Bug 1072695

Description of problem:
I have a win7 virtual machine.  In order to communicate with my fedora 20 host, I decided to setup a samba server and have win7 mount my fedora 20 box.  Setting up samba was easy.  I even followed the selinux suggestion in /etc/samba/smb.conf

setsebool -P samba_export_all_rw on

However, every time my win7 box creates a new directory (or renames or deletes) inside the samba shared folder, selinux throws out these errors.

I thought the whole point of telling selinux to 'export all rw' was to allow the top level directory and everyone below it to be 'selinux friendly'.  I am hoping I don't have to explicitly give permission for every single directory created below the top level share directory.  That would be very frustrating.

SELinux is preventing /usr/sbin/smbd from 'setattr' accesses on the directory Shared.

*****  Plugin samba_share (89.9 confidence) suggests   ***********************

If you want to allow smbd to have setattr access on the Shared directory
Then you need to change the label on 'Shared'
Do
# semanage fcontext -a -t samba_share_t 'Shared'
# restorecon  -v 'Shared'

*****  Plugin catchall_labels (9.27 confidence) suggests   *******************

If you want to allow smbd to have setattr access on the Shared directory
Then you need to change the label on Shared
Do
# semanage fcontext -a -t FILE_TYPE 'Shared'
where FILE_TYPE is one of the following: auth_cache_t, samba_log_t, samba_share_t, samba_var_t, smbd_tmp_t, smbd_tmpfs_t, smbd_var_run_t. 
Then execute: 
restorecon -v 'Shared'


*****  Plugin catchall (2.25 confidence) suggests   **************************

If you believe that smbd should be allowed setattr access on the Shared directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep smbd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:smbd_t:s0
Target Context                system_u:object_r:default_t:s0
Target Objects                Shared [ dir ]
Source                        smbd
Source Path                   /usr/sbin/smbd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           samba-4.1.4-1.fc20.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-122.fc20.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.13.3-201.fc20.x86_64 #1 SMP Fri
                              Feb 14 19:08:32 UTC 2014 x86_64 x86_64
Alert Count                   12
First Seen                    2014-03-04 21:38:23 EST
Last Seen                     2014-03-04 22:16:11 EST
Local ID                      5a479d3b-6614-44cc-81dc-63bca8ab10bd

Raw Audit Messages
type=AVC msg=audit(1393989371.412:1405): avc:  denied  { setattr } for  pid=26165 comm="smbd" name="Shared" dev="dm-4" ino=24905453 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir


type=SYSCALL msg=audit(1393989371.412:1405): arch=x86_64 syscall=chmod success=no exit=EACCES a0=7f0c62b078d0 a1=41ed a2=0 a3=3 items=0 ppid=997 pid=26165 auid=4294967295 uid=1000 gid=0 euid=1000 suid=0 fsuid=1000 egid=1000 sgid=0 fsgid=1000 ses=4294967295 tty=(none) comm=smbd exe=/usr/sbin/smbd subj=system_u:system_r:smbd_t:s0 key=(null)

Hash: smbd,smbd_t,default_t,dir,setattr

Additional info:
reporter:       libreport-2.1.12
hashmarkername: setroubleshoot
kernel:         3.13.3-201.fc20.x86_64
type:           libreport