[update, solved] It was apparmor, which was lying about being inactive. Ubuntu's default profile denies bind write access to its config directory. Needed to add /etc/bind/dnskeys/** rw
, reload apparmor, and it's all good.
Trying to switch my internal domain from auto-dnssec maintain
to dnssec-policy default.
Zone is signed but not secure and logs are full of
zone_rekey:dns_dnssec_keymgr failed: error occurred writing key to disk
key-directory is /etc/bind/dnskeys, owned bind:bind, and named runs as bind
I've set every directory I could think of to 777: /etc/bind, /etc/bind/dnskeys, /var/lib/bind, /var/cache/bind, /var/log/bind. I disabled apparmor, in case it was blocking.
A signed zone file appears, but I can't dig any DNSKEYs or RRSIGs. named-checkzone says there's nsec records in the signed file, so something is happening, but I'm guessing it all stops when keymgr fails to write the key.
I tried manually generating a key and sticking it in dnskeys, but this doesn't appear to be used.
The filibuster is just a Senate rule, though, which they can rewrite any time they like (though usually only after an election).
The 2017 repeal effort used a budget reconciliation mechanism that is not subject to filibuster. In fact, a lot of the 2017 legislative awfulness used the budget reconciliation hack, where the Senate can change laws in order to 'balance the budget,' so long as (by convention) they don't change policy. 2017 repeal, of course, famously failed because John McCain thought they shouldn't use that process and voted against it.