Re: samba & selinux

[McGuffey, David C.]

>  John Summerfield wrote: 
>  McGuffey, David C. wrote:
>  > Have had an interesting time getting samba to serve up files on F7.
>  > After doing a lot of rftm and tinkering, it will share test files in
>  > /mnt/winxp_data for both localhost and remote windowz boxes on the 
LAN.
>  > However when I remove the test files (created with
> 'touch') and 
mount an
>  > ntfs partition, I get an selinux error. From the error I deduce
> that 
the
>  > selinux type for winxp_data is fusefs_t, and it needs to be
>  > samba_share_t.
>  >
>  
>  I expect it will work when you find the magic incantation of the mount
>  command. I think you need to override the context.
>  
>  This is how I mounted an ISO so I could serve it from Apache:
>  
/var/local/mirrors/linux/ScientificLinux/5.0/SL-5.0-050407-i386-DVD.iso
>  /mnt/SL5 iso9660
>  
ro,nosuid,nodev,noexec,loop,context=system_u:object_r:httpd_sys_content_
t:
>  s0	0 0
>  
>  That's all one line
>   
Thanks

I've registered for the selinux forum and will repost my question there.

In the mean time, I spent a bit of time last night playing with the
mount options in fstab.  I added the
context=system_u:object_r:samba_share_t option but ended up with some
strange behavior.

Per the guidance from the selinux error message, I unmounted the ntfs
partion, issued the chcon command and the selinux type of
/mnt/winxp_data was changed to samba_share_t. When the ntfs partion is
mounted, the type changes to fusefs_t, which then causes selinux to
complain.  I unmount the partition, and the mount point returns to
samba_share_t. I issued the chcon command with the ntfs partition
mounted, but because the files on ntfs don't have extended attributes,
chon pukes.

I don't want to remove or back away from selinux in enforcing mode.  I
have customers who want to build applications on top of selinux, so the
task at hand is to get smart and make things work with selinux.

Dave McGuffey
Principal Information System Security Engineer // NSA-IEM, NSA-IAM
SAIC, IISBU, Columbia, MD

samba & selinux

[Gordon Messmer]

McGuffey, David C. wrote:
>  
>  I don't want to remove or back away from selinux in enforcing mode.  I
>  have customers who want to build applications on top of selinux, so the
>  task at hand is to get smart and make things work with selinux. 
I can't find any selinux boolean or setting to allow samba access to the 
required contexts.  What I'd do is change your policy to permissive and 
use samba to access the files as you require.  Then use "audit2allow" to 
create SELinux rules that will allow normal samba operation.  Install 
those, and then go back to enforcing mode.

samba & selinux

[Alex White]

On Fri, 2 Nov 2007 09:40:22 -0400
"McGuffey, David C." <DAVID.C.MCGUFFEY(a)saic.com&gt; took out a #2
pencil and scribbled:

>  I don't want to remove or back away from selinux in enforcing
>  mode.  I have customers who want to build applications on top of
>  selinux, so the task at hand is to get smart and make things work
>  with selinux.
>  
>  Dave McGuffey
>  Principal Information System Security Engineer // NSA-IEM, NSA-IAM
>  SAIC, IISBU, Columbia, MD 
Isn't it possible (I don't know that this would work for you) to
turn off that particular policy? I run selinux in enforcing mode
and haven't fallen into this particular problem as my setup is
obviously different. Would it be poor advice to try and disable the
selinux policy for this particular instance? Or is the situation of
a sort that it wouldn't matter and selinux would freak out anyway?

Sincerely
-- 
ethericalzen(a)gmail.com
Life is a prison, death is a release

samba & selinux

[Mikkel]

McGuffey, David C. wrote:
>  
>  In the mean time, I spent a bit of time last night playing with the
>  mount options in fstab.  I added the
>  context=system_u:object_r:samba_share_t option but ended up with some
>  strange behavior.
>  
>  Per the guidance from the selinux error message, I unmounted the ntfs
>  partion, issued the chcon command and the selinux type of
>  /mnt/winxp_data was changed to samba_share_t. When the ntfs partion is
>  mounted, the type changes to fusefs_t, which then causes selinux to
>  complain.  I unmount the partition, and the mount point returns to
>  samba_share_t. I issued the chcon command with the ntfs partition
>  mounted, but because the files on ntfs don't have extended attributes,
>  chon pukes.
>   
This is the expected behavior. When you use a directory as a mount
point, the permissions of the directory are overridden by the mount
command as long as the file system is mounted there. When you
unmount the file system, the original permissions are again in
force. When you do not specify permissions, the defaults for the
file system type are used. The exact values depend on the file
system type. For example, the default user and group for a FAT file
system is the user/group mounting it, but not for an ext3 file
system, the owner/group of the file system is used.

On an added note, the directory used as a mount point does not need
to be empty, but you will lose access to the contents while it is
used as a mount point. The exception to this is that open files are
still accessible to the programs that have them open, but only until
they close them.

Mikkel
-- 

  Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!