Bug 866761 - SELinux is preventing /usr/sbin/smbd from 'getattr' accesses on the file /var/public/test.file.
Summary: SELinux is preventing /usr/sbin/smbd from 'getattr' accesses on the file /var...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 17
Hardware: i686
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:3f2bbada941b2fe09230134bee1...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-10-16 04:53 UTC by Raj Upadhyaya
Modified: 2012-10-16 16:10 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-10-16 16:10:08 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)
File: type (9 bytes, text/plain)
2012-10-16 04:53 UTC, Raj Upadhyaya 		no flags Details
File: hashmarkername (14 bytes, text/plain)
2012-10-16 04:53 UTC, Raj Upadhyaya 		no flags Details
View All

Description Raj Upadhyaya 2012-10-16 04:53:51 UTC 
Description of problem:
I am trying to configure SAMBA on Fedora 17.  I have created this in the smb.conf
[public]
        comment = My Samba Share
        path = /var/public
        read only = no
;       browseable = yes
        guest ok = yes

and created a directory /var/public and chmod 777 to it.

I then used Nautilus to connect to the Windows Share.  It reports that SELinux has detected a problem.



Additional info:
libreport version: 2.0.14
kernel:         3.6.2
Comment 1 Raj Upadhyaya 2012-10-16 04:53:53 UTC 
Created attachment 627949 [details]
File: type
Comment 2 Raj Upadhyaya 2012-10-16 04:53:54 UTC 
Created attachment 627950 [details]
File: hashmarkername
Comment 3 Raj Upadhyaya 2012-10-16 05:03:49 UTC 
I tried creating an empty document in the samba share, but it fails because it tells me access denied.

 - Raj
Comment 4 Miroslav Grepl 2012-10-16 12:13:37 UTC 
Either you will need to setup proper labeling or you will need to turn on a boolean.

What AVC are you getting?
Comment 5 Daniel Walsh 2012-10-16 12:55:48 UTC 
# semanage fcontext -a -t samba_share_t "/var/public(/.*)?"
# restorecon -R -v /var/public

Then it will work fine for you.  You have to tell SELinux that this is samba data in this directory.
Comment 6 Raj Upadhyaya 2012-10-16 14:35:56 UTC 
Ok, that seems to fix it.  I will need to test with a Windows machine mounting the Linux share, but my guess is that will work as well.  What is creating the file test.file?  Can I delete it?  It is zero length.

- Raj
Comment 7 Daniel Walsh 2012-10-16 16:09:54 UTC 
Nothing to do with SELinux.

Miroslav we need some improvement on 

man samba_selinux and man smbd_selinux

samba_share_t needs to be called out more.
Note You need to log in before you can comment on or make changes to this bug.