[Samba] Public shares in FC4 (update)

[Louis E Garcia II]

I changed smb_t to smbd_t and not it's working.

Thanks for your help. --Louis

On Sat, 2006-02-25 at 18:08 -0500, Louis E Garcia II wrote:
> Ok, I did what you said but make load gave me errors:
> 
> Compiling policy ...
> /usr/bin/checkpolicy  -o /etc/selinux/targeted/policy/policy.19
> policy.conf
> /usr/bin/checkpolicy:  loading policy configuration from policy.conf
> domains/misc/local.te:6:ERROR 'unknown type smb_t' at token ';' on line
> 6340:
> # and a file context (.fc) file in file_context/program.
> allow smb_t default_t:dir search;
> /usr/bin/checkpolicy:  error(s) encountered while parsing configuration
> make: *** [/etc/selinux/targeted/policy/policy.19] Error 1
> 
> Guess smb_t doesn't exist. Maybe I should try samba_share_t like the
> samba_selinux man page says?
> 
> -Louis
> 
> On Sat, 2006-02-25 at 17:48 -0500, Louis E Garcia II wrote:
> > I get this for the operation:
> > 
> > type=AVC msg=audit(1140906974.651:180): avc:  denied  { search } for
> > pid=10306 comm="smbd" name="/" dev=hda5 ino=2
> > scontext=system_u:system_r:smbd_t tcontext=system_u:object_r:default_t
> > tclass=dir
> > type=SYSCALL msg=audit(1140906974.651:180): arch=40000003 syscall=195
> > success=no exit=-13 a0=9ca6208 a1=bfb40c64 a2=343ff4 a3=bfb40c64 items=1
> > pid=10306 auid=4294967295 uid=502 gid=0 euid=502 suid=0 fsuid=502
> > egid=100 sgid=100 fsgid=100 comm="smbd" exe="/usr/sbin/smbd"
> > type=CWD msg=audit(1140906974.651:180):  cwd="/"
> > type=PATH msg=audit(1140906974.651:180): item=0 name="/data/public"
> > flags=1  inode=2 dev=03:05 mode=040755 ouid=0 ogid=0 rdev=00:00
> > 
> > when I put this though audit2allow i get:
> > 
> > allow smb_t default_t:dir search;
> > 
> > I will put this in local.te and see what heppens.
> > 
> > Some thoughts; 
> > 
> > Should I replace dir with /data/public?
> > 
> > Do I have to do this every time the selinux-policy-targeted packaged is
> > updated?
> > 
> > -Thanks 
> > 
> > 
> > On Sat, 2006-02-25 at 00:35 -0600, Don Meyer wrote:
> > > Looks like you have multiple SELinux issues to track down and 
> > > resolve.  Hard telling whether they all trace back to a single cause though...
> > > 
> > > To have a better idea of how the errors trace to operations, open two 
> > > shells on a console.   In one, "tail -f /var/log/audit/audit.log"  -- 
> > > this will give you a live display of the logged warnings & 
> > > errors.  In the other, try some operations -- restart your smb 
> > > service, and try the operations that are giving your problems.  Watch 
> > > the other console to see the AVC errors as they happen.
> > > 
> > > You can use "tail -f ..." and pipe the output to a /tmp file to 
> > > capture snippets relevant to specific actions/operations.   These can 
> > > then be processed through "audit2allow" to find the specific 
> > > modifications that you'll need to add to your local.te file and then 
> > > reload your SELinux policy.
> > > 
> > > -D
> > > 
> > > At 08:32 PM 2/24/2006, Louis E Garcia II wrote:
> > > >On FC4 it's under /var/log/audit/audit.log. This is the only place I
> > > >found AVC errors.
> > > >
> > > ># audit2allow -i /var/log/audit/audit.log
> > > >allow auditd_t self:fifo_file write;
> > > >allow cupsd_config_t proc_net_t:dir search;
> > > >allow cupsd_config_t unconfined_t:fifo_file { getattr ioctl write };
> > > >allow hald_t unconfined_t:fifo_file read;
> > > >allow httpd_t crond_t:fifo_file read;
> > > >allow nmbd_t unconfined_t:fifo_file write;
> > > >allow rpcd_t unconfined_t:fifo_file read;
> > > >allow smbd_t default_t:dir search;
> > > >allow smbd_t file_t:dir { getattr search };
> > > >allow smbd_t mnt_t:lnk_file read;
> > > >allow smbd_t root_t:dir write;
> > > >allow smbd_t unconfined_t:fifo_file write;
> > > >allow system_dbusd_t unconfined_t:fifo_file read;
> > > >
> > > >I think I'm only worried about smb_t? There are 5 lines there, do I put
> > > >them all in /etc/selinux/targeted/src/policy/domains/misc/local.te?
> > > >
> > > >or I only need some? I see nothing about /data/public access.
> > > >
> > > >-Louis
> > > >
> > > >On Fri, 2006-02-24 at 16:54 -0600, Don Meyer wrote:
> > > > > [Caveat:  My systems are mostly RHEL4 based, I don't have a FC4
> > > > > system handy to verify paths & package names.  But they should be
> > > > > somewhat close...]
> > > > >
> > > > > First, you need to identify what the problem is:  If you cannot find
> > > > > the AVC errors reported in your syslog, and decifer them to know how
> > > > > to fix them manually, the easiest method is to run the following
> > > > > utility command:
> > > > >
> > > > >          audit2allow -i /var/log/messages
> > > > >
> > > 
> > > Don Meyer                                           <dlmeyer at uiuc.edu>
> > > Network Manager, ACES Academic Computing Facility
> > > Technical System Manager, ACES TeleNet System
> > > UIUC College of ACES, Information Technology and Communication Services
> > > 
> > >    "They that can give up essential liberty to obtain a little 
> > > temporary safety,
> > >          deserve neither liberty or safety."     -- Benjamin Franklin, 1759 
> > > 
> > 
>