SAMBA home directories and SELinux

[Stephen Walton]

I have the usual entry in smb.conf on my FC4 server:

[homes]
        comment = Home Directories
        read only = No
        browseable = No

As an additional wrinkle, home directories on the server are physically 
on /users but get mounted on demand on /home on both the server and on 
client workstations using a typical LDAP/autofs setup.

With SELinux enabled, both smbclient and users on Windows machines fail 
to get access to home directories.  What magic chcon invocation do I need?

[Vitaliy Ivanov]

On Wednesday 28 September 2005 19:13, Stephen Walton wrote:
> I have the usual entry in smb.conf on my FC4 server:
>
> [homes]
>         comment = Home Directories
>         read only = No
>         browseable = No
>
> As an additional wrinkle, home directories on the server are physically
> on /users but get mounted on demand on /home on both the server and on
> client workstations using a typical LDAP/autofs setup.
>
> With SELinux enabled, both smbclient and users on Windows machines fail
> to get access to home directories.  What magic chcon invocation do I need?

Solution 1 (temporary; won't survive a re-boot):

Issue the command:

[root]# setsebool samba_enable_home_dirs=1

Solution 2 (might survive a reboot; I didn't actually try this one):

[root]# setsebool -P samba_enable_home_dirs=1

Solution 3 (survives a reboot):

This is the solution I ultimately settled on. Go to the /etc/selinux/targeted 
directory. Create a text file called booleans.local, and put the 
"samba_enable_home_dirs=1" line in it (without the quotes, of course).

Solution 4 (surives a reboot, but removes all SELinux protection):

Edit /etc/selinux/config. Change the line SELINUX=enforcing to 
SELINUX=permissive or SELINUX=disabled.

I've got same problem earlier and tried the 3 solution from the list above. 
It worked.

Best.

[Stephen Walton]

Vitaliy Ivanov wrote:
> On Wednesday 28 September 2005 19:13, Stephen Walton wrote:
> > With SELinux enabled, both smbclient and users on Windows machines fail
> > to get access to home directories.  What magic chcon invocation do I need?
>
> Solution 2 (might survive a reboot; I didn't actually try this one):
>
> [root]# setsebool -P samba_enable_home_dirs=1

This does survive a reboot as it puts samba_enable_home_dirs in 
/etc/selinux/targeted/booleans.local.  Unfortunately I tried doing both 
this and

setsebool -P smb_use_home_dirs=1

to no avail.

smbclient //machine/swalton

still throws a NT_STATUS_BAD_NETWORK_NAME error when I try to connect to 
my home directory with SELinux set to "enforcing", and the error message 
in the smb log file reads

'/home/swalton' does not exist or is not a directory, when connecting to 
[swalton]

[Daniel J Walsh]

Stephen Walton wrote:
> Vitaliy Ivanov wrote:
> > On Wednesday 28 September 2005 19:13, Stephen Walton wrote:
> > > With SELinux enabled, both smbclient and users on Windows machines fail
> > > to get access to home directories.  What magic chcon invocation do I 
> > > need?
> >
> > Solution 2 (might survive a reboot; I didn't actually try this one):
> >
> > [root]# setsebool -P samba_enable_home_dirs=1
>
> This does survive a reboot as it puts samba_enable_home_dirs in 
> /etc/selinux/targeted/booleans.local.  Unfortunately I tried doing 
> both this and
>
> setsebool -P smb_use_home_dirs=1
>
> to no avail.
>
> smbclient //machine/swalton
>
> still throws a NT_STATUS_BAD_NETWORK_NAME error when I try to connect 
> to my home directory with SELinux set to "enforcing", and the error 
> message in the smb log file reads
>
> '/home/swalton' does not exist or is not a directory, when connecting 
> to [swalton]

Are you seeing AVC messages in /var/log/messages or 
/var/log/audit/audit.log?

[Stephen Walton]

Daniel J Walsh wrote:
> Stephen Walton wrote:
> > smbclient //machine/swalton
> >
> > still throws a NT_STATUS_BAD_NETWORK_NAME error when I try to connect 
> > to my home directory with SELinux set to "enforcing", and the error 
> > message in the smb log file reads
> >
> > '/home/swalton' does not exist or is not a directory, when connecting 
> > to [swalton]
>
> Are you seeing AVC messages in /var/log/messages or 
> /var/log/audit/audit.log?

No, but perhaps I need a log level tweaked higher somewhere.  It is 100% 
reliably true that if I use system-config-securitylevel to set SELinux 
enforcing to off, smbclient works fine, and if I reset SELinux back to 
enforcing I see the above error messages again.  So SELinux is 
definitely the culprit here somehow.

[Deepak]

Hi,
I am new user of FC4. I had similar problem in my LAN
too.

have you checked if your linux hostname is configured
properly? SAMBA, SElinux conbination seems to
manipulte the hostname or somentihg like that. (I am
novice user :-) )

In my case I found out that my hostname set during the
installation of FC4 was somehow manipulated when I
tried to use samba and selinux. I had to manually set
my linux hostname (I used GUI tool) and its everything
is working.

because of this hostname thing even my httpd was not
working properly.

my problem before was when samba is running, windows
clients can locate the machine and browsers can locate
served page but when samba is stopped, everything
stops also.

I have no idea where the problem lies but its ok now.

