on a clean install on f34 of freeipa server with dns:
After enabling dnssec on a zone, to avoid thousands of lines appear in
the logs like:
May 10 12:12:45
registry1.1.quietfountain.com named[11774]:
File.cpp(94): Could not open the file (Permission denied):
/var/lib/ipa/dnssec/tokens/2bf061ad-fdef-a969-a3bb-22d6252d136d/c6824fd2-b21e-95b1-bf02-f7acdfc228a2.object
which continue for many minutes every time named tries to reference the
files.
To workaround the situation, I have to run
setfacl -R -m u:named:rwX /var/lib/ipa/dnssec/tokens
after dnssec is enabled on a zone.
It seems some freeipa dnssec permission fixer doesn't get them all or
run often enough.