How to clear Samba through SELinux

[Temlakos]

Everyone:

I go through this exercise with every update. I have two machines on my 
network. One runs Windows; the other runs Fedora (now up to 17).

Right now, the Fedora box can "see" everything in the Windows box that 
belongs to the default Windows user.

But: the Windows box can see that a share is available but may not visit 
the share.

I cleared Samba through the firewall; otherwise I'd have no connection 
at all.

Now: what Booleans or modules do I need to set or reset to clear Samba 
through SELinux? I don't seem to have any configuration tool (not 
graphical, anyway) to let me see where the problem is. The Windows box 
doesn't say much, except "Windows cannot access this share; you need to 
talk to the system admin in charge of the other system." Well, I /am/ 
the system admin. I'd like to clear each machine for full read-write 
access to the other. But right now, I have to do all my sharing through 
the Fedora machine.

(As to why I would even want a Windows machine around: I keep it around 
for programs like TV tuning and DVD authoring that /just work out of the 
box/. I also use that Windows box as a print server. That works.)

So in essence, my Fedora box is a good client but a bad server. I think 
maybe SELinux is the one remaining obstacle. I need to know how to clear it.

Temlakos

[yersinia]

Difficult to answer without any info. Do you see any avc samba related
? And the samba log what tell you , do you see any acceso denied ?

2012/10/7, Temlakos <temlakos(a)gmail.com&gt;:
>  Everyone:
>
>  I go through this exercise with every update. I have two machines on my
>  network. One runs Windows; the other runs Fedora (now up to 17).
>
>  Right now, the Fedora box can "see" everything in the Windows box that
>  belongs to the default Windows user.
>
>  But: the Windows box can see that a share is available but may not visit
>  the share.
>
>  I cleared Samba through the firewall; otherwise I'd have no connection
>  at all.
>
>  Now: what Booleans or modules do I need to set or reset to clear Samba
>  through SELinux? I don't seem to have any configuration tool (not
>  graphical, anyway) to let me see where the problem is. The Windows box
>  doesn't say much, except "Windows cannot access this share; you need to
>  talk to the system admin in charge of the other system." Well, I /am/
>  the system admin. I'd like to clear each machine for full read-write
>  access to the other. But right now, I have to do all my sharing through
>  the Fedora machine.
>
>  (As to why I would even want a Windows machine around: I keep it around
>  for programs like TV tuning and DVD authoring that /just work out of the
>  box/. I also use that Windows box as a print server. That works.)
>
>  So in essence, my Fedora box is a good client but a bad server. I think
>  maybe SELinux is the one remaining obstacle. I need to know how to clear it.
>
>  Temlakos
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux 
-- 
Inviato dal mio dispositivo mobile

[Frank Murphy]

On 07/10/12 12:39, Temlakos wrote:
  I don't seem to have any configuration tool (not
>  graphical, anyway) 
in a console type:
yum  install policycoreutils-gui

You will then in Administraton
have an ison for Selinux Management
if you clikc booleans, and scroll down.
You will see a number of them for Samba.

(Xfce, don't know about other Desktops)

-- 
Regards,
Frank
"Jack of all, fubars"

[yersinia]

If you have a recent selinux distro, i can be more precise if
necessary , you can put samba in permissive mode, if you think your
problem is selinux.

