Re: selinux: AVC postfix and samba

On Mittwoch, 17. Juni 2026 14:40:04 Mitteleuropäische Sommerzeit Andrei 
Borzenkov wrote:
> 17.06.2026 15:23, [email protected] wrote:
> > On Mittwoch, 17. Juni 2026 08:45:13 Mitteleuropäische Sommerzeit
> > Andrei> 
> > Borzenkov wrote:
> >> 17.06.2026 00:44, [email protected] wrote:
> >>> Target Objects                /run/samba/winbindd/pipe [
> >>> unix_stream_socket ]
> >> 
> >> Anything related to winbind in /etc/nsswitch.conf or
> >> /usr/etc/nsswitch.conf?
> > 
> > Yep, for the samba domain I have
> > 
> > passwd:   compat winbind systemd
> > group:    compat winbind systemd
> > shadow:   compat systemd
> > 
> > in my nsswitch.conf.
> 
> Well, the policy already has
> 
> postfix_server_domain_template(smtp)
> 
> which should grant the postfix_smtp_t access to the objects required
> for NSS. But the context of the /run/samba/winbindd/pipe is wrong -
> it is supposed to be winbind_var_run_t.
> 
> leap16:~ # matchpathcon /run/samba/winbindd/pipe
> /run/samba/winbindd/pipe	system_u:object_r:winbind_var_run_t:s0
> leap16:~ # matchpathcon /var/run/samba/winbindd/pipe
> /var/run/samba/winbindd/pipe	
system_u:object_r:winbind_var_run_t:s0
> leap16:~ #
> 
> 
> leap16:~ # ps -Zp 2172
> LABEL                               PID TTY          TIME CMD
> system_u:system_r:winbind_t:s0     2172 ?        00:00:00 winbindd
> leap16:~ # ls -Z /run/samba/winbindd
> system_u:object_r:winbind_var_run_t:s0 pipe
> leap16:~ #


ls -laZ /run/samba/winbindd
total 0
drwxr-xr-x. 2 root root system_u:object_r:smbd_var_run_t:s0  60 16. Jun 
20:56 .
drwxr-xr-x. 5 root root system_u:object_r:smbd_var_run_t:s0 180 16. Jun 
20:56 ..
srwxrwxrwx. 1 root root system_u:object_r:smbd_var_run_t:s0   0 16. Jun 
20:56 pipe