Bug 466121

Summary: SELinux prevents creation of /var/cache/samba/smb_krb5
Product: [Fedora] Fedora Reporter: Greg <gpanula>
Component: selinux-policyAssignee: Daniel Walsh <dwalsh>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: medium    
Version: 9CC: dwalsh, gpanula, jkubin, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-11-17 22:05:55 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
denied messages from /var/log/audit/audit.log none

Description Greg 2008-10-08 15:04:03 UTC 
Description of problem:
SELinux prevents creation of /var/cache/samba/smb_krb5 by samba(smb)
This prevents `net ads join -U administrator` from working properly.

Version-Release number of selected component (if applicable):
$ rpm -qa | grep sam
samba-common-3.0.28-0.el5.8
samba-3.0.28-0.el5.8
samba-client-3.0.28-0.el5.8
system-config-samba-1.2.39-1.el5

$ rpm -qa | grep sel
libselinux-1.33.4-5.el5
libselinux-python-1.33.4-5.el5
selinux-policy-2.4.6-137.el5
selinux-policy-targeted-2.4.6-137.el5


How reproducible:
Everytime

Steps to Reproduce:
1. Configure system per directions at http://www.planetmy.com/blog/how-to-join-fedora-core-6-samba-server-to-windows-2003-active-directory/
2. Execute `net ads join -U administrator`

  
Actual results:
 # net ads join -U administrator
[2008/10/08 09:41:22, 0] libads/kerberos.c:create_local_private_krb5_conf_for_domain(651)
  create_local_private_krb5_conf_for_domain: failed to create directory /var/cache/samba/smb_krb5. Error was Permission denied

I've also attached /var/log/audit/audit.log messages, see smb_krb5-denied.txt.


Expected results:
No error message... /var/cache/samba/smb_krb5 is silently created.

Additional info:
Comment 1 Greg 2008-10-08 15:06:41 UTC 
Created attachment 319757 [details]
denied messages from /var/log/audit/audit.log
Comment 2 Daniel Walsh 2008-10-08 21:16:30 UTC 
restorecon  /etc/krb5.conf

Everything else is 

Fixed in selinux-policy-3.3.1-100.fc9

You can add these rules for now using

# grep avc /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Comment 3 Daniel Walsh 2008-11-17 22:05:55 UTC 
Closing all bugs that have been in modified for over a month.  Please reopen if the bug is not actually fixed.