Re: Samba shares...

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Daniel B. Thurman wrote:
>  Stephen Smalley wrote:
>  |On Tue, 2008-05-13 at 10:27 -0700, Daniel B. Thurman wrote:
>  |> Daniel B. Thurman wrote:
>  |> |Stephen Smalley
>  |> ||On Tue, 2008-05-13 at 08:12 -0700, Daniel B. Thurman wrote:
>  |> ||> Stephen Smalley wrote:
>  |> ||> >> Daniel B. Thurman wrote:
>  |> ||> >> I am not sure what is going on.  I am unable to get
>  |> ||> >> samba shares to work for an NTFS filesystem.  I do
>  |> ||> >> have several shares working for ext3 filesystems.
>  |> ||> >> 
>  |> ||> >> Here is what I did:
>  |> ||> >> 
>  |> ||> >> 1) Create an empty directory: /AV
>  |> ||> >> 2) chcon -t samba_share_t /AV
>  |> ||> >> 3) chmod 775 !$
>  |> ||> >> 4) chgrp avusers !$
>  |> ||> >> 5) Add to fstab
>  |> ||> >>    /dev/sda1 /AV ntfs defaults 1 2
>  |> |   [snipped!]
>  |> ||
>  |> ||It is just another mount option, so you can just do something like:
>  |> ||/dev/sda1 /AV ntfs 
>  |> |defaults,context=system_u:object_r:samba_share_t 1 2
>  |> |
>  |> |Yes, I thought so.  I tried that and the context does not
>  |> |change.  Any ideas?
>  |> 
>  |> Mounting an NTFS filesystem even with context options,
>  |> the context always remains as fusefs_t. I am allowed
>  |> to change the context on the directory before the mount,
>  |> but not after the mount. After mounting, I am not allowed
>  |> to chcon the mounted FS as it says that the Operation is
>  |> not allowed.
>  |
>  |Can you confirm that if you umount /AV and then mount it with the
>  |context= option that it really doesn't work for you?  You do have to
>  |umount it though if you previously mounted it w/o the context option to
>  |make the option take affect.
>  
>  Yes, I can confirm that adding context= to the option line
>  in /etc/fstab does not seem to do anything, i.e. the context
>  does not change and remains fusefs_t.  I tried several times,
>  and even tried the fscontext= as well, neither seems to work.
>  
>  I was forced to reboot sometimes since I was not at times
>  able to unmount the /AV filesystem, it sometimes reports
>  that the /AV filesystem was 'busy'.  This seems to happen
>  if I mount/unmount several times then it says 'busy',
>  preventing me from unmounting. Hmm.
>  
>  |I'm not sure why a context mount option wouldn't work for fuse - Eric?
>  |
>  |fuse itself won't let you chcon (setxattr) the files unless the
>  |filesystem supports setxattr, which is why you get Operation not
>  |supported there.
>  |
>  |> I even tried: setsebool -P samba_export_all_rw=1 and that
>  |> does not work, either.
>  |> 
>  |> If I setenforce 0, I can share the NTFS filesystem, but I
>  |> really do not want to do this.  Can someone please give me
>  |> a workaround?
>  |
>  |You can certainly generate a local policy module that gives access to
>  |fusefs_t, but it would be better if we could get the context mount
>  |option to work.
>  
>  I will try anything you suggest.  Let me know if you can
>  resolve this issue, otherwise let me know (in detail) how
>  to write a policy as a last resort?
>  
>  Thanks much!
>  Dan 
This looks like a bug.

If you are using fedora 9 policy it has a boolean

samba_share_fusefs

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkgp4e4ACgkQrlYvE4MpobN14ACg1mVCa9sxAoDThvTwSMW5v+2C
> etcAoIVXMYbp+hBFVWzjDjVP2VYh7Iaf
> =VZTf
> -----END PGP SIGNATURE-----