LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 08-19-2009, 03:21 PM   #1
mia_tech
Member
 
Registered: Dec 2007
Location: FL, USA
Distribution: CentOS 5.3, Ubuntu 9.04
Posts: 234

Rep: Reputation: 16
problem with samba and selinux


guys, I have a share on my server which users access through map drive from the Window$ machines; I'm doing this with SAMBA, but the problem is that when I put SELinux in Enforcing mode, it will not let anyone access the share. I have to put it in permisive (I believe that's the correct word). At first the share was not available because I needed to add
Code:
chcon -R -t samba_share_t '/mnt/storage'
, but still was not working, untill I put SELinux in permisive mode; then, it worked fine.... is it possible to make samba work with SELinux in Enforcing mode?

thanks
 
Old 08-19-2009, 11:58 PM   #2
blacky_5251
Member
 
Registered: Oct 2004
Location: Adelaide Hills, South Australia
Distribution: RHEL 5&6 CentOS 5, 6 & 7
Posts: 573

Rep: Reputation: 56
Check your SE Boolean settings:-
Code:
2.6.18-128.4.1.el5[root@www ~]# getsebool -a | grep smb
allow_smbd_anon_write --> off
smbd_disable_trans --> off
2.6.18-128.4.1.el5[root@www ~]# getsebool -a | grep samba
samba_domain_controller --> off
samba_enable_home_dirs --> on
samba_export_all_ro --> off
samba_export_all_rw --> on
samba_share_nfs --> on
use_samba_home_dirs --> on
virt_use_samba --> off
2.6.18-128.4.1.el5[root@www ~]#
These are my settings, and I'm happily working with Samba with SELinux in enforcing mode.

Don't forget to use "setsebool" with the -a option to make your changes permanent.

Let me know how you get on.
 
Old 08-21-2009, 02:43 AM   #3
mia_tech
Member
 
Registered: Dec 2007
Location: FL, USA
Distribution: CentOS 5.3, Ubuntu 9.04
Posts: 234

Original Poster
Rep: Reputation: 16
Man, I use
Code:
setsebool -P samba_export_all_ro on
setsebool -P samba_export_all_rw on
but when I try to access the drive from the network, SELinux is blocking access to the file

Code:
SELinux is preventing the samba daemon from accessing a ro file system
is not a premission issue because when I put SELinux in permisive mode, I can access the share no problem. Beside for troubleshooting measures I gave the share 777 access

Last edited by mia_tech; 08-21-2009 at 02:45 AM.
 
Old 08-21-2009, 04:05 PM   #4
blacky_5251
Member
 
Registered: Oct 2004
Location: Adelaide Hills, South Australia
Distribution: RHEL 5&6 CentOS 5, 6 & 7
Posts: 573

Rep: Reputation: 56
I don't know which distro or version of SELinux you're using, so perhaps you have an older version with a crappy policy.

You could use audit2allow to generate local policy settings that you could then load. I know I've had to do that for some postfix issues, but not Samba.

Have you googled the error message from the audit log file?
 
Old 08-21-2009, 07:42 PM   #5
mia_tech
Member
 
Registered: Dec 2007
Location: FL, USA
Distribution: CentOS 5.3, Ubuntu 9.04
Posts: 234

Original Poster
Rep: Reputation: 16
Quote:
Originally Posted by blacky_5251 View Post
I don't know which distro or version of SELinux you're using, so perhaps you have an older version with a crappy policy.

You could use audit2allow to generate local policy settings that you could then load. I know I've had to do that for some postfix issues, but not Samba.

Have you googled the error message from the audit log file?
Yes, I have google-ed and I'm working on a few solution. As far as my Linux version, I'm using CentOS 5.3 with all updates installed, so I don't think that would be a problem.
 
Old 08-21-2009, 09:35 PM   #6
blacky_5251
Member
 
Registered: Oct 2004
Location: Adelaide Hills, South Australia
Distribution: RHEL 5&6 CentOS 5, 6 & 7
Posts: 573

Rep: Reputation: 56
Quote:
As far as my Linux version, I'm using CentOS 5.3 with all updates installed, so I don't think that would be a problem.
Agreed. I'm also using CentOS 5.3 fully patched, so I'm puzzled as to why you're having problems.

Could you post the error from /var/log/audit/audit.log and your smb.conf file?

Also, have you tried using setroubleshooter? There's a good chance it will tell you how to allow the behaviour that SELinux is blocking.
 
Old 08-29-2009, 12:41 PM   #7
jamturtle
LQ Newbie
 
Registered: Aug 2009
Posts: 1

Rep: Reputation: 0
Hi guys I was having the same problem and this is how I solved it.
I don't mount on the typical /mnt I usually create a directory called /space and add disks there. Anyways, I had setup a samba share on /space/backup01 using
#chcon -R -t samba_share_t /space/backup01
SELinux just did not let me access it using samba from any windows system. I kept on getting errors saying it was a default_t label yet when I checked with
# ls -ldZ /space/backup01
I would see that indeed it was a samba_share_t label.
I did several relabels and verified that samba was working correctly by turning off SELinux.
Anyways the error message regarding the default_t label keyed me into checking the parent directory's label and sure enough it was default_t
I ran
#chcon -t samba_share_t /space/
Not using -R so that the other directories in /space would not get a samba label.
This did the trick. Now I have samba working with SELinux enforcing.
mia_tech, /mnt has a special system label mnt_t. I am not sure how this affects the solution I just described nor am I sure setting /mnt to samba_share_t is a wise choice.

Well I hope this helps a little bit.

Good luck!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
selinux, autofs and samba wesbarris Linux - Security 2 03-04-2009 12:16 AM
SELinux issues with Samba samohn Linux - Newbie 1 11-25-2008 03:38 PM
samba pdc selinux problem "rename" %m.log WorldIsNotFair Linux - Server 2 07-23-2008 09:15 PM
SELINUX Samba jerzeejerome Linux - Networking 1 12-23-2006 07:33 PM
I think SELinux killed samba, but I am not sure neddis Linux - Newbie 1 07-19-2006 11:24 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 03:35 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration