SAMBA home directories and SELinux

[Stephen Walton]

I have the usual entry in smb.conf on my FC4 server:

[homes]
comment = Home Directories
read only = No
browseable = No

As an additional wrinkle, home directories on the server are physically
on /users but get mounted on demand on /home on both the server and on
client workstations using a typical LDAP/autofs setup.

With SELinux enabled, both smbclient and users on Windows machines fail
to get access to home directories. What magic chcon invocation do I need?

[Vitaliy Ivanov]

Post by Stephen Walton
[homes]
comment = Home Directories
read only = No
browseable = No
As an additional wrinkle, home directories on the server are physically
on /users but get mounted on demand on /home on both the server and on
client workstations using a typical LDAP/autofs setup.
With SELinux enabled, both smbclient and users on Windows machines fail
to get access to home directories. What magic chcon invocation do I need?

Solution 1 (temporary; won't survive a re-boot):

Issue the command:

[root]# setsebool samba_enable_home_dirs=1

Solution 2 (might survive a reboot; I didn't actually try this one):

[root]# setsebool -P samba_enable_home_dirs=1

Solution 3 (survives a reboot):

This is the solution I ultimately settled on. Go to the /etc/selinux/targeted
directory. Create a text file called booleans.local, and put the
"samba_enable_home_dirs=1" line in it (without the quotes, of course).

Solution 4 (surives a reboot, but removes all SELinux protection):

Edit /etc/selinux/config. Change the line SELINUX=enforcing to
SELINUX=permissive or SELINUX=disabled.

I've got same problem earlier and tried the 3 solution from the list above.
It worked.

Best.

[Stephen Walton]

Post by Vitaliy Ivanov

Post by Stephen Walton
With SELinux enabled, both smbclient and users on Windows machines fail
to get access to home directories. What magic chcon invocation do I need?

[root]# setsebool -P samba_enable_home_dirs=1

This does survive a reboot as it puts samba_enable_home_dirs in
/etc/selinux/targeted/booleans.local. Unfortunately I tried doing both
this and

setsebool -P smb_use_home_dirs=1

to no avail.

smbclient //machine/swalton

still throws a NT_STATUS_BAD_NETWORK_NAME error when I try to connect to
my home directory with SELinux set to "enforcing", and the error message
in the smb log file reads

'/home/swalton' does not exist or is not a directory, when connecting to
[swalton]

[Daniel J Walsh]

Post by Stephen Walton

Post by Vitaliy Ivanov

Post by Stephen Walton
With SELinux enabled, both smbclient and users on Windows machines fail
to get access to home directories. What magic chcon invocation do I need?

[root]# setsebool -P samba_enable_home_dirs=1

This does survive a reboot as it puts samba_enable_home_dirs in
/etc/selinux/targeted/booleans.local. Unfortunately I tried doing
both this and
setsebool -P smb_use_home_dirs=1
to no avail.
smbclient //machine/swalton
still throws a NT_STATUS_BAD_NETWORK_NAME error when I try to connect
to my home directory with SELinux set to "enforcing", and the error
message in the smb log file reads
'/home/swalton' does not exist or is not a directory, when connecting
to [swalton]

Are you seeing AVC messages in /var/log/messages or
/var/log/audit/audit.log?

--

[Stephen Walton]

Post by Daniel J Walsh

Post by Stephen Walton
smbclient //machine/swalton
still throws a NT_STATUS_BAD_NETWORK_NAME error when I try to connect
to my home directory with SELinux set to "enforcing", and the error
message in the smb log file reads
'/home/swalton' does not exist or is not a directory, when connecting
to [swalton]

Are you seeing AVC messages in /var/log/messages or
/var/log/audit/audit.log?

No, but perhaps I need a log level tweaked higher somewhere. It is 100%
reliably true that if I use system-config-securitylevel to set SELinux
enforcing to off, smbclient works fine, and if I reset SELinux back to
enforcing I see the above error messages again. So SELinux is
definitely the culprit here somehow.

