind to /var/lib/name/etc/
#mv /etc/bind /var/lib/named/etc

5.mkdir software link to /etc/bind
#ln -s /var/lib/named/etc/bind /etc/bind

6.mkdir two char device and grant some permission
#mknod /var/lib/named/dev/null c 1 3
#mknod /var/lib/named/dev/random c 1 8
#chmod 666 /var/lib/named/dev/null /var/lib/named/dev/random
#chown -R bind:bind /var/lib/named/var/*
#chown -R bind:bind /var/lib/named/etc/bind

7.create one file to log import message and add one line on it
#vim /etc/rsyslog.d/bind-chroot.conf
$AddUnixListenSocket /var/lib/named/dev/log

8.add some lines on /etc/apparmor.d/usr.sbin.named
#vim /etc/apparmor.d/usr.sbin.named
/var/lib/named/etc/bind/* rw,
/var/lib/named/var/run/bind/run/named.pid w,
/var/lib/named/var/run/bind/named.options r,
/var/lib/named/dev/null rw,
/var/lib/named/dev/random rw,


9.restart rsyslog and bind9 serivice
#/etc/init.d/rsyslog restart
#/etc/init.d/apparmor restart
#/etc/init.d/bind9 start