Description of problem:

It appears that selinux is preventing the Samba daemon from rotating the log files in /var/log/samba. I have not verified what happens once a file is not able to rotate as the AVC filed on the directory access and therefore did not list the name of the file it was trying to rotate.

Version-Release number of selected component (if applicable):

Currently running:
  selinux-policy-targeted-2.4.6-203.el5
  samba-3.0.33-3.7.el5

How reproducible:
  Always active

Steps to Reproduce:

1. Run Samba with selinux enforcing
  
Actual results:

auditd records an AVC denied error as follows:

type=AVC msg=audit(1235182541.483:5744): avc:  denied  { rename } for  pid=14959 comm="smbd" name="log.139.57.100.40" dev=sda1 ino=3963459 scontext=system_u:system_r:smbd_t:s0 tcontext=user_u:object_r:samba_log_t:s0 tclass=file
type=SYSCALL msg=audit(1235182541.483:5744): arch=c000003e syscall=82 success=no exit=-13 a0=2ba2379c41e0 a1=7fff736a9f70 a2=24 a3=30342e3030312e37 items=0 ppid=3962 pid=14959 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=system_u:system_r:smbd_t:s0 key=(null)

Expected results:

Old log rotated and saved for reference, new log started.

Additional info:

Looking at the last time I had a proper log rotation in /var/log/samba I would guess that this has been a problem ever since I went to EL5 back in July. Here is the selinux module that I am currently using to work around this problem. It seems to be working well.

module sambalogs 1.0;

require {
        type file_t;
        type smbd_t;
        type samba_log_t;
        class file { rename unlink };
        class dir getattr;
}

#============= smbd_t ==============
allow smbd_t file_t:dir getattr;
allow smbd_t samba_log_t:file { rename unlink };