[Daniel J Walsh]

Post by Stephen Walton

Post by Daniel J Walsh

Post by Stephen Walton
smbclient //machine/swalton
still throws a NT_STATUS_BAD_NETWORK_NAME error when I try to
connect to my home directory with SELinux set to "enforcing", and
the error message in the smb log file reads
'/home/swalton' does not exist or is not a directory, when
connecting to [swalton]

Are you seeing AVC messages in /var/log/messages or
/var/log/audit/audit.log?

No, but perhaps I need a log level tweaked higher somewhere. It is
100% reliably true that if I use system-config-securitylevel to set
SELinux enforcing to off, smbclient works fine, and if I reset SELinux
back to enforcing I see the above error messages again. So SELinux is
definitely the culprit here somehow.

Install selinux-policy-targeted-sources

cd /etc/selinux/targeted/src/policy
make enableaudit; make load

Try the smbclient command

Grab the AVC messages

make clean; make load

to reset the policy.

--

[Stephen Walton]

Post by Daniel J Walsh
Install selinux-policy-targeted-sources
cd /etc/selinux/targeted/src/policy
make enableaudit; make load
Try the smbclient command
Grab the AVC messages

OK, I did this and it was pretty clear from the result that the problem
was the labeling of /home. In fact, the problem was the lack of
labeling. Because /home was still around from an original FC1 install
on this system, it did not get labeled appropriately on install of FC4,
and therefore smbclient didn't work with SELinux enabled. A quick

# touch /.autorelabel

and a reboot fixed the problem. FYI, the appropriate labels seem to be
system_u:object_r:home_root_t for /home, user_u:object_r:user_home_dir_t
for user directories in /home, and user_u:object_r:user_home_t for
users' other files and directories.

Thanks to everyone for their help and patience with this problem.

[Stephen Walton]

Post by Daniel J Walsh
Install selinux-policy-targeted-sources
cd /etc/selinux/targeted/src/policy
make enableaudit; make load
Try the smbclient command
Grab the AVC messages

OK, I did this and it was pretty clear from the result that the problem
was the labeling of /home. In fact, the problem was the lack of
labeling. Because /home was still around from an original FC1 install
on this system, it did not get labeled appropriately on install of FC4,
and therefore smbclient didn't work with SELinux enabled. A quick

# touch /.autorelabel

and a reboot fixed the problem. FYI, the appropriate labels seem to be
system_u:object_r:home_root_t for /home, user_u:object_r:user_home_dir_t
for user directories in /home, and user_u:object_r:user_home_t for
users' other files and directories.

Thanks to everyone for their help and patience with this problem.

[Daniel J Walsh]

Post by Stephen Walton

Post by Daniel J Walsh

Post by Stephen Walton
smbclient //machine/swalton
still throws a NT_STATUS_BAD_NETWORK_NAME error when I try to
connect to my home directory with SELinux set to "enforcing", and
the error message in the smb log file reads
'/home/swalton' does not exist or is not a directory, when
connecting to [swalton]

Are you seeing AVC messages in /var/log/messages or
/var/log/audit/audit.log?

No, but perhaps I need a log level tweaked higher somewhere. It is
100% reliably true that if I use system-config-securitylevel to set
SELinux enforcing to off, smbclient works fine, and if I reset SELinux
back to enforcing I see the above error messages again. So SELinux is
definitely the culprit here somehow.

Install selinux-policy-targeted-sources

cd /etc/selinux/targeted/src/policy
make enableaudit; make load

Try the smbclient command

Grab the AVC messages

make clean; make load

to reset the policy.

--

[Stephen Walton]

Post by Daniel J Walsh

Post by Stephen Walton
smbclient //machine/swalton
still throws a NT_STATUS_BAD_NETWORK_NAME error when I try to connect
to my home directory with SELinux set to "enforcing", and the error
message in the smb log file reads
'/home/swalton' does not exist or is not a directory, when connecting
to [swalton]

Are you seeing AVC messages in /var/log/messages or
/var/log/audit/audit.log?

