On 02/22/2010 07:55 PM, Trevor Hemsley wrote:
> I am sharing my user home directories to other machines on my LAN using
> Samba. I have that all working correctly except for one persistent AVC
> that I keep seeing. Now this AVC is correct in that I really do not want
> my user's .ssh directories read over SMB so I'd quite like to keep that
> as-is. But... I get alerts for this all the time so I'd like to know how
> to add a dontaudit rule for it so that access is denied but I don't get
> told about it. Ideally I'd like to add a generic rule to catch all
> user's not have to add one dontaudit rule per user. Just don't have a
> clue where to start and google was not much use on this so would
> appreciate some help if anyone has done this before?
>
> SELinux is preventing samba (smbd) "getattr" to /home/$user/.ssh
> (sshd_key_t).
>
> Source Context: system_u:system_r:smbd_t
> Target Context: user_u:object_r:sshd_key_t
> Target Objects: /home/$user/.ssh/config [ file ]
> Source: smbd
> Source Path: /usr/sbin/smbd
> Port:<Unknown>
> Host: hostname
> Source RPM Packages: samba-3.0.33-3.15.el5_4.1
> Target RPM Packages:
> Policy RPM: selinux-policy-2.4.6-255.el5_4.4
> Selinux Enabled: True
> Policy Type: targeted
> MLS Enabled: True
> Enforcing Mode: Permissive
> Plugin Name: samba_share
> Host Name: hostname
> Platform: Linux hostname 2.6.32.5 #3 SMP Sun Jan 31 03:27:09 GMT 2010
> x86_64 x86_64
> Alert Count: 1
> First Seen: Tue 23 Feb 2010 12:44:47 AM GMT
> Last Seen: Tue 23 Feb 2010 12:44:47 AM GMT
> Local ID: 5d933e81-2ab5-4529-8dce-9e554a59f0e3
> Line Numbers:
>
> Raw Audit Messages :
> host=hostname type=AVC msg=audit(1266885887.400:4313): avc: denied {
> getattr } for pid=16382 comm="smbd" path="/home/$user/.ssh/config"
> dev=dm-4 ino=10453601 scontext=system_u:system_r:smbd_t:s0
> tcontext=user_u:object_r:sshd_key_t:s0 tclass=file
>
> host=hostname type=SYSCALL msg=audit(1266885887.400:4313): arch=c000003e
> syscall=4 success=yes exit=0 a0=7fff2dc9f270 a1=7fff2dc9e9a0
> a2=7fff2dc9e9a0 a3=7fff2dc9ee70 items=0 ppid=4352 pid=16382
> auid=4294967295 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=500 sgid=0
> fsgid=500 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd"
> subj=system_u:system_r:smbd_t:s0 key=(null)
>
>
# cat > mysmbd.te << _EOF
policy_module(mysmbd, 1.0)
require {
type smbd_t;
type sshd_key_t;
}
dontaudit smbd_t sshd_key_t:file getattr;
_EOF
# make -f /usr/share/selinux/devel/Makefile
# semodule -i mysmbd.pp
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux
