fc4 samba errors { read write } { search } { remove_name } - second part

[lastic miles]

Hello!

I found some things. With the command 'audit2allow'
and the log I've got these rules:

allow nmbd_t devpts_t:chr_file { read write };
allow smbd_t devpts_t:chr_file { read write };
allow smbd_t nscd_var_run_t:dir search;
allow smbd_t samba_log_t:dir remove_name;

How and where to apply them into the security policy
on my fc4?

Thanks!

--
L. Miles


		
____________________________________________________ 
Yahoo! Sports 
Rekindle the Rivalries. Sign up for Fantasy Football 
http://football.fantasysports.yahoo.com

[Ivan Gyurdiev]

On Sat, 2005-06-18 at 11:24 -0700, lastic miles wrote:
>  Hello!
>  
>  I found some things. With the command 'audit2allow'
>  and the log I've got these rules:
>  
>  allow nmbd_t devpts_t:chr_file { read write };
>  allow smbd_t devpts_t:chr_file { read write }; 
I don't like these two... 

>  allow smbd_t nscd_var_run_t:dir search; 
Add nscd_client_domain to the daemon_domain call for smbd

>  allow smbd_t samba_log_t:dir remove_name; 
Samba's currently not allowed to delete logs - it seems this was
done on purpose. Why, I'm not sure - so you can't erase valuable
audit trail I suppose...

---

By the way, notice how samba doesn't use standard log macros for
this (append_logdir_domain). The only reason for this appears to 
be that the type is shared across multiple types. This is not a very
good reason. IMHO we need to change all those log/var/etc macros 
to address this issue. If you look at home_macros.te you'll see one
(rather ugly) way to address this - separate macro in one declaration
part, and another "access" part.

-- 
Ivan Gyurdiev <ivg2(a)cornell.edu&gt;
Cornell University

[lastic miles]

--- Ivan Gyurdiev <ivg2(a)cornell.edu&gt; wrote:

>  Add nscd_client_domain to the daemon_domain call for
>  smbd 
What does that mean?

>  Samba's currently not allowed to delete logs - it
>  seems this was
>  done on purpose. Why, I'm not sure - so you can't
>  erase valuable
>  audit trail I suppose...
>  
>  ---
>  
>  By the way, notice how samba doesn't use standard
>  log macros for
>  this (append_logdir_domain). The only reason for
>  this appears to 
>  be that the type is shared across multiple types.
>  This is not a very
>  good reason. IMHO we need to change all those
>  log/var/etc macros 
>  to address this issue. If you look at home_macros.te
>  you'll see one
>  (rather ugly) way to address this - separate macro
>  in one declaration
>  part, and another "access" part. 
In general you are saying "Do not touch for now. It
works."

Thank you for your time!

--
L. Miles


		
____________________________________________________ 
Yahoo! Sports 
Rekindle the Rivalries. Sign up for Fantasy Football 
http://football.fantasysports.yahoo.com

[Ivan Gyurdiev]

On Mon, 2005-06-20 at 12:12 -0700, lastic miles wrote:
>  --- Ivan Gyurdiev <ivg2(a)cornell.edu&gt; wrote:
>  
>  > Add nscd_client_domain to the daemon_domain call for
>  > smbd
>  
>  What does that mean? 
nscd caches passwords and dns lookups, and similar things -
it's part of libc. It seems like samba is trying to access 
the nscd cache, and is failing. By adding the attribute
"nscd_client_domain" to the proper macro call in the policy, 
it will make it work. 

I realize that you possibly do not know how to do this
yourself, but my email was addressed to the list
with the purpose that Dan Walsh (the policy maintainer)
may see and fix it.

The other things which you posted are less clear, since
they have to do with samba writing to the terminal,
and samba erasing its logs. It may be the case that
we should not allow those things.

-- 
Ivan Gyurdiev <ivg2(a)cornell.edu&gt;
Cornell University