Re: samba & selinux
On Thu, 2007-11-01 at 17:03 -0400, McGuffey, David C. wrote:
Have had an interesting time getting samba to serve up files on F7.
After doing a lot of rftm and tinkering, it will share test files in
/mnt/winxp_data for both localhost and remote windowz boxes on the LAN.
However when I remove the test files (created with 'touch') and mount an
ntfs partition, I get an selinux error. From the error I deduce that the
selinux type for winxp_data is fusefs_t, and it needs to be
samba_share_t.
But when I try to change the type (using the guidance in the selinux
error message) I get another error.
Is it the way I'm mounting the ntfs partition? Have read that mounting
ntfs partitions and sharing them with samba is problematic. Some report
success by doing the following in fstab:
/dev/sdb2 /mnt/winxp_data ntfs defaults 1
2
But that doesn't seem to solve the problem...at least in my case.
In the end, I'll be formatting /dev/sdb2 as an ext3 partition, and
copying all of my ntfs data to it from /dev/sdb1, and then sharing out
the data from a linux partition. /dev/sdb1 will remain for dual-boot to
WinXP until my conversion to linux is complete. But for now, I'd like to
get samba to share this ntfs partition. Any tips?
selinux error message:
Summary
SELinux is preventing samba (/usr/sbin/smbd) "getattr" to
/mnt/winxp_data (fusefs_t).
Detailed Description
SELinux denied samba access to /mnt/winxp_data. If you want to share
this directory with samba it has to have a file context label of
samba_share_t.
If you did not intend to use /mnt/winxp_data as a samba repository
it could indicate either a bug or it could signal a intrusion attempt.
Allowing Access
You can alter the file context by executing chcon -R -t
samba_share_t
/mnt/winxp_data
The following command will allow this access:
chcon -R -t samba_share_t /mnt/winxp_data
Additional Information
Source Context system_u:system_r:smbd_t
Target Context system_u:object_r:fusefs_t
Target Objects /mnt/winxp_data [ dir ]
Affected RPM Packages samba-3.0.26a-0.fc7 [application]
Policy RPM selinux-policy-2.6.4-48.fc7
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name plugins.samba_share
Host Name desk.x.x
Platform Linux desk.x.x
2.6.23.1-10.fc7 #1
SMP Fri Oct 19 15:39:08 EDT 2007 i686 i686
Alert Count 7
First Seen Mon 29 Oct 2007 07:15:02 PM EDT
Last Seen Wed 31 Oct 2007 09:40:07 PM EDT
Local ID x
Line Numbers
Raw Audit Messages
avc: denied { getattr } for comm="smbd" dev=sdb2 egid=500 euid=500
exe="/usr/sbin/smbd" exit=-13 fsgid=500 fsuid=500 gid=0 items=0
path="/mnt/winxp_data" pid=2856 scontext=system_u:system_r:smbd_t:s0
sgid=0 subj=system_u:system_r:smbd_t:s0 suid=0 tclass=dir
tcontext=system_u:object_r:fusefs_t:s0 tty=(none) uid=500
[root@desk ~]# ls --lcontext /mnt
total 4
drwxrwxrwx 1 system_u:object_r:fusefs_t root root 4096 2007-10-30
21:09 winxp_data
[root@desk ~]# chcon -t samba_share_t /mnt/winxp_data
chcon: failed to change context of /mnt/winxp_data to
system_u:object_r:samba_share_t: Operation not supported
----
you're probably better off taking this to the selinux list...
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
but it seems to my under informed mind that if /mnt/winxp_data is a
mounted ntfs volume that the ntfs volume is not going to support the
extended attributes necessary for selinux and nothing is going to change
that short of Microsoft changing the ntfs format itself to support posix
extended attributes.
Craig