Today was the day to upgrade the server running this blog to Ubuntu 9.10 "Karmic Koala".

Late in the upgrade, during the process of installing and configuring the Debian packages, the upgrade hung. I had just tried to stop bind9 and given an series of error messages indicating that rndc was unable to communicate with bind9.

After waiting a while I hit control-c and was warned that this might leave the system in an inconsistent state, but I figured I had little to lose, so I clicked ok. The upgrade continued, but didn't reboot, saying that there had been a problem

I tried to start bind9 manually, both with rndc start, and /etc/init.d/bind9 start but only got bad news.

So I then tried to start it while tailing the syslog, and noticed that I was getting an error about a failure to open /etc/ssl/openssl.cnf for read. This was strange since the permissions on that file allowed reading by anyone.

A little googling eventually revealed that I was running afoul of AppArmor, something I hadn't encountered before. It turns out that Ubuntu doesn't automatically include an AppArmor profile for bind9, not sure why.

The solution seems to have been to manually install the apparmor-profile package with apt-get.

After verifying that I could manually start bind9 and talk to it with rndc, I rebooted, and as they say "so far so good."