Bug 913762
| Summary: | Start of nmbd always fails due to missing /var/nmbd and SELinux policy | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Robert Scheck <redhat-bugzilla> |
| Component: | samba | Assignee: | Andreas Schneider <asn> |
| Status: | CLOSED NOTABUG | QA Contact: | qe-baseos-daemons |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.4 | CC: | gdeschner, Moray.Henderson, robert.scheck |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-02-22 01:02:09 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
GNA! Figured out that we got tricked by RHN which somehow did not ship the updated SELinux policy in the first "yum update run", running another "yum update" brought it. Actually now that selinux-policy-3.7.19-195.el6_4.1.noarch.rpm selinux-policy-targeted-3.7.19-195.el6_4.1.noarch.rpm are applied, everything works again as expected. Sorry for the trouble! May somebody close this as NOTABUG? I'm lacking the permissions to do so. Closing as not a bug - as requested by the reporter. Anyway - Thanks for reporting ! You mean you accept /var/nmbd as a valid directory? http://www.pathname.com/fhs/pub/fhs-2.3.html#THEVARHIERARCHY : "Applications must generally not add directories to the top level of /var." |
Description of problem: Install the versions mentioned below (RHEL 6.4 GA) and put the following into /etc/samba/smb.conf: --- snipp --- [global] workgroup = TEST netbios name = SAMBA server string = Samba server interfaces = em1 load printers = No printcap name = /etc/printcap add user script = /usr/sbin/useradd "%u" -n -g users delete user script = /usr/sbin/userdel "%u" add group script = /usr/sbin/groupadd "%g" delete group script = /usr/sbin/groupdel "%g" delete user from group script = /usr/sbin/userdel "%u" "%g" add machine script = /usr/sbin/useradd -n -c "Workstation (%u)" -M -d /nohome -s /sbin/nologin "%u" logon drive = R: domain logons = Yes os level = 33 preferred master = Yes domain master = Yes wins proxy = Yes wins support = Yes idmap config * : backend = tdb [homes] comment = Home Directories valid users = %S read only = No browseable = No [netlogon] comment = Network Logon Service path = /var/lib/samba/netlogon guest ok = Yes --- snapp --- Perform "service smb start" - works regular. Run "service nmb start" - just fails. What happens? NMB tries to access /var/nmbd, which does not exist at all by default. Additionally, SELinux yells a lot: --- snipp --- type=AVC msg=audit(1361468338.719:410): avc: denied { write } for pid=7704 comm="nmbd" name="var" dev=sda4 ino=124649473 scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir type=SYSCALL msg=audit(1361468338.719:410): arch=c000003e syscall=83 success=no exit=-13 a0=7f226b5bb0a2 a1=1ed a2=ffffffffffffff88 a3=7fff1b572490 items=0 ppid=1 pid=7704 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=29 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null) type=AVC msg=audit(1361468388.630:411): avc: denied { write } for pid=7748 comm="nmbd" name="var" dev=sda4 ino=124649473 scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir type=SYSCALL msg=audit(1361468388.630:411): arch=c000003e syscall=83 success=no exit=-13 a0=7fcc02b660a2 a1=1ed a2=ffffffffffffff88 a3=7fffdb5d6480 items=0 ppid=1 pid=7748 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=29 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null) type=AVC msg=audit(1361468719.597:455): avc: denied { write } for pid=8656 comm="nmbd" name="nmbd" dev=sda4 ino=124650655 scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=dir type=SYSCALL msg=audit(1361468719.597:455): arch=c000003e syscall=49 success=no exit=-13 a0=12 a1=7fff09b505e0 a2=6e a3=7fff09b502c0 items=0 ppid=1 pid=8656 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=29 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null) type=AVC msg=audit(1361468871.752:457): avc: denied { add_name } for pid=8729 comm="nmbd" name="unexpected" scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=dir type=SYSCALL msg=audit(1361468871.752:457): arch=c000003e