Hth

2012/10/7, Temlakos <temlakos(a)gmail.com&gt;:
>  Everyone:
>
>  I go through this exercise with every update. I have two machines on my
>  network. One runs Windows; the other runs Fedora (now up to 17).
>
>  Right now, the Fedora box can "see" everything in the Windows box that
>  belongs to the default Windows user.
>
>  But: the Windows box can see that a share is available but may not visit
>  the share.
>
>  I cleared Samba through the firewall; otherwise I'd have no connection
>  at all.
>
>  Now: what Booleans or modules do I need to set or reset to clear Samba
>  through SELinux? I don't seem to have any configuration tool (not
>  graphical, anyway) to let me see where the problem is. The Windows box
>  doesn't say much, except "Windows cannot access this share; you need to
>  talk to the system admin in charge of the other system." Well, I /am/
>  the system admin. I'd like to clear each machine for full read-write
>  access to the other. But right now, I have to do all my sharing through
>  the Fedora machine.
>
>  (As to why I would even want a Windows machine around: I keep it around
>  for programs like TV tuning and DVD authoring that /just work out of the
>  box/. I also use that Windows box as a print server. That works.)
>
>  So in essence, my Fedora box is a good client but a bad server. I think
>  maybe SELinux is the one remaining obstacle. I need to know how to clear it.
>
>  Temlakos
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux 
-- 
Inviato dal mio dispositivo mobile

[Tristan Santore]

On 07/10/12 12:39, Temlakos wrote:
>  Everyone:
>  
>  I go through this exercise with every update. I have two machines on my
>  network. One runs Windows; the other runs Fedora (now up to 17).
>  
>  Right now, the Fedora box can "see" everything in the Windows box that
>  belongs to the default Windows user.
>  
>  But: the Windows box can see that a share is available but may not visit
>  the share.
>  
>  I cleared Samba through the firewall; otherwise I'd have no connection
>  at all.
>  
>  Now: what Booleans or modules do I need to set or reset to clear Samba
>  through SELinux? I don't seem to have any configuration tool (not
>  graphical, anyway) to let me see where the problem is. The Windows box
>  doesn't say much, except "Windows cannot access this share; you need to
>  talk to the system admin in charge of the other system." Well, I /am/
>  the system admin. I'd like to clear each machine for full read-write
>  access to the other. But right now, I have to do all my sharing through
>  the Fedora machine.
>  
>  (As to why I would even want a Windows machine around: I keep it around
>  for programs like TV tuning and DVD authoring that /just work out of the
>  box/. I also use that Windows box as a print server. That works.)
>  
>  So in essence, my Fedora box is a good client but a bad server. I think
>  maybe SELinux is the one remaining obstacle. I need to know how to clear
>  it.
>  
>  Temlakos
>  -- 
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux 
getsebool -a|grep samba

setsebool name_of_bool on/off

To make changes permanent, after you worked out which one you need/want:

setsebool -P name_of_bool on/off

Regards,
Tristan

-- 
Tristan Santore BSc MBCS
TS4523-RIPE
Network and Infrastructure Operations
InterNexusConnect
Mobile [phone]
Tristan.Santore(a)internexusconnect.net

Former Thawte Notary
(Please note: Thawte has closed its WoT programme down,
and I am therefore no longer able to accredit trust)

For Fedora related issues, please email me at:
TSantore(a)fedoraproject.org

[Dominick Grift]

On Sun, 2012-10-07 at 18:27 +0100, Tristan Santore wrote:

>  > So in essence, my Fedora box is a good client but a bad server.
> I think
>  > maybe SELinux is the one remaining obstacle. I need to know how to clear
>  > it.
>  > 
>  > Temlakos 
To determine if selinux is blocking you can toggle detection only mode
by running the following command:

setenforce 0

No reboot required or anything, it goes into effect immediately
Then do your tests

You can see the current status of selinux with:

getenforce

if it returns "Permissive" then your selinux is in detection only mode
if it returns "Enforcing" then your selinux is in full prevention mode

If your tests succeeds when selinux is in permissive mode but not when
selinux is in enforcing mode then it is likely selinux blocking access.

If your tests fail in both permissive as well as enforcing mode then you
can rule out any selinux issues and look for issues elsewhere

After your tests be sure to go back to enforcing mode:

setenforce 1

[Temlakos]

On 10/07/2012 10:08 AM, Frank Murphy wrote:
>  On 07/10/12 12:39, Temlakos wrote:
>   I don't seem to have any configuration tool (not
> > graphical, anyway)
>
>  in a console type:
>  yum  install policycoreutils-gui
>
>  You will then in Administraton
>  have an ison for Selinux Management
>  if you clikc booleans, and scroll down.
>  You will see a number of them for Samba.
>
>  (Xfce, don't know about other Desktops)
>  
Everyone:

Thank you all for your suggestions.

