On 02/22/2010 07:55 PM, Trevor Hemsley wrote:
I am sharing my user home directories to other machines on my LAN
using
Samba. I have that all working correctly except for one persistent AVC
that I keep seeing. Now this AVC is correct in that I really do not want
my user's .ssh directories read over SMB so I'd quite like to keep that
as-is. But... I get alerts for this all the time so I'd like to know how
to add a dontaudit rule for it so that access is denied but I don't get
told about it. Ideally I'd like to add a generic rule to catch all
user's not have to add one dontaudit rule per user. Just don't have a
clue where to start and google was not much use on this so would
appreciate some help if anyone has done this before?
SELinux is preventing samba (smbd) "getattr" to /home/$user/.ssh
(sshd_key_t).
Source Context: system_u:system_r:smbd_t
Target Context: user_u:object_r:sshd_key_t
Target Objects: /home/$user/.ssh/config [ file ]
Source: smbd
Source Path: /usr/sbin/smbd
Port:<Unknown>
Host: hostname
Source RPM Packages: samba-3.0.33-3.15.el5_4.1
Target RPM Packages:
Policy RPM: selinux-policy-2.4.6-255.el5_4.4
Selinux Enabled: True
Policy Type: targeted
MLS Enabled: True
Enforcing Mode: Permissive
Plugin Name: samba_share
Host Name: hostname
Platform: Linux hostname 2.6.32.5 #3 SMP Sun Jan 31 03:27:09 GMT 2010
x86_64 x86_64
Alert Count: 1
First Seen: Tue 23 Feb 2010 12:44:47 AM GMT
Last Seen: Tue 23 Feb 2010 12:44:47 AM GMT
Local ID: 5d933e81-2ab5-4529-8dce-9e554a59f0e3
Line Numbers:
Raw Audit Messages :
host=hostname type=AVC msg=audit(1266885887.400:4313): avc: denied {
getattr } for pid=16382 comm="smbd" path="/home/$user/.ssh/config"
dev=dm-4 ino=10453601 scontext=system_u:system_r:smbd_t:s0
tcontext=user_u:object_r:sshd_key_t:s0 tclass=file
host=hostname type=SYSCALL msg=audit(1266885887.400:4313): arch=c000003e
syscall=4 success=yes exit=0 a0=7fff2dc9f270 a1=7fff2dc9e9a0
a2=7fff2dc9e9a0 a3=7fff2dc9ee70 items=0 ppid=4352 pid=16382
auid=4294967295 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=500 sgid=0
fsgid=500 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd"
subj=system_u:system_r:smbd_t:s0 key=(null)
# cat > mysmbd.te << _EOF
policy_module(mysmbd, 1.0)
require {
type smbd_t;
type sshd_key_t;
}
dontaudit smbd_t sshd_key_t:file getattr;
_EOF
# make -f /usr/share/selinux/devel/Makefile
# semodule -i mysmbd.pp