syscall=49 success=no exit=-13 a0=12 a1=7fff74a68bd0 a2=6e a3=7fff74a688b0 items=0 ppid=1 pid=8729 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=34 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null) type=AVC msg=audit(1361468948.385:459): avc: denied { create } for pid=8777 comm="nmbd" name="unexpected" scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=sock_file type=SYSCALL msg=audit(1361468948.385:459): arch=c000003e syscall=49 success=no exit=-13 a0=12 a1=7fffc987f820 a2=6e a3=7fffc987f500 items=0 ppid=1 pid=8777 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=34 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null) type=AVC msg=audit(1361469662.164:517): avc: denied { remove_name } for pid=9434 comm="nmbd" name="unexpected" dev=sda4 ino=124650656 scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=dir type=SYSCALL msg=audit(1361469662.164:517): arch=c000003e syscall=87 success=no exit=-13 a0=7f9993e83800 a1=ffffffff a2=0 a3=7fff285d1e70 items=0 ppid=1 pid=9434 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=34 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null) type=AVC msg=audit(1361476829.756:911): avc: denied { unlink } for pid=12040 comm="nmbd" name="unexpected" dev=sda4 ino=124650656 scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=sock_file type=SYSCALL msg=audit(1361476829.756:911): arch=c000003e syscall=87 success=no exit=-13 a0=7fcea97419d0 a1=ffffffff a2=0 a3=7ffff64dd910 items=0 ppid=1 pid=12040 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=44 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null) type=AVC msg=audit(1361476831.075:912): avc: denied { unlink } for pid=12056 comm="nmbd" name="unexpected" dev=sda4 ino=124650656 scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=sock_file type=SYSCALL msg=audit(1361476831.075:912): arch=c000003e syscall=87 success=no exit=-13 a0=7f6d3161a9d0 a1=ffffffff a2=0 a3=7fffc57ffac0 items=0 ppid=1 pid=12056 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=44 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null) type=AVC msg=audit(1361476831.941:913): avc: denied { unlink } for pid=12085 comm="nmbd" name="unexpected" dev=sda4 ino=124650656 scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=sock_file type=SYSCALL msg=audit(1361476831.941:913): arch=c000003e syscall=87 success=no exit=-13 a0=7f232f0fb9d0 a1=ffffffff a2=0 a3=7fff69210cd0 items=0 ppid=1 pid=12085 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=44 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null) type=AVC msg=audit(1361476859.780:914): avc: denied { unlink } for pid=12127 comm="nmbd" name="unexpected" dev=sda4 ino=124650656 scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=sock_file type=SYSCALL msg=audit(1361476859.780:914): arch=c000003e syscall=87 success=no exit=-13 a0=7f47e6e259d0 a1=ffffffff a2=0 a3=7fff903e6f00 items=0 ppid=1 pid=12127 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=44 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null) --- snapp --- Workaround: mkdir /var/nmbd and create a SELinux policy like this: --- snipp --- allow nmbd_t var_t:dir { add_name write }; allow nmbd_t var_t:dir remove_name; allow nmbd_t var_t:sock_file { create unlink }; --- snapp --- Version-Release number of selected component (if applicable): samba-3.6.9-151.el6.x86_64 samba-common-3.6.9-151.el6.x86_64 samba-winbind-3.6.9-151.el6.x86_64 samba-winbind-clients-3.6.9-151.el6.x86_64 How reproducible: Everytime, see above and below. Actual results: Start of nmbd always fails due to missing /var/nmbd and SELinux policy. Expected results: Simply working nmbd. Additional info: - https://bugzilla.samba.org/show_bug.cgi?id=8230 - http://gitweb.samba.org/?p=samba.git;a=commit;h=a10029b854a7bfb536b9ed1cd0c4383f9ff8b3c0 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628121 - http://gitweb.samba.org/?p=samba.git;a=commit;h=edd3e8b03aa0bca85d4a9a62b35471e76a1f9390 - http://gitweb.samba.org/?p=samba.git;a=commit;h=b2c62d639d7fd565d39a999d500018b290b5279f