Bug 1292783 – (RHEL6) CTDB: SELinux: AVC's triggered while executing smbcontrol via 49.winbind script

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1292783 - (RHEL6) CTDB: SELinux: AVC's triggered while executing smbcontrol via 49.winbind script

Summary:	(RHEL6) CTDB: SELinux: AVC's triggered while executing smbcontrol via 49.winb...

Status:	CLOSED WORKSFORME

Aliases:	None

Product:	Red Hat Gluster Storage
Classification:	Red Hat
Component:	samba (Show other bugs)
Sub Component:
Version:	3.1
Hardware:	Unspecified Unspecified

Priority	unspecified Severity high
Target Milestone:	---
Target Release:	---
Assigned To:	Anoop C S
QA Contact:	storage-qa-internal@redhat.com
Docs Contact:

URL:
Whiteboard:
Keywords:	Reopened, ZStream

Depends On:
Blocks:	1268895 1293785
	Show dependency tree / graph

Reported:	2015-12-18 05:44 EST by Michael Adam
Modified:	2018-04-30 04:04 EDT (History)
CC List:	8 users (show)

See Also:	1560732
Fixed In Version:
Doc Type:	Known Issue
Doc Text:	Current SELinux policy prevents ctdb's 49.winbind event script from executing smbcontrol. This can create inconsistent state in winbind, because when a public IP address is moved away from a node, winbind fails to drop connections made through that IP address.
Story Points:	---
Clone Of:	1291194
Clones:	1293785 (view as bug list)
Environment:
Last Closed:	2018-04-30 04:04:50 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Comment 2 Michael Adam 2015-12-21 15:28:45 EST

We really should have some fix or workaround for this.

Ultimately this needs to be fixed in RHEL selinux policy, as far as I can tell, but this is broken in RHGS installs using CTDB_MANAGES_WINBIND for CTDB.

Comment 4 Michael Adam 2016-02-01 17:54:56 EST

same comment as for bug #1291194 applies:

the text should read

"prevents ctdb's 49.winbind event script from executing smbcontrol"

Comment 6 Michael Adam 2016-02-03 07:01:11 EST

Thanks, the text looks good now,

Comment 11 Amar Tumballi 2018-04-19 00:16:51 EDT

Closed the samba bugs in bulk when PM_Score was less than 0. As the team was working on few of them, opening all of them.

Note You need to log in before you can comment on or make changes to this bug.