Re: selinux: AVC postfix and samba

17.06.2026 22:07, [email protected] wrote:
> On Mittwoch, 17. Juni 2026 17:25:26 Mitteleuropäische Sommerzeit Andrei
> Borzenkov wrote:
>> 17.06.2026 15:45, [email protected] wrote:
>>> ls -laZ /run/samba/winbindd
>>> total 0
>>> drwxr-xr-x. 2 root root system_u:object_r:smbd_var_run_t:s0  60 16.
>>> Jun 20:56 .
>>> drwxr-xr-x. 5 root root system_u:object_r:smbd_var_run_t:s0 180 16.
>>> Jun 20:56 ..
>>> srwxrwxrwx. 1 root root system_u:object_r:smbd_var_run_t:s0   0 16.
>>> Jun 20:56 pipe
>>
>> What is the context of the /usr/sbin/winbindd?
>>
>> bor@leap16:~> ls -Z /usr/sbin/winbindd
>> system_u:object_r:winbind_exec_t:s0 /usr/sbin/winbindd
>> bor@leap16:~>
> 
> ls -Z /usr/sbin/winbindd
> system_u:object_r:winbind_exec_t:s0 /usr/sbin/winbindd
> 
>>
>> Or are you using non-standard samba packages?
> 
> I use the samba addc packages from
> https://download.opensuse.org/repositories/network:samba:STABLE/16.0

Then contact the maintainer(s) of these packages. The fact is that your 
winbindd runs in the wrong context, apparently unconfined_service_t.

The default SELinux policy allows access to the UNIX pipe with the label 
winbind_var_run_t and connection to the UNIX socket in the domain winbind_t:

bor@leap16:~> sesearch -A -s postfix_smtp_t -t winbind_var_run_t -c 
sock_file
allow nsswitch_domain winbind_var_run_t:sock_file { append getattr open 
write };
bor@leap16:~> sesearch -A -s postfix_smtp_t -t winbind_t -c 
unix_stream_socket
allow nsswitch_domain winbind_t:unix_stream_socket connectto;
bor@leap16:~>

And in your case the pipe has the smbd_var_run_t and the socket has the 
label unconfined_service_t.

bor@leap16:~> sesearch -A -s postfix_smtp_t -t smbd_var_run_t -c sock_file
bor@leap16:~> sesearch -A -s postfix_smtp_t -t unconfined_service_t -c 
unix_stream_socket
bor@leap16:~>


The former is strictly speaking the side effect of the latter. The 
policy has rules to automatically assign the correct label to the new 
files /run/samba/winbindd and below if the creating process has the 
correct context. These rules are not applicable here.

Show

systemctl cat winbind.service
ps -eZ | grep winbind