Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

when I'm trying to mount a read-only samba share, then I get this messages on the samba server (and timeout on client side)

Nov  5 18:45:49 localhost kernel: type=1400 audit(1352137549.469:17): avc:  denied  { module_request } for  pid=3046 comm="smbd" kmod="net-pf-10" scontext=unconfined_u:system_r:smbd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system

I already tried:

setsebool -P samba_export_all_ro 1
getsebool -a | egrep -i 'smb|samba'
yum install policycoreutils-python
semanage fcontext -a -t samba_share_t '/PATH/TO/SAMBASHARE(/.*)?'
restorecon -R /PATH/TO/SAMBASHARE
/etc/init.d/smb restart

How can I configure SELinux to allow the read-only samba share? Turning off SELinux is just idiotic.

UPDATE:

[root@SERVER ~]# getsebool -a|grep -i smbd
allow_smbd_anon_write --> off
[root@SERVER ~]# setsebool -P smbd_disable_trans 1
libsemanage.dbase_llist_set: record not found in the database
libsemanage.dbase_llist_set: could not set record value
Could not change boolean smbd_disable_trans
Could not change policy booleans
share|improve this question
    
OK. You can try to disable SELinux particularly for SMB service. Use smbd_disable_trans variable... In this case another protections of SELinux are still active. –  George Gaál Nov 9 '12 at 0:04
    
there isnt a boolean named smbd_disable_trans –  gasko peter Nov 9 '12 at 18:39
    
Very strange... Look here please: kangry.com/topics/viewcomment.php?index=18546 –  George Gaál Nov 9 '12 at 19:18

1 Answer 1

It appears that smbd is trying to autoload the kernel module net-pf-10, which is an alias for ipv6. This apparently isn't permitted in SELinux, since it wasn't reasonably anticipated that the module wouldn't be loaded (or that you would ask for IPv6 bindings with IPv6 disabled).

There are at least two possible ways to resolve this.

  1. Re-enable IPv6 system-wide (since you almost certainly disabled it; this is just one of many problems that disabling IPv6 will cause).
  2. Re-configure Samba to not attempt to bind to any IPv6 address. Change the interfaces line in smb.conf to bind to your desired IPv4 addresses only. An example:

    interfaces = 127.0.0.1 198.51.100.87
    bind interfaces only = yes
    
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.