Red Hat Bugzilla – Bug 705148
No audit logs of selinux denies for samba
Last modified: 2011-05-23 03:30:34 EDT
Description of problem: Selinux is denying Samba access to shared directories. The smbd.log file contains error messages, but the audit.log does not. Setting smbd_disable_trans to on resolves the issue. Version-Release number of selected component (if applicable): 1.7.18 How reproducible: Always Steps to Reproduce: 1. Fresh install of 5.6. 2. Setup a Samba share with security = share and guest access = ok. 3. Actual results: smbd.log file contains the following errors: '/disks/d1' does not exist of permission denied with connecting to [d1] Error was Permission denied audit.log contains no messages for smbd. Expected results: Expect to see audit deny messages. Additional info: It appears as though other audit related messages are also not logged for Samba. Attempting to share home directories without enabling the appropriate selinux boolean also results in no audit trail.
Transferring this to SE Linux policy. This doesn't sound like an audit system problem. The AVC should be logged by SE Linux and the audit rules have no real effect (other than to add additional data). But the policy does have "no audit" controls and maybe that is causing the issue? It may be that way because a file server could flood the logs with AVCs under the right situation. Not sure...
semodule -DB Will turn off the dontaudit rules. (semodule -B turns them back on) I would figure you need to label /disks directory as samba_share_t. # semanage fcontext -a -t samba_share_t '/disks(/.*)?' # restorecon -R -v /disks Should fix the problem.
Thanks for the responses. I wasn't sure if this was intentional or not, but it is confusing not seeing any audit logs. Of course setting the appropriate context resolves the problem.
What AVC's were you seeing when you disabled the dontaudits. I think part of the problem is we have dontaudits for search of default_t directories. In RHEL6 I believe we are now allowing search of these directories.
Also # rpm -q selinux-policy
Here is the AVC message: type=AVC msg=audit(1305913412.063:15): avc: denied { read } for pid=3280 comm="smbd" name="share" dev=dm-0 ino=443970 scontext=root:system_r:smbd_t:s0 tcontext=root:object_r:default_t:s0 tclass=dir [root@testbox audit]# rpm -q selinux-policy selinux-policy-2.4.6-300.el5
You will need to label /share directory # semanage fcontext -a -t samba_share_t 'PATHTO/share(/.*)?' # restorecon -R -v PATHTO/share