No, but perhaps I need a log level tweaked higher somewhere. It is 100%
reliably true that if I use system-config-securitylevel to set SELinux
enforcing to off, smbclient works fine, and if I reset SELinux back to
enforcing I see the above error messages again. So SELinux is
definitely the culprit here somehow.

[Daniel J Walsh]

Post by Stephen Walton

Post by Vitaliy Ivanov

Post by Stephen Walton
With SELinux enabled, both smbclient and users on Windows machines fail
to get access to home directories. What magic chcon invocation do I need?

[root]# setsebool -P samba_enable_home_dirs=1

This does survive a reboot as it puts samba_enable_home_dirs in
/etc/selinux/targeted/booleans.local. Unfortunately I tried doing
both this and
setsebool -P smb_use_home_dirs=1
to no avail.
smbclient //machine/swalton
still throws a NT_STATUS_BAD_NETWORK_NAME error when I try to connect
to my home directory with SELinux set to "enforcing", and the error
message in the smb log file reads
'/home/swalton' does not exist or is not a directory, when connecting
to [swalton]

Are you seeing AVC messages in /var/log/messages or
/var/log/audit/audit.log?

--

[Stephen Walton]

Post by Vitaliy Ivanov

Post by Stephen Walton
With SELinux enabled, both smbclient and users on Windows machines fail
to get access to home directories. What magic chcon invocation do I need?

[root]# setsebool -P samba_enable_home_dirs=1

This does survive a reboot as it puts samba_enable_home_dirs in
/etc/selinux/targeted/booleans.local. Unfortunately I tried doing both
this and

setsebool -P smb_use_home_dirs=1

to no avail.

smbclient //machine/swalton

still throws a NT_STATUS_BAD_NETWORK_NAME error when I try to connect to
my home directory with SELinux set to "enforcing", and the error message
in the smb log file reads

'/home/swalton' does not exist or is not a directory, when connecting to
[swalton]

[Stephen Walton]

I have the usual entry in smb.conf on my FC4 server:

[homes]
comment = Home Directories
read only = No
browseable = No

As an additional wrinkle, home directories on the server are physically
on /users but get mounted on demand on /home on both the server and on
client workstations using a typical LDAP/autofs setup.

With SELinux enabled, both smbclient and users on Windows machines fail
to get access to home directories. What magic chcon invocation do I need?

[Vitaliy Ivanov]

Post by Stephen Walton
[homes]
comment = Home Directories
read only = No
browseable = No
As an additional wrinkle, home directories on the server are physically
on /users but get mounted on demand on /home on both the server and on
client workstations using a typical LDAP/autofs setup.
With SELinux enabled, both smbclient and users on Windows machines fail
to get access to home directories. What magic chcon invocation do I need?

Solution 1 (temporary; won't survive a re-boot):

Issue the command:

[root]# setsebool samba_enable_home_dirs=1

Solution 2 (might survive a reboot; I didn't actually try this one):

[root]# setsebool -P samba_enable_home_dirs=1

Solution 3 (survives a reboot):

This is the solution I ultimately settled on. Go to the /etc/selinux/targeted
directory. Create a text file called booleans.local, and put the
"samba_enable_home_dirs=1" line in it (without the quotes, of course).

Solution 4 (surives a reboot, but removes all SELinux protection):

Edit /etc/selinux/config. Change the line SELINUX=enforcing to
SELINUX=permissive or SELINUX=disabled.

I've got same problem earlier and tried the 3 solution from the list above.
It worked.

Best.

