RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 913762 - Start of nmbd always fails due to missing /var/nmbd and SELinux policy
Summary: Start of nmbd always fails due to missing /var/nmbd and SELinux policy
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: samba
Version: 6.4
Hardware: All
OS: Linux
unspecified
high
Target Milestone: rc
: ---
Assignee: Andreas Schneider
QA Contact: qe-baseos-daemons
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-02-22 00:48 UTC by Robert Scheck
Modified: 2013-04-26 08:42 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-02-22 01:02:09 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Robert Scheck 2013-02-22 00:48:28 UTC 
Description of problem:
Install the versions mentioned below (RHEL 6.4 GA) and put the following
into /etc/samba/smb.conf:

--- snipp ---
[global]
	workgroup = TEST
	netbios name = SAMBA
	server string = Samba server
	interfaces = em1
	load printers = No
	printcap name = /etc/printcap
	add user script = /usr/sbin/useradd "%u" -n -g users
	delete user script = /usr/sbin/userdel "%u"
	add group script = /usr/sbin/groupadd "%g"
	delete group script = /usr/sbin/groupdel "%g"
	delete user from group script = /usr/sbin/userdel "%u" "%g"
	add machine script = /usr/sbin/useradd -n -c "Workstation (%u)" -M -d /nohome -s /sbin/nologin "%u"
	logon drive = R:
	domain logons = Yes
	os level = 33
	preferred master = Yes
	domain master = Yes
	wins proxy = Yes
	wins support = Yes
	idmap config * : backend = tdb

[homes]
	comment = Home Directories
	valid users = %S
	read only = No
	browseable = No

[netlogon]
	comment = Network Logon Service
	path = /var/lib/samba/netlogon
	guest ok = Yes
--- snapp ---

Perform "service smb start" - works regular. Run "service nmb start" - just
fails. What happens? NMB tries to access /var/nmbd, which does not exist at
all by default. Additionally, SELinux yells a lot:

--- snipp ---
type=AVC msg=audit(1361468338.719:410): avc:  denied  { write } for  pid=7704 comm="nmbd" name="var" dev=sda4 ino=124649473 scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir
type=SYSCALL msg=audit(1361468338.719:410): arch=c000003e syscall=83 success=no exit=-13 a0=7f226b5bb0a2 a1=1ed a2=ffffffffffffff88 a3=7fff1b572490 items=0 ppid=1 pid=7704 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=29 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null)
type=AVC msg=audit(1361468388.630:411): avc:  denied  { write } for  pid=7748 comm="nmbd" name="var" dev=sda4 ino=124649473 scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir
type=SYSCALL msg=audit(1361468388.630:411): arch=c000003e syscall=83 success=no exit=-13 a0=7fcc02b660a2 a1=1ed a2=ffffffffffffff88 a3=7fffdb5d6480 items=0 ppid=1 pid=7748 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=29 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null)
type=AVC msg=audit(1361468719.597:455): avc:  denied  { write } for  pid=8656 comm="nmbd" name="nmbd" dev=sda4 ino=124650655 scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=dir
type=SYSCALL msg=audit(1361468719.597:455): arch=c000003e syscall=49 success=no exit=-13 a0=12 a1=7fff09b505e0 a2=6e a3=7fff09b502c0 items=0 ppid=1 pid=8656 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=29 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null)
type=AVC msg=audit(1361468871.752:457): avc:  denied  { add_name } for  pid=8729 comm="nmbd" name="unexpected" scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=dir
type=SYSCALL msg=audit(1361468871.752:457): arch=c000003e syscall=49 success=no exit=-13 a0=12 a1=7fff74a68bd0 a2=6e a3=7fff74a688b0 items=0 ppid=1 pid=8729 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=34 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null)
type=AVC msg=audit(1361468948.385:459): avc:  denied  { create } for  pid=8777 comm="nmbd" name="unexpected" scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=sock_file
type=SYSCALL msg=audit(1361468948.385:459): arch=c000003e syscall=49 success=no exit=-13 a0=12 a1=7fffc987f820 a2=6e a3=7fffc987f500 items=0 ppid=1 pid=8777 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=34 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null)
type=AVC msg=audit(1361469662.164:517): avc:  denied  { remove_name } for  pid=9434 comm="nmbd" name="unexpected" dev=sda4 ino=124650656 scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=dir
type=SYSCALL msg=audit(1361469662.164:517): arch=c000003e syscall=87 success=no exit=-13 a0=7f9993e83800 a1=ffffffff a2=0 a3=7fff285d1e70 items=0 ppid=1 pid=9434 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=34 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null)
type=AVC msg=audit(1361476829.756:911): avc:  denied  { unlink } for  pid=12040 comm="nmbd" name="unexpected" dev=sda4 ino=124650656 scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=sock_file
type=SYSCALL msg=audit(1361476829.756:911): arch=c000003e syscall=87 success=no exit=-13 a0=7fcea97419d0 a1=ffffffff a2=0 a3=7ffff64dd910 items=0 ppid=1 pid=12040 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=44 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null)
type=AVC msg=audit(1361476831.075:912): avc:  denied  { unlink } for  pid=12056 comm="nmbd" name="unexpected" dev=sda4 ino=124650656 scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=sock_file
type=SYSCALL msg=audit(1361476831.075:912): arch=c000003e syscall=87 success=no exit=-13 a0=7f6d3161a9d0 a1=ffffffff a2=0 a3=7fffc57ffac0 items=0 ppid=1 pid=12056 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=44 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null)
type=AVC msg=audit(1361476831.941:913): avc:  denied  { unlink } for  pid=12085 comm="nmbd" name="unexpected" dev=sda4 ino=124650656 scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=sock_file
type=SYSCALL msg=audit(1361476831.941:913): arch=c000003e syscall=87 success=no exit=-13 a0=7f232f0fb9d0 a1=ffffffff a2=0 a3=7fff69210cd0 items=0 ppid=1 pid=12085 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=44 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null)
type=AVC msg=audit(1361476859.780:914): avc:  denied  { unlink } for  pid=12127 comm="nmbd" name="unexpected" dev=sda4 ino=124650656 scontext=unconfined_u:system_r:nmbd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=sock_file
type=SYSCALL msg=audit(1361476859.780:914): arch=c000003e syscall=87 success=no exit=-13 a0=7f47e6e259d0 a1=ffffffff a2=0 a3=7fff903e6f00 items=0 ppid=1 pid=12127 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=44 comm="nmbd" exe="/usr/sbin/nmbd" subj=unconfined_u:system_r:nmbd_t:s0 key=(null)
--- snapp ---

