Re: selinux: AVC postfix and samba

On Donnerstag, 18. Juni 2026 11:00:18 Mitteleuropäische Sommerzeit 
Andrei Borzenkov wrote:
> 17.06.2026 22:07, [email protected] wrote:
> > On Mittwoch, 17. Juni 2026 17:25:26 Mitteleuropäische Sommerzeit
> > Andrei> 
> > Borzenkov wrote:
> >> 17.06.2026 15:45, [email protected] wrote:
> >>> ls -laZ /run/samba/winbindd
> >>> total 0
> >>> drwxr-xr-x. 2 root root system_u:object_r:smbd_var_run_t:s0  60
> >>> 16.
> >>> Jun 20:56 .
> >>> drwxr-xr-x. 5 root root system_u:object_r:smbd_var_run_t:s0 180
> >>> 16.
> >>> Jun 20:56 ..
> >>> srwxrwxrwx. 1 root root system_u:object_r:smbd_var_run_t:s0   0
> >>> 16.
> >>> Jun 20:56 pipe
> >> 
> >> What is the context of the /usr/sbin/winbindd?
> >> 
> >> bor@leap16:~> ls -Z /usr/sbin/winbindd
> >> system_u:object_r:winbind_exec_t:s0 /usr/sbin/winbindd
> >> bor@leap16:~>
> > 
> > ls -Z /usr/sbin/winbindd
> > system_u:object_r:winbind_exec_t:s0 /usr/sbin/winbindd
> > 
> >> Or are you using non-standard samba packages?
> > 
> > I use the samba addc packages from
> > https://download.opensuse.org/repositories/network:samba:STABLE/16.0
> 
> Then contact the maintainer(s) of these packages. The fact is that
> your winbindd runs in the wrong context, apparently
> unconfined_service_t.
> 
> The default SELinux policy allows access to the UNIX pipe with the
> label winbind_var_run_t and connection to the UNIX socket in the
> domain winbind_t:
> 
> bor@leap16:~> sesearch -A -s postfix_smtp_t -t winbind_var_run_t -c
> sock_file
> allow nsswitch_domain winbind_var_run_t:sock_file { append getattr
> open write };
> bor@leap16:~> sesearch -A -s postfix_smtp_t -t winbind_t -c
> unix_stream_socket
> allow nsswitch_domain winbind_t:unix_stream_socket connectto;
> bor@leap16:~>
> 
> And in your case the pipe has the smbd_var_run_t and the socket has
> the label unconfined_service_t.
> 
> bor@leap16:~> sesearch -A -s postfix_smtp_t -t smbd_var_run_t -c
> sock_file bor@leap16:~> sesearch -A -s postfix_smtp_t -t
> unconfined_service_t -c unix_stream_socket
> bor@leap16:~>
> 
> 
> The former is strictly speaking the side effect of the latter. The
> policy has rules to automatically assign the correct label to the new
> files /run/samba/winbindd and below if the creating process has the
> correct context. These rules are not applicable here.
> 
> Show
> 
> systemctl cat winbind.service
> ps -eZ | grep winbind

systemctl cat winbind.service
# /usr/lib/systemd/system/winbind.service
[Unit]
Description=Samba Winbind Daemon
Documentation=man:winbindd(8) man:samba(7) man:smb.conf(5)
After=network.target nmb.service
Before=nss-user-lookup.target
Wants=nss-user-lookup.target

[Service]
Type=notify
PIDFile=/run/samba/winbindd.pid
EnvironmentFile=-/etc/sysconfig/samba
Environment=KRB5CCNAME=/run/samba/krb5cc_samba
Environment=KRB5RCACHEDIR=/var/cache/krb5rcache
ExecStart=/usr/sbin/winbindd --foreground --no-process-group 
$WINBINDOPTIONS
ExecReload=/bin/kill -HUP $MAINPID
LimitCORE=infinity


[Install]



ps -eZ | grep winbind
system_u:system_r:winbind_t:s0  root        2397       1  0 Jun06 ?        
00:00:23 /usr/sbin/winbindd --foreground --no-process-group
system_u:system_r:winbind_t:s0  root        2554    2397  0 Jun06 ?        
00:00:17 /usr/sbin/winbindd --foreground --no-process-group
system_u:system_r:winbind_t:s0  root        2579    2397  0 Jun06 ?        
00:00:00 /usr/sbin/winbindd --foreground --no-process-group
system_u:system_r:winbind_t:s0  root        2619    2397  0 Jun06 ?        
00:00:04 /usr/sbin/winbindd --foreground --no-process-group