[Deepak Shrestha]

Hi,
I am new user of FC4. I had similar problem in my LAN
too.

have you checked if your linux hostname is configured
properly? SAMBA, SElinux conbination seems to
manipulte the hostname or somentihg like that. (I am
novice user :-) )

In my case I found out that my hostname set during the
installation of FC4 was somehow manipulated when I
tried to use samba and selinux. I had to manually set
my linux hostname (I used GUI tool) and its everything
is working.

because of this hostname thing even my httpd was not
working properly.

my problem before was when samba is running, windows
clients can locate the machine and browsers can locate
served page but when samba is stopped, everything
stops also.

I have no idea where the problem lies but its ok now.

Post by Stephen Walton

Post by Daniel J Walsh

Post by Stephen Walton
smbclient //machine/swalton
still throws a NT_STATUS_BAD_NETWORK_NAME error

when I try to connect

Post by Daniel J Walsh

Post by Stephen Walton
to my home directory with SELinux set to

"enforcing", and the error

Post by Daniel J Walsh

Post by Stephen Walton
message in the smb log file reads
'/home/swalton' does not exist or is not a

directory, when connecting

Post by Daniel J Walsh

Post by Stephen Walton
to [swalton]

Are you seeing AVC messages in /var/log/messages

or

Post by Daniel J Walsh
/var/log/audit/audit.log?

No, but perhaps I need a log level tweaked higher
somewhere. It is 100%
reliably true that if I use
system-config-securitylevel to set SELinux
enforcing to off, smbclient works fine, and if I
reset SELinux back to
enforcing I see the above error messages again. So
SELinux is
definitely the culprit here somehow.
--
fedora-list mailing list
fedora-list at redhat.com
https://www.redhat.com/mailman/listinfo/fedora-list

________
___ __ \_____ _____
__ / / /_ _ \_ _ \
_ /_/ / / __// __/
/_____/ \___/ \___/

Send instant messages to your online friends http://uk.messenger.yahoo.com

[Stephen Walton]

Post by Deepak Shrestha
have you checked if your linux hostname is configured
properly?

Well, the 'hostname' command returns the fully qualified domain name of
my host. Is that what you mean? Anyway, I'm not on a home LAN but on
my campus network.

[Stephen Walton]

Post by Deepak Shrestha
have you checked if your linux hostname is configured
properly?

Well, the 'hostname' command returns the fully qualified domain name of
my host. Is that what you mean? Anyway, I'm not on a home LAN but on
my campus network.

[Jonathan Underwood]

Post by Stephen Walton
[homes]
comment = Home Directories
read only = No
browseable = No
As an additional wrinkle, home directories on the server are physically
on /users but get mounted on demand on /home on both the server and on
client workstations using a typical LDAP/autofs setup.
With SELinux enabled, both smbclient and users on Windows machines fail
to get access to home directories. What magic chcon invocation do I need?

I had this issue too, solved by:

From Gnome desktop panel menus:

Desktop->System Settings->Security Level

(Alternatively run system-config-securitylevel from a command line)

Select SElinux tab, scroll down in the box at the bottom and expand the
Samba section, and check "Allow samba to share users home directories"

Jonathan.

[Stephen Walton]

Post by Jonathan Underwood
Desktop->System Settings->Security Level
Select SElinux tab, scroll down in the box at the bottom and expand
the Samba section, and check "Allow samba to share users home
directories"

This does the same thing as "setsebool -P samba_enable_home_dirs 1" from
the command line, which I've already done on my machine. Still doesn't
work.

[Stephen Walton]

Post by Jonathan Underwood
Desktop->System Settings->Security Level
Select SElinux tab, scroll down in the box at the bottom and expand
the Samba section, and check "Allow samba to share users home
directories"

This does the same thing as "setsebool -P samba_enable_home_dirs 1" from
the command line, which I've already done on my machine. Still doesn't
work.

[Deepak Shrestha]

My case is home lan. In my case something has messed
up the hostname given during installation (it seems
so) until I used the GNOME Network GUI tool to set the
host name.

Post by Deepak Shrestha

Post by Deepak Shrestha
have you checked if your linux hostname is

configured

Post by Deepak Shrestha
properly?

