1

In the CentOS7 GUI, I have been seeing a smattering of messages such as:

SELinux is preventing /usr/bin/smbd from getattr on the file ___. The files are for instance:

/etc/default/grub
/etc/rc.d/init.d/webmin
network.service
kmsg
authconfig.py
modules
generator
/usr/bin/wodim
/usr/sbin/sendmail.postfix

The machine is serving files to two Windows computers on a network and as far as I can tell, neither machine is attempting to access these admittedly important looking files.

The UI at best is giving advice on how to allow these accesses, which if this is an intrusion is a terrible idea. There is no information on the source of the requests or anything obvious with which to investigate further.

Are they just false positives?

  • It might be impossible to say anything conclusive without any other logs to correlate with the SELinux messages. If your configuration should not allow access to those files in question, you should double check your configuration and if there are any pending samba security updates. – sebasth Sep 11 '18 at 7:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.