Bug 483513

Summary: Wrong suggestion when smb.conf is labeled with certain types
Product: [Fedora] Fedora Reporter: Murray McAllister <mmcallis>
Component: selinux-policyAssignee: Daniel Walsh <dwalsh>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 10CC: dwalsh, jkubin, mgrepl, vdanen
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-04-13 15:18:33 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
full denial viewed with sealert none

Description Murray McAllister 2009-02-02 01:41:39 UTC
Description of problem:

When /etc/samba/smb.conf is labeled with a type that the smbd_t domain does not have access to, sealert suggests labeling /etc/samba/smb.conf with the public_content_t type.


Version-Release number of selected component (if applicable):

selinux-policy-3.5.13-40.fc10.noarch
selinux-policy-targeted-3.5.13-40.fc10.noarch

How reproducible:

Always.

Steps to Reproduce:

1. Label /etc/samba/smb.conf with a type that the smbd_t domain does not have access to:
chcon -t httpd_sys_content_t /etc/samba/smb.conf
2. service smb start
3. check /var/log/messages or setroubleshoot browser.
  
Actual results:

Fix Command:

chcon -t public_content_t './smb.conf'

Expected results:

Fix Command:

chcon -t samba_etc_t /etc/samba/smb.conf

If there is a chance this type will change in future, perhaps the following is a better fix command:

restorecon -R -v /etc/samba/

Comment 1 Murray McAllister 2009-02-02 01:44:05 UTC
Created attachment 330571 [details]
full denial viewed with sealert

Comment 2 Daniel Walsh 2009-04-13 15:18:33 UTC
Fixed in setroubleshoot-plugins- 2.0.16-1