After the update to systemd 237-3ubuntu10.57+esm4 (bionic-security, ESM),
which adds the root zone KSK-2024 to the built-in DNSSEC trust anchor
(LP: #2170538), systemd-resolved no longer starts on Ubuntu 18.04.
Version:
systemd 237-3ubuntu10.57+esm4
libsystemd0 237-3ubuntu10.57+esm4
What happened:
The update was installed automatically (unattended-upgrades) on
2026-10-15 at 06:17. During package configuration systemd-resolved was
restarted and has failed ever since. All name resolution on the host
stopped working (/etc/resolv.conf points to 127.0.0.53).
Log (journalctl -u systemd-resolved):
systemd-resolved[694]: Failed to add built-in positive trust anchor: No space
left on device
systemd-resolved[694]: Could not create manager: No space left on device
systemd[1]: systemd-resolved.service: Main process exited, code=exited,
status=1/FAILURE
systemd[1]: systemd-resolved.service: Start request repeated too quickly.
Notes:
- Disk space and inodes are fine (root fs 87 % used, 23 % inodes).
- strace shows no syscall returning ENOSPC, so the error is generated
inside systemd-resolved. It looks like the built-in trust anchor
answer is allocated for one DS record while the patch adds a second
one (KSK-2017 + KSK-2024), so adding it returns -ENOSPC.
- Running /lib/systemd/systemd-resolved manually as root fails the
same way.
- A reboot does not help.
Workaround:
Replace the /etc/resolv.conf symlink with a static file pointing to
upstream DNS servers and disable systemd-resolved.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2170538
Title:
Ubuntu 24.04: systemd-resolved DNSSEC fails after root KSK rollover;
built-in trust anchor lacks key 38696
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/2170538/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
