Re: selinux: AVC postfix and samba
Andrei Borzenkov <[email protected]>
| Newsgroups | gmane.linux.suse.general |
|---|---|
| Message-ID | <[email protected]> |
17.06.2026 15:45, [email protected] wrote: > On Mittwoch, 17. Juni 2026 14:40:04 Mitteleuropäische Sommerzeit Andrei > Borzenkov wrote: >> 17.06.2026 15:23, [email protected] wrote: >>> On Mittwoch, 17. Juni 2026 08:45:13 Mitteleuropäische Sommerzeit >>> Andrei> >>> Borzenkov wrote: >>>> 17.06.2026 00:44, [email protected] wrote: >>>>> Target Objects /run/samba/winbindd/pipe [ >>>>> unix_stream_socket ] >>>> >>>> Anything related to winbind in /etc/nsswitch.conf or >>>> /usr/etc/nsswitch.conf? >>> >>> Yep, for the samba domain I have >>> >>> passwd: compat winbind systemd >>> group: compat winbind systemd >>> shadow: compat systemd >>> >>> in my nsswitch.conf. >> >> Well, the policy already has >> >> postfix_server_domain_template(smtp) >> >> which should grant the postfix_smtp_t access to the objects required >> for NSS. But the context of the /run/samba/winbindd/pipe is wrong - >> it is supposed to be winbind_var_run_t. >> >> leap16:~ # matchpathcon /run/samba/winbindd/pipe >> /run/samba/winbindd/pipe system_u:object_r:winbind_var_run_t:s0 >> leap16:~ # matchpathcon /var/run/samba/winbindd/pipe >> /var/run/samba/winbindd/pipe > system_u:object_r:winbind_var_run_t:s0 >> leap16:~ # >> >> >> leap16:~ # ps -Zp 2172 >> LABEL PID TTY TIME CMD >> system_u:system_r:winbind_t:s0 2172 ? 00:00:00 winbindd >> leap16:~ # ls -Z /run/samba/winbindd >> system_u:object_r:winbind_var_run_t:s0 pipe >> leap16:~ # > > > ls -laZ /run/samba/winbindd > total 0 > drwxr-xr-x. 2 root root system_u:object_r:smbd_var_run_t:s0 60 16. Jun > 20:56 . That's wrong > drwxr-xr-x. 5 root root system_u:object_r:smbd_var_run_t:s0 180 16. Jun > 20:56 .. That's correct > srwxrwxrwx. 1 root root system_u:object_r:smbd_var_run_t:s0 0 16. Jun > 20:56 pipe That's wrong. Sorry, no idea. Try disabling samba/windbind services, rebooting and starting one by one checking the labels. When I start winbind.service I get the correct labels. bor@leap16:~> ls -Z /run/samba/ bor@leap16:~> sudo systemctl start winbind.service bor@leap16:~> ls -Z /run/samba/ system_u:object_r:winbind_var_run_t:s0 winbindd system_u:object_r:smbd_var_run_t:s0 winbindd.pid bor@leap16:~> ls -Z /run/samba/winbindd system_u:object_r:winbind_var_run_t:s0 pipe bor@leap16:~>