Bug 466121 - SELinux prevents creation of /var/cache/samba/smb_krb5
SELinux prevents creation of /var/cache/samba/smb_krb5
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
9
All Linux
medium Severity low
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-10-08 11:04 EDT by Greg
Modified: 2008-11-17 17:05 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-11-17 17:05:55 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
denied messages from /var/log/audit/audit.log (15.02 KB, text/plain)
2008-10-08 11:06 EDT, Greg
no flags Details

  None (edit)
Description Greg 2008-10-08 11:04:03 EDT
Description of problem:
SELinux prevents creation of /var/cache/samba/smb_krb5 by samba(smb)
This prevents `net ads join -U administrator` from working properly.

Version-Release number of selected component (if applicable):
$ rpm -qa | grep sam
samba-common-3.0.28-0.el5.8
samba-3.0.28-0.el5.8
samba-client-3.0.28-0.el5.8
system-config-samba-1.2.39-1.el5

$ rpm -qa | grep sel
libselinux-1.33.4-5.el5
libselinux-python-1.33.4-5.el5
selinux-policy-2.4.6-137.el5
selinux-policy-targeted-2.4.6-137.el5


How reproducible:
Everytime

Steps to Reproduce:
1. Configure system per directions at http://www.planetmy.com/blog/how-to-join-fedora-core-6-samba-server-to-windows-2003-active-directory/
2. Execute `net ads join -U administrator`

  
Actual results:
 # net ads join -U administrator
[2008/10/08 09:41:22, 0] libads/kerberos.c:create_local_private_krb5_conf_for_domain(651)
  create_local_private_krb5_conf_for_domain: failed to create directory /var/cache/samba/smb_krb5. Error was Permission denied

I've also attached /var/log/audit/audit.log messages, see smb_krb5-denied.txt.


Expected results:
No error message... /var/cache/samba/smb_krb5 is silently created.

Additional info:
Comment 1 Greg 2008-10-08 11:06:41 EDT
Created attachment 319757 [details]
denied messages from /var/log/audit/audit.log
Comment 2 Daniel Walsh 2008-10-08 17:16:30 EDT
restorecon  /etc/krb5.conf

Everything else is 

Fixed in selinux-policy-3.3.1-100.fc9

You can add these rules for now using

# grep avc /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Comment 3 Daniel Walsh 2008-11-17 17:05:55 EST
Closing all bugs that have been in modified for over a month.  Please reopen if the bug is not actually fixed.

Note You need to log in before you can comment on or make changes to this bug.