Workaround: mkdir /var/nmbd and create a SELinux policy like this:

--- snipp ---
allow nmbd_t var_t:dir { add_name write };
allow nmbd_t var_t:dir remove_name;
allow nmbd_t var_t:sock_file { create unlink };
--- snapp ---

Version-Release number of selected component (if applicable):
samba-3.6.9-151.el6.x86_64
samba-common-3.6.9-151.el6.x86_64
samba-winbind-3.6.9-151.el6.x86_64
samba-winbind-clients-3.6.9-151.el6.x86_64

How reproducible:
Everytime, see above and below.
  
Actual results:
Start of nmbd always fails due to missing /var/nmbd and SELinux policy.

Expected results:
Simply working nmbd.

Additional info:
- https://bugzilla.samba.org/show_bug.cgi?id=8230
- http://gitweb.samba.org/?p=samba.git;a=commit;h=a10029b854a7bfb536b9ed1cd0c4383f9ff8b3c0
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628121
- http://gitweb.samba.org/?p=samba.git;a=commit;h=edd3e8b03aa0bca85d4a9a62b35471e76a1f9390
- http://gitweb.samba.org/?p=samba.git;a=commit;h=b2c62d639d7fd565d39a999d500018b290b5279f
Comment 1 Robert Scheck 2013-02-22 00:53:58 UTC 
GNA! Figured out that we got tricked by RHN which somehow did not ship the
updated SELinux policy in the first "yum update run", running another "yum 
update" brought it. Actually now that 

selinux-policy-3.7.19-195.el6_4.1.noarch.rpm
selinux-policy-targeted-3.7.19-195.el6_4.1.noarch.rpm

are applied, everything works again as expected. Sorry for the trouble!
Comment 2 Robert Scheck 2013-02-22 00:54:48 UTC 
May somebody close this as NOTABUG? I'm lacking the permissions to do so.
Comment 3 Guenther Deschner 2013-02-22 01:02:09 UTC 
Closing as not a bug - as requested by the reporter. 

Anyway - Thanks for reporting !
Comment 4 Moray.Henderson 2013-04-26 08:42:37 UTC 
You mean you accept /var/nmbd as a valid directory?  

http://www.pathname.com/fhs/pub/fhs-2.3.html#THEVARHIERARCHY :
"Applications must generally not add directories to the top level of /var."
Note You need to log in before you can comment on or make changes to this bug.