Well, the 'hostname' command returns the fully
qualified domain name of
my host. Is that what you mean? Anyway, I'm not on
a home LAN but on
my campus network.
--
fedora-list mailing list
fedora-list at redhat.com
https://www.redhat.com/mailman/listinfo/fedora-list

________
___ __ \_____ _____
__ / / /_ _ \_ _ \
_ /_/ / / __// __/
/_____/ \___/ \___/

Send instant messages to your online friends http://uk.messenger.yahoo.com

[Deepak Shrestha]

Hi,
I am new user of FC4. I had similar problem in my LAN
too.

have you checked if your linux hostname is configured
properly? SAMBA, SElinux conbination seems to
manipulte the hostname or somentihg like that. (I am
novice user :-) )

In my case I found out that my hostname set during the
installation of FC4 was somehow manipulated when I
tried to use samba and selinux. I had to manually set
my linux hostname (I used GUI tool) and its everything
is working.

because of this hostname thing even my httpd was not
working properly.

my problem before was when samba is running, windows
clients can locate the machine and browsers can locate
served page but when samba is stopped, everything
stops also.

I have no idea where the problem lies but its ok now.

Post by Stephen Walton

Post by Daniel J Walsh

Post by Stephen Walton
smbclient //machine/swalton
still throws a NT_STATUS_BAD_NETWORK_NAME error

when I try to connect

Post by Daniel J Walsh

Post by Stephen Walton
to my home directory with SELinux set to

"enforcing", and the error

Post by Daniel J Walsh

Post by Stephen Walton
message in the smb log file reads
'/home/swalton' does not exist or is not a

directory, when connecting

Post by Daniel J Walsh

Post by Stephen Walton
to [swalton]

Are you seeing AVC messages in /var/log/messages

or

Post by Daniel J Walsh
/var/log/audit/audit.log?

No, but perhaps I need a log level tweaked higher
somewhere. It is 100%
reliably true that if I use
system-config-securitylevel to set SELinux
enforcing to off, smbclient works fine, and if I
reset SELinux back to
enforcing I see the above error messages again. So
SELinux is
definitely the culprit here somehow.
--
fedora-list mailing list
fedora-list at redhat.com
https://www.redhat.com/mailman/listinfo/fedora-list

________
___ __ \_____ _____
__ / / /_ _ \_ _ \
_ /_/ / / __// __/
/_____/ \___/ \___/

Send instant messages to your online friends http://uk.messenger.yahoo.com

[Jonathan Underwood]

Post by Stephen Walton
[homes]
comment = Home Directories
read only = No
browseable = No
As an additional wrinkle, home directories on the server are physically
on /users but get mounted on demand on /home on both the server and on
client workstations using a typical LDAP/autofs setup.
With SELinux enabled, both smbclient and users on Windows machines fail
to get access to home directories. What magic chcon invocation do I need?

I had this issue too, solved by:

From Gnome desktop panel menus:

Desktop->System Settings->Security Level

(Alternatively run system-config-securitylevel from a command line)

Select SElinux tab, scroll down in the box at the bottom and expand the
Samba section, and check "Allow samba to share users home directories"

Jonathan.

[Deepak Shrestha]

My case is home lan. In my case something has messed
up the hostname given during installation (it seems
so) until I used the GNOME Network GUI tool to set the
host name.

Post by Deepak Shrestha

Post by Deepak Shrestha
have you checked if your linux hostname is

configured

Post by Deepak Shrestha
properly?

Well, the 'hostname' command returns the fully
qualified domain name of
my host. Is that what you mean? Anyway, I'm not on
a home LAN but on
my campus network.
--
fedora-list mailing list
fedora-list at redhat.com
https://www.redhat.com/mailman/listinfo/fedora-list

________
___ __ \_____ _____
__ / / /_ _ \_ _ \
_ /_/ / / __// __/
/_____/ \___/ \___/

Send instant messages to your online friends http://uk.messenger.yahoo.com