Apparmor is also blocking read access from named to /var/lib/samba/private/dns.keytab.
[40953.694755] audit: type=1400 audit(1482362368.332:17): apparmor="DENIED" operation="open" profile="/usr/sbin/named" name="/var/lib/samba/private/dns.keytab" pid=5334 comm="named" requested_mask="r" denied_mask="r" fsuid=123 ouid=0
Apparmor is also blocking read access from named to /var/lib/ samba/private/ dns.keytab.
[40953.694755] audit: type=1400 audit(148236236 8.332:17) : apparmor="DENIED" operation="open" profile= "/usr/sbin/ named" name="/ var/lib/ samba/private/ dns.keytab" pid=5334 comm="named" requested_mask="r" denied_mask="r" fsuid=123 ouid=0