First, I did a quick Google search on the terms "samba" and "SELinux"

together. I found two Booleans to set to 1. When I did, my Fedora 
machine became a proper server.

But Frank's suggestion to install the policycoreutils GUI front-end was 
a good one. In KDE, that does put an "SELinux Management" application in 
the Administration menu. (I use either the Yum Extender or Apper for all 
my software management.

I'm going to keep the other suggestions on file. I hope I can remember 
to switch those Booleans in the next upgrade. Which I anticipate doing 
after Christmas. By then, F18 will be out for a month, and maybe that 
will be time for RPMfusion and Livna to catch up with it, and for other 
package maintainers to iron out the kinks.

Temlakos

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/07/2012 07:39 AM, Temlakos wrote:
>  Everyone:
>  
>  I go through this exercise with every update. I have two machines on my
>  network. One runs Windows; the other runs Fedora (now up to 17).
>  
>  Right now, the Fedora box can "see" everything in the Windows box that
>  belongs to the default Windows user.
>  
>  But: the Windows box can see that a share is available but may not visit
>  the share.
>  
>  I cleared Samba through the firewall; otherwise I'd have no connection at
>  all.
>  
>  Now: what Booleans or modules do I need to set or reset to clear Samba
>  through SELinux? I don't seem to have any configuration tool (not
>  graphical, anyway) to let me see where the problem is. The Windows box
>  doesn't say much, except "Windows cannot access this share; you need to
>  talk to the system admin in charge of the other system." Well, I /am/ the
>  system admin. I'd like to clear each machine for full read-write access to
>  the other. But right now, I have to do all my sharing through the Fedora
>  machine.
>  
>  (As to why I would even want a Windows machine around: I keep it around
>  for programs like TV tuning and DVD authoring that /just work out of the
>  box/. I also use that Windows box as a print server. That works.)
>  
>  So in essence, my Fedora box is a good client but a bad server. I think
>  maybe SELinux is the one remaining obstacle. I need to know how to clear
>  it.
>  
>  Temlakos -- selinux mailing list selinux(a)lists.fedoraproject.org 
>  https://admin.fedoraproject.org/mailman/listinfo/selinux
>  
>   
Try using the smbd_selinux man page

man smbd_selinux



> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
>
> iEYEARECAAYFAlBy58YACgkQrlYvE4MpobNcGACaA1cnA0etAGBQd5TVfqDkC5BE
> 4pIAoIT2LjwhiQnqzVq8LbDfSE8Eq6dO
> =EOvw
> -----END PGP SIGNATURE-----

Constraint violation AVC

[Anamitra Dutta Majumdar]

I am running into some denials that seem to be constraint violation as
follows


#!!!! This avc is a constraint violation.  You will need to add an
attribute to either the source or target type to make it work.
#Contraint rule:
allow ssh_t ssh_home_t:dir create;


What does this mean and how do we address it?

Any pointers would be appreciated.

Thanks,
Anamitra

Constraint violation AVC

[Dominick Grift]

On Mon, 2012-10-15 at 16:41 +0000, Anamitra Dutta Majumdar (anmajumd)
wrote:
>  I am running into some denials that seem to be constraint violation
> as
>  follows
>  
>  
>  #!!!! This avc is a constraint violation.  You will need to add an
>  attribute to either the source or target type to make it work.
>  #Contraint rule:
>  allow ssh_t ssh_home_t:dir create;
>  
>  
>  What does this mean and how do we address it? 
Would need to see the actual avc denial message to be able to suggest
something

>  Any pointers would be appreciated.
>  
>  Thanks,
>  Anamitra
>   
>  
>  
>  
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux

