Re: selinux: AVC postfix and samba
Andrei Borzenkov <[email protected]>
| Newsgroups | gmane.linux.suse.general |
|---|---|
| Message-ID | <[email protected]> |
17.06.2026 15:23, [email protected] wrote: > On Mittwoch, 17. Juni 2026 08:45:13 Mitteleuropäische Sommerzeit Andrei > Borzenkov wrote: >> 17.06.2026 00:44, [email protected] wrote: >>> Target Objects /run/samba/winbindd/pipe [ >>> unix_stream_socket ] >> >> Anything related to winbind in /etc/nsswitch.conf or >> /usr/etc/nsswitch.conf? > > Yep, for the samba domain I have > > passwd: compat winbind systemd > group: compat winbind systemd > shadow: compat systemd > > in my nsswitch.conf. Well, the policy already has postfix_server_domain_template(smtp) which should grant the postfix_smtp_t access to the objects required for NSS. But the context of the /run/samba/winbindd/pipe is wrong - it is supposed to be winbind_var_run_t. leap16:~ # matchpathcon /run/samba/winbindd/pipe /run/samba/winbindd/pipe system_u:object_r:winbind_var_run_t:s0 leap16:~ # matchpathcon /var/run/samba/winbindd/pipe /var/run/samba/winbindd/pipe system_u:object_r:winbind_var_run_t:s0 leap16:~ # leap16:~ # ps -Zp 2172 LABEL PID TTY TIME CMD system_u:system_r:winbind_t:s0 2172 ? 00:00:00 winbindd leap16:~ # ls -Z /run/samba/winbindd system_u:object_r:winbind_var_run_t:s0 pipe leap16:~ #