Bug 144959 - Samba capability issues
Summary: Samba capability issues
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: rawhide
Hardware: i386
OS: Linux
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact:
Depends On:
TreeView+ depends on / blocked
Reported: 2005-01-13 00:30 UTC by Ivan Gyurdiev
Modified: 2007-11-30 22:10 UTC (History)
0 users

Clone Of:
Last Closed: 2005-01-20 18:37:30 UTC

Attachments (Terms of Use)

Description Ivan Gyurdiev 2005-01-13 00:30:40 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5)
Gecko/20041228 Firefox/1.0 Fedora/1.0-8

Description of problem:
audit(1105575656.361:0): avc:  denied  { dac_override } for  pid=6705
exe=/usr/sbin/smbd capability=1 scontext=user_u:system_r:smbd_t
tcontext=user_u:system_r:smbd_t tclass=capability

audit(1105575656.361:0): avc:  denied  { dac_read_search } for 
pid=6705 exe=/usr/sbin/smbd capability=2
scontext=user_u:system_r:smbd_t tcontext=user_u:system_r:smbd_t


I think I'll go give strict policy another shot... let's 
see how that goes...

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. See summary    

Additional info:

Comment 1 Ivan Gyurdiev 2005-01-13 00:34:23 UTC
"I think I'll go give strict policy another shot... let's 
see how that goes..."

Maybe not - where are all the booleans for samba home dirs, etc..
Strict policy has a lot less boleans shown under samba-security-level.

Comment 2 Daniel Walsh 2005-01-13 01:14:59 UTC
Run it in permissive mode for a while and then give me the AVC Messages.
I have added the dac permissions.


Comment 3 Ivan Gyurdiev 2005-01-13 01:53:18 UTC
What am I looking for?
I tried reading/writing/creating/deleting files and directories,
looking at content from windows, mounting shares, and doing
nmblookup - nothing out of the usual... or should I leave it on 
for a longer time.. 

Actually I can't really reproduce the dac messages consistently
anymore either. They used to show up when I restarted smb, but now
they don't, and I just saw a single case of dac_override.

Comment 4 Ivan Gyurdiev 2005-01-13 02:05:31 UTC
...or did you just want me to test the strict policy in permissive mode? 

Sorry if I misunderstood :)

Comment 5 Daniel Walsh 2005-01-13 14:36:24 UTC
Yes I want you to run all your tests in permissive mode and then get
me the AVC messages.  That way I am not fixing them one at a time.  
But it looks like you already did most of the testing and all you
found is the two dac errors.


Comment 6 Ivan Gyurdiev 2005-01-13 18:25:30 UTC
Yes, I have seen no other errors. 

Why doesn't the strict policy 
show all the booleans (and smbd_enable_home_dirs in particular)?
Is that intentional?

Comment 7 Daniel Walsh 2005-01-13 18:42:06 UTC
getsebool -a 

should show all booleans

Note You need to log in before you can comment on or make changes to this bug.