Constraint violation AVC

[Anamitra Dutta Majumdar]

Hi Dominick,

Here it is

type=AVC msg=audit(1350454530.626:73898): avc:  denied  { transition } for
 pid=11860 comm="sudo" path="/home/tomcat/tomcat_security_startup.sh"
dev=sda2 ino=2523182 scontext=system_u:system_r:servm_t:s0
tcontext=system_u:system_r:tomcatd_t:s0-s0:c0.c1023 tclass=process


Thanks,
Anamitra

On 10/15/12 9:57 AM, "Dominick Grift" <dominick.grift(a)gmail.com&gt; wrote:

> On Mon, 2012-10-15 at 16:41 +0000, Anamitra Dutta Majumdar (anmajumd)
> wrote:
> > I am running into some denials that seem to be constraint violation as
> > follows
> > 
> > 
> > #!!!! This avc is a constraint violation.  You will need to add an
> > attribute to either the source or target type to make it work.
> > #Contraint rule:
> > allow ssh_t ssh_home_t:dir create;
> > 
> > 
> > What does this mean and how do we address it?
>
> Would need to see the actual avc denial message to be able to suggest
> something
>
> > Any pointers would be appreciated.
> > 
> > Thanks,
> > Anamitra
> >  
> > 
> > 
> > 
> > --
> > selinux mailing list
> > selinux(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/selinux
>
>
> --
> selinux mailing list
> selinux(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux

Constraint violation AVC

[Dominick Grift]

On Thu, 2012-10-18 at 21:51 +0000, Anamitra Dutta Majumdar (anmajumd)
wrote:
>  Hi Dominick,
>  
>  Here it is
>  
>  type=AVC msg=audit(1350454530.626:73898): avc:  denied  { transition } for
>   pid=11860 comm="sudo"
> path="/home/tomcat/tomcat_security_startup.sh"
>  dev=sda2 ino=2523182 scontext=system_u:system_r:servm_t:s0
>  tcontext=system_u:system_r:tomcatd_t:s0-s0:c0.c1023 tclass=process 
Looks like a mcs constrained violation.

I believe you have two options.

The preferred option is to run servm_t with the full mcs range:

init_ranged_daemon_domain(servm_t, servm_exec_t, s0 - mcs_systemhigh)

(assumes that a init script runs the servm executable file that is
labeled type servm_exec_t)

Or you can:

"Make specified domain MCS trusted for setting any category set for the
processes it executes."

mcs_process_set_categories(servm_t)

>  
>  Thanks,
>  Anamitra
>  
>  On 10/15/12 9:57 AM, "Dominick Grift" <dominick.grift(a)gmail.com&gt; wrote:
>  
>  >
>  >
>  >On Mon, 2012-10-15 at 16:41 +0000, Anamitra Dutta Majumdar (anmajumd)
>  >wrote:
>  >> I am running into some denials that seem to be constraint violation as
>  >> follows
>  >> 
>  >> 
>  >> #!!!! This avc is a constraint violation.  You will need to add an
>  >> attribute to either the source or target type to make it work.
>  >> #Contraint rule:
>  >> allow ssh_t ssh_home_t:dir create;
>  >> 
>  >> 
>  >> What does this mean and how do we address it?
>  >
>  >Would need to see the actual avc denial message to be able to suggest
>  >something
>  >
>  >> Any pointers would be appreciated.
>  >> 
>  >> Thanks,
>  >> Anamitra
>  >>  
>  >> 
>  >> 
>  >> 
>  >> --
>  >> selinux mailing list
>  >> selinux(a)lists.fedoraproject.org
>  >> https://admin.fedoraproject.org/mailman/listinfo/selinux
>  >
>  >
>  >--
>  >selinux mailing list
>  &gt;selinux(a)lists.fedoraproject.org
>  >https://admin.fedoraproject.org/mailman/listinfo/selinux
>