Bug 243467 - Selinux deny smbd access to the krb replay cache
Selinux deny smbd access to the krb replay cache
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
All Linux
low Severity low
: ---
: ---
Assigned To: Daniel Walsh
Ben Levenson
Depends On:
  Show dependency treegraph
Reported: 2007-06-08 16:51 EDT by Simo Sorce
Modified: 2007-11-30 17:12 EST (History)
0 users

See Also:
Fixed In Version: Current
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2007-08-22 10:10:36 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Simo Sorce 2007-06-08 16:51:27 EDT
Description of problem:
Samba refuses authentication when configured with security=ads

Version-Release number of selected component (if applicable):

How reproducible:
access samba from a windows client in security=ads mode

Steps to Reproduce:
1. Join samba to an AD domain
2. Try to access the server from a windows client
Actual results:
access denied

Expected results:
Access allowed

Additional info:
The problem seem to be related to a policy blocking smbd from accessing the
kerberos replay cache.

AVC log:
type=AVC msg=audit(1181334367.409:23585): avc:  denied  { getattr } for 
pid=3113 comm="smbd" name="rhfc7-044_0" dev=dm-0 ino=979997
scontext=system_u:system_r:smbd_t:s0 tcontext=root:object_r:winbind_tmp_t:s0
type=SYSCALL msg=audit(1181334367.409:23585): arch=40000003 syscall=195
success=no exit=-13 a0=8112b578 a1=bfb36e38 a2=c39ff4 a3=8112b578 items=0
ppid=2281 pid=3113 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) comm="smbd" exe="/usr/sbin/smbd"
subj=system_u:system_r:smbd_t:s0 key=(null)     
type=AVC_PATH msg=audit(1181334367.409:23585):  path="/var/tmp/rhfc7-044_0"
Samba log:
[2007/06/08 16:26:07, 1] libads/kerberos_verify.c:ads_verify_ticket(397)
  ads_verify_ticket: krb5_get_server_rcache failed (Permission denied in replay
cache code)  
[2007/06/08 16:26:07, 10] passdb/secrets.c:secrets_named_mutex_release(942)
  secrets_named_mutex: released mutex for replay cache mutex
[2007/06/08 16:26:07, 1] smbd/sesssetup.c:reply_spnego_kerberos(316)
  Failed to verify incoming ticket with error NT_STATUS_LOGON_FAILURE!
Selinux configuration:
# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 21
Policy from config file:        targeted
Comment 1 Daniel Walsh 2007-06-11 09:44:58 EDT
Fixed in selinux-policy-2.6.4-14.
Comment 2 Daniel Walsh 2007-08-22 10:10:36 EDT
Closing as fixes are in the current release

Note You need to log in before you can comment on or make changes to this bug.