Bug 466121 - SELinux prevents creation of /var/cache/samba/smb_krb5
Summary: SELinux prevents creation of /var/cache/samba/smb_krb5
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 9
Hardware: All
OS: Linux
medium
low
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-10-08 15:04 UTC by Greg
Modified: 2008-11-17 22:05 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-11-17 22:05:55 UTC
Type: ---


Attachments (Terms of Use)
denied messages from /var/log/audit/audit.log (15.02 KB, text/plain)
2008-10-08 15:06 UTC, Greg
no flags Details

Description Greg 2008-10-08 15:04:03 UTC
Description of problem:
SELinux prevents creation of /var/cache/samba/smb_krb5 by samba(smb)
This prevents `net ads join -U administrator` from working properly.

Version-Release number of selected component (if applicable):
$ rpm -qa | grep sam
samba-common-3.0.28-0.el5.8
samba-3.0.28-0.el5.8
samba-client-3.0.28-0.el5.8
system-config-samba-1.2.39-1.el5

$ rpm -qa | grep sel
libselinux-1.33.4-5.el5
libselinux-python-1.33.4-5.el5
selinux-policy-2.4.6-137.el5
selinux-policy-targeted-2.4.6-137.el5


How reproducible:
Everytime

Steps to Reproduce:
1. Configure system per directions at http://www.planetmy.com/blog/how-to-join-fedora-core-6-samba-server-to-windows-2003-active-directory/
2. Execute `net ads join -U administrator`

  
Actual results:
 # net ads join -U administrator
[2008/10/08 09:41:22, 0] libads/kerberos.c:create_local_private_krb5_conf_for_domain(651)
  create_local_private_krb5_conf_for_domain: failed to create directory /var/cache/samba/smb_krb5. Error was Permission denied

I've also attached /var/log/audit/audit.log messages, see smb_krb5-denied.txt.


Expected results:
No error message... /var/cache/samba/smb_krb5 is silently created.

Additional info:

Comment 1 Greg 2008-10-08 15:06:41 UTC
Created attachment 319757 [details]
denied messages from /var/log/audit/audit.log

Comment 2 Daniel Walsh 2008-10-08 21:16:30 UTC
restorecon  /etc/krb5.conf

Everything else is 

Fixed in selinux-policy-3.3.1-100.fc9

You can add these rules for now using

# grep avc /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Comment 3 Daniel Walsh 2008-11-17 22:05:55 UTC
Closing all bugs that have been in modified for over a month.  Please reopen if the bug is not actually fixed.


Note You need to log in before you can comment on or make changes to this bug.