--- Stephen Walton  wrote:
> Daniel J Walsh wrote:
> > Stephen Walton wrote:
> > > smbclient //machine/swalton
> > >
> > > still throws a NT_STATUS_BAD_NETWORK_NAME error
>
> when I try to connect
> > > to my home directory with SELinux set to
>
> "enforcing", and the error
> > > message in the smb log file reads
> > >
> > > '/home/swalton' does not exist or is not a
>
> directory, when connecting
> > > to [swalton]
> >
> > Are you seeing AVC messages in /var/log/messages
>
> or
> > /var/log/audit/audit.log?
>
> No, but perhaps I need a log level tweaked higher
> somewhere.  It is 100% 
> reliably true that if I use
> system-config-securitylevel to set SELinux 
> enforcing to off, smbclient works fine, and if I
> reset SELinux back to 
> enforcing I see the above error messages again.  So
> SELinux is 
> definitely the culprit here somehow.
>
> -- 
> fedora-list mailing list
> [e-mail]
> To unsubscribe:
> https://www.redhat.com/mailman/listinfo/fedora-list

________             
___  __ _____ _____ 
__  / / /_  _ _  _ \
_  /_/ / /  __//  __/
/_____/  ___/ ___/

Send instant messages to your online friends http://uk.messenger.yahoo.com

[Jonathan Underwood]

Stephen Walton wrote:
> I have the usual entry in smb.conf on my FC4 server:
>
> [homes]
>        comment = Home Directories
>        read only = No
>        browseable = No
>
> As an additional wrinkle, home directories on the server are physically 
> on /users but get mounted on demand on /home on both the server and on 
> client workstations using a typical LDAP/autofs setup.
>
> With SELinux enabled, both smbclient and users on Windows machines fail 
> to get access to home directories.  What magic chcon invocation do I need?

I had this issue too, solved by:

From Gnome desktop panel menus:

Desktop->System Settings->Security Level

(Alternatively run system-config-securitylevel from a command line)

Select SElinux tab, scroll down in the box at the bottom and expand the 
Samba section, and check "Allow samba to share users home directories"

Jonathan.

[Stephen Walton]

Jonathan Underwood wrote:
> I had this issue too, solved by:
>
> From Gnome desktop panel menus:
>
> Desktop->System Settings->Security Level
>
> Select SElinux tab, scroll down in the box at the bottom and expand 
> the Samba section, and check "Allow samba to share users home 
> directories"

This does the same thing as "setsebool -P samba_enable_home_dirs 1" from 
the command line, which I've already done on my machine.  Still doesn't 
work.

[Stephen Walton]

Deepak Shrestha wrote:
> have you checked if your linux hostname is configured
> properly?

Well, the 'hostname' command returns the fully qualified domain name of 
my host.  Is that what you mean?  Anyway, I'm not on a home LAN but on 
my campus network.

[Deepak]

My case is home lan. In my case something has messed
up the hostname given during installation (it seems
so) until I used the GNOME Network GUI tool to set the
host name.

--- Stephen Walton  wrote:
> Deepak Shrestha wrote:
> > have you checked if your linux hostname is
>
> configured
> > properly?
>
> Well, the 'hostname' command returns the fully
> qualified domain name of 
> my host.  Is that what you mean?  Anyway, I'm not on
> a home LAN but on 
> my campus network.
>
> -- 
> fedora-list mailing list
> [e-mail]
> To unsubscribe:
> https://www.redhat.com/mailman/listinfo/fedora-list

________             
___  __ _____ _____ 
__  / / /_  _ _  _ \
_  /_/ / /  __//  __/
/_____/  ___/ ___/

Send instant messages to your online friends http://uk.messenger.yahoo.com

[Daniel J Walsh]

Stephen Walton wrote:
> Daniel J Walsh wrote:
> > Stephen Walton wrote:
> > > smbclient //machine/swalton
> > >
> > > still throws a NT_STATUS_BAD_NETWORK_NAME error when I try to 
> > > connect to my home directory with SELinux set to "enforcing", and 
> > > the error message in the smb log file reads
> > >
> > > '/home/swalton' does not exist or is not a directory, when 
> > > connecting to [swalton]
> >
> > Are you seeing AVC messages in /var/log/messages or 
> > /var/log/audit/audit.log?
>
> No, but perhaps I need a log level tweaked higher somewhere.  It is 
> 100% reliably true that if I use system-config-securitylevel to set 
> SELinux enforcing to off, smbclient works fine, and if I reset SELinux 
> back to enforcing I see the above error messages again.  So SELinux is 
> definitely the culprit here somehow.

Install selinux-policy-targeted-sources

cd /etc/selinux/targeted/src/policy
make enableaudit; make load

Try the smbclient command

Grab the AVC messages

make clean; make load

to reset the policy.

[Stephen Walton]

Daniel J Walsh wrote:
> Install selinux-policy-targeted-sources
>
> cd /etc/selinux/targeted/src/policy
> make enableaudit; make load
>
> Try the smbclient command
>
> Grab the AVC messages

OK, I did this and it was pretty clear from the result that the problem 
was the labeling of /home.  In fact, the problem was the lack of 
labeling.  Because /home was still around from an original FC1 install 
on this system, it did not get labeled appropriately on install of FC4, 
and therefore smbclient didn't work with SELinux enabled.  A quick

# touch /.autorelabel

and a reboot fixed the problem.  FYI, the appropriate labels seem to be 
system_u:object_r:home_root_t for /home, user_u:object_r:user_home_dir_t 
for user directories in /home, and user_u:object_r:user_home_t for 
users' other files and directories.

Thanks to everyone for their help and patience with this problem.