Re: selinux: AVC postfix and samba

18.06.2026 12:42, [email protected] wrote:
...
 >>>>>> ls -Z /usr/sbin/winbindd
>>> system_u:object_r:winbind_exec_t:s0 /usr/sbin/winbindd
>>>
>>>> Or are you using non-standard samba packages?
>>>
>>> I use the samba addc packages from
>>> https://download.opensuse.org/repositories/network:samba:STABLE/16.0
>>
>> Then contact the maintainer(s) of these packages. The fact is that
>> your winbindd runs in the wrong context, apparently
>> unconfined_service_t.
>>
>> The default SELinux policy allows access to the UNIX pipe with the
>> label winbind_var_run_t and connection to the UNIX socket in the
>> domain winbind_t:
>>
>> bor@leap16:~> sesearch -A -s postfix_smtp_t -t winbind_var_run_t -c
>> sock_file
>> allow nsswitch_domain winbind_var_run_t:sock_file { append getattr
>> open write };
>> bor@leap16:~> sesearch -A -s postfix_smtp_t -t winbind_t -c
>> unix_stream_socket
>> allow nsswitch_domain winbind_t:unix_stream_socket connectto;
>> bor@leap16:~>
>>
>> And in your case the pipe has the smbd_var_run_t and the socket has
>> the label unconfined_service_t.
>>
>> bor@leap16:~> sesearch -A -s postfix_smtp_t -t smbd_var_run_t -c
>> sock_file bor@leap16:~> sesearch -A -s postfix_smtp_t -t
>> unconfined_service_t -c unix_stream_socket
>> bor@leap16:~>
>>
>>
>> The former is strictly speaking the side effect of the latter. The
>> policy has rules to automatically assign the correct label to the new
>> files /run/samba/winbindd and below if the creating process has the
>> correct context. These rules are not applicable here.
>>
>> Show
>>
>> systemctl cat winbind.service
>> ps -eZ | grep winbind
> 
> systemctl cat winbind.service
> # /usr/lib/systemd/system/winbind.service
> [Unit]
> Description=Samba Winbind Daemon
> Documentation=man:winbindd(8) man:samba(7) man:smb.conf(5)
> After=network.target nmb.service
> Before=nss-user-lookup.target
> Wants=nss-user-lookup.target
> 
> [Service]
> Type=notify
> PIDFile=/run/samba/winbindd.pid
> EnvironmentFile=-/etc/sysconfig/samba
> Environment=KRB5CCNAME=/run/samba/krb5cc_samba
> Environment=KRB5RCACHEDIR=/var/cache/krb5rcache
> ExecStart=/usr/sbin/winbindd --foreground --no-process-group
> $WINBINDOPTIONS
> ExecReload=/bin/kill -HUP $MAINPID
> LimitCORE=infinity
> 
> 
> [Install]
> 
> 
> 
> ps -eZ | grep winbind
> system_u:system_r:winbind_t:s0  root        2397       1  0 Jun06 ?
> 00:00:23 /usr/sbin/winbindd --foreground --no-process-group
> system_u:system_r:winbind_t:s0  root        2554    2397  0 Jun06 ?
> 00:00:17 /usr/sbin/winbindd --foreground --no-process-group
> system_u:system_r:winbind_t:s0  root        2579    2397  0 Jun06 ?
> 00:00:00 /usr/sbin/winbindd --foreground --no-process-group
> system_u:system_r:winbind_t:s0  root        2619    2397  0 Jun06 ?
> 00:00:04 /usr/sbin/winbindd --foreground --no-process-group

Do you still see those AVCs?

What programs are using the socket?

lsof /run/samba/winbindd/pipe