[Samba] Public shares in FC4 (update)

[Louis E Garcia II]

Ok, I did what you said but make load gave me errors:

Compiling policy ...
/usr/bin/checkpolicy  -o /etc/selinux/targeted/policy/policy.19
policy.conf
/usr/bin/checkpolicy:  loading policy configuration from policy.conf
domains/misc/local.te:6:ERROR 'unknown type smb_t' at token ';' on line
6340:
# and a file context (.fc) file in file_context/program.
allow smb_t default_t:dir search;
/usr/bin/checkpolicy:  error(s) encountered while parsing configuration
make: *** [/etc/selinux/targeted/policy/policy.19] Error 1

Guess smb_t doesn't exist. Maybe I should try samba_share_t like the
samba_selinux man page says?

-Louis

On Sat, 2006-02-25 at 17:48 -0500, Louis E Garcia II wrote:
> I get this for the operation:
> 
> type=AVC msg=audit(1140906974.651:180): avc:  denied  { search } for
> pid=10306 comm="smbd" name="/" dev=hda5 ino=2
> scontext=system_u:system_r:smbd_t tcontext=system_u:object_r:default_t
> tclass=dir
> type=SYSCALL msg=audit(1140906974.651:180): arch=40000003 syscall=195
> success=no exit=-13 a0=9ca6208 a1=bfb40c64 a2=343ff4 a3=bfb40c64 items=1
> pid=10306 auid=4294967295 uid=502 gid=0 euid=502 suid=0 fsuid=502
> egid=100 sgid=100 fsgid=100 comm="smbd" exe="/usr/sbin/smbd"
> type=CWD msg=audit(1140906974.651:180):  cwd="/"
> type=PATH msg=audit(1140906974.651:180): item=0 name="/data/public"
> flags=1  inode=2 dev=03:05 mode=040755 ouid=0 ogid=0 rdev=00:00
> 
> when I put this though audit2allow i get:
> 
> allow smb_t default_t:dir search;
> 
> I will put this in local.te and see what heppens.
> 
> Some thoughts; 
> 
> Should I replace dir with /data/public?
> 
> Do I have to do this every time the selinux-policy-targeted packaged is
> updated?
> 
> -Thanks 
> 
> 
> On Sat, 2006-02-25 at 00:35 -0600, Don Meyer wrote:
> > Looks like you have multiple SELinux issues to track down and 
> > resolve.  Hard telling whether they all trace back to a single cause though...
> > 
> > To have a better idea of how the errors trace to operations, open two 
> > shells on a console.   In one, "tail -f /var/log/audit/audit.log"  -- 
> > this will give you a live display of the logged warnings & 
> > errors.  In the other, try some operations -- restart your smb 
> > service, and try the operations that are giving your problems.  Watch 
> > the other console to see the AVC errors as they happen.
> > 
> > You can use "tail -f ..." and pipe the output to a /tmp file to 
> > capture snippets relevant to specific actions/operations.   These can 
> > then be processed through "audit2allow" to find the specific 
> > modifications that you'll need to add to your local.te file and then 
> > reload your SELinux policy.
> > 
> > -D
> > 
> > At 08:32 PM 2/24/2006, Louis E Garcia II wrote:
> > >On FC4 it's under /var/log/audit/audit.log. This is the only place I
> > >found AVC errors.
> > >
> > ># audit2allow -i /var/log/audit/audit.log
> > >allow auditd_t self:fifo_file write;
> > >allow cupsd_config_t proc_net_t:dir search;
> > >allow cupsd_config_t unconfined_t:fifo_file { getattr ioctl write };
> > >allow hald_t unconfined_t:fifo_file read;
> > >allow httpd_t crond_t:fifo_file read;
> > >allow nmbd_t unconfined_t:fifo_file write;
> > >allow rpcd_t unconfined_t:fifo_file read;
> > >allow smbd_t default_t:dir search;
> > >allow smbd_t file_t:dir { getattr search };
> > >allow smbd_t mnt_t:lnk_file read;
> > >allow smbd_t root_t:dir write;
> > >allow smbd_t unconfined_t:fifo_file write;
> > >allow system_dbusd_t unconfined_t:fifo_file read;
> > >
> > >I think I'm only worried about smb_t? There are 5 lines there, do I put
> > >them all in /etc/selinux/targeted/src/policy/domains/misc/local.te?
> > >
> > >or I only need some? I see nothing about /data/public access.
> > >
> > >-Louis
> > >
> > >On Fri, 2006-02-24 at 16:54 -0600, Don Meyer wrote:
> > > > [Caveat:  My systems are mostly RHEL4 based, I don't have a FC4
> > > > system handy to verify paths & package names.  But they should be
> > > > somewhat close...]
> > > >
> > > > First, you need to identify what the problem is:  If you cannot find
> > > > the AVC errors reported in your syslog, and decifer them to know how
> > > > to fix them manually, the easiest method is to run the following
> > > > utility command:
> > > >
> > > >          audit2allow -i /var/log/messages
> > > >
> > 
> > Don Meyer                                           <dlmeyer at uiuc.edu>
> > Network Manager, ACES Academic Computing Facility
> > Technical System Manager, ACES TeleNet System
> > UIUC College of ACES, Information Technology and Communication Services
> > 
> >    "They that can give up essential liberty to obtain a little 
> > temporary safety,
> >          deserve neither liberty or safety."     -- Benjamin Franklin, 1759 
> > 
>