Bug 284581

Summary: SELinux prevents automatic addition of machine accounts in a Samba PDC
Product: Red Hat Enterprise Linux 5 Reporter: Markku Kolkka <markku.kolkka>
Component: selinux-policy-targetedAssignee: Daniel Walsh <dwalsh>
Status: CLOSED NEXTRELEASE QA Contact:
Severity: high Docs Contact:
Priority: medium    
Version: 5.0CC: dwalsh
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-09-10 18:28:45 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
AVC messages from audit.log none

Description Markku Kolkka 2007-09-10 13:50:55 UTC 
+++ This bug was initially created as a clone of Bug #229466 +++

Description of problem:
The Fedora machine is set up as a Samba PDC, but trying to join a Windows
machine in the domain fails if SELinux is in enforcing mode, the samba log shows
that machine account creation failed. In permissive mode joining succeeds, but
with a large number of SELinux alerts.

Version-Release number of selected component (if applicable):
selinux-policy-targeted-2.4.6-30.el5

How reproducible:
always

Steps to Reproduce:
1. Setup Samba as a primary domain controller
2. Log in a Windows machine and try to join the domain created in step 1.
  
Actual results:
The machine account isn't created and joining fails.

Expected results:
The Windows macine is added to the domain and a machine account created.

Additional info:
Changed our Samba PDC from Fedora 6 to CentOS 5, and the SELinux problems from
bug #229466 re-appeared. I'm attaching the AVC messages generated when joining a
machine with SELinux in permissive mode.
Comment 1 Markku Kolkka 2007-09-10 13:50:55 UTC 
Created attachment 191661 [details]
AVC messages from audit.log
Comment 2 Daniel Walsh 2007-09-10 18:28:45 UTC 
Fixed in u1 selinux-policy-2.4.6-89

Currently a preview is available on ftp://people.redhat.com/dwalsh/SELinux/RHEL5

You need to turn on the samba_domain_controller boolean

setsebool -P samba_domain_controller=1