selinux: AVC postfix and samba

Hi *,

does anyone have an idea, why I get these AVCs?
Where is the connection between postfix and samba here?

---------------------

SELinux is preventing smtp from write access on the sock_file pipe.

*****  Plugin catchall (100. confidence) suggests   
**************************

If you believe that smtp should be allowed write access on the pipe 
sock_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'smtp' --raw | audit2allow -M my-smtp
# semodule -X 300 -i my-smtp.pp

Additional Information:
Source Context                system_u:system_r:postfix_smtp_t:s0
Target Context                system_u:object_r:smbd_var_run_t:s0
Target Objects                pipe [ sock_file ]
Source                        smtp
Source Path                   smtp
Port                          <Unknown>
Host                          <server>
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-
targeted-20250627+git378.e27ad25be-
                              160000.1.1.noarch
Local Policy RPM              selinux-policy-
targeted-20250627+git378.e27ad25be-
                              160000.1.1.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     <server>
Platform                      Linux <server> 6.12.0-160000.34-default #1
                              SMP PREEMPT_DYNAMIC Tue Jun  2 11:19:13 
UTC 2026
                              (9550304) x86_64 x86_64
Alert Count                   1
First Seen                    2026-06-16 21:05:27 CEST
Last Seen                     2026-06-16 21:05:27 CEST
Local ID                      9032a2cc-ac4f-4632-844b-96479878c66d

Raw Audit Messages
type=AVC msg=audit(1781636727.364:379): avc:  denied  { write } for  
pid=5429 comm="smtp" name="pipe" dev="tmpfs" ino=3160 
scontext=system_u:system_r:postfix_smtp_t:s0 
tcontext=system_u:object_r:smbd_var_run_t:s0 tclass=sock_file 
permissive=1


Hash: smtp,postfix_smtp_t,smbd_var_run_t,sock_file,write

---------------------

SELinux is preventing smtp from connectto access on the 
unix_stream_socket /run/samba/winbindd/pipe.

*****  Plugin catchall (100. confidence) suggests   
**************************

If you believe that smtp should be allowed connectto access on the pipe 
unix_stream_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'smtp' --raw | audit2allow -M my-smtp
# semodule -X 300 -i my-smtp.pp

Additional Information:
Source Context                system_u:system_r:postfix_smtp_t:s0
Target Context                system_u:system_r:unconfined_service_t:s0
Target Objects                /run/samba/winbindd/pipe [ 
unix_stream_socket ]
Source                        smtp
Source Path                   smtp
Port                          <Unknown>
Host                          <server>
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-
targeted-20250627+git378.e27ad25be-
                              160000.1.1.noarch
Local Policy RPM              selinux-policy-
targeted-20250627+git378.e27ad25be-
                              160000.1.1.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     <server>
Platform                      Linux <server> 6.12.0-160000.34-default #1
                              SMP PREEMPT_DYNAMIC Tue Jun  2 11:19:13 
UTC 2026
                              (9550304) x86_64 x86_64
Alert Count                   1
First Seen                    2026-06-16 21:05:27 CEST
Last Seen                     2026-06-16 21:05:27 CEST
Local ID                      61b1dec3-1222-4c6c-812c-b0ea1723c4bb

Raw Audit Messages
type=AVC msg=audit(1781636727.364:380): avc:  denied  { connectto } for  
pid=5429 comm="smtp" path="/run/samba/winbindd/pipe" 
scontext=system_u:system_r:postfix_smtp_t:s0 
tcontext=system_u:system_r:unconfined_service_t:s0 
tclass=unix_stream_socket permissive=1


Hash: 
smtp,postfix_smtp_t,unconfined_service_t,unix_stream_socket,connectto

--------------------------

TIA.

Bye.
Michael