Problem with permissions when sharing a mounted filesystem

Question

I am setting up a linux to act as a fileserver, using CentOS 6.3.

Since I want to have disk quotas and can't install LVM (it is a 32 bit machine), I am using an LVM volume with ext4 mounted as /samba/seg

I have created /samba/seg, assigned a domain group, changed FS permissions to 770, executed:

• semanage fcontext -a -t samba_share_t /samba/seg
• restorecon -R -v /samba/seg

My config (from testparm):

[seg]
       comment = Remote unit
       path = /samba/seg
       valid users = @DOMAIN\GROUP
       read only = No
       create mask = 0660
       force create mode =  0660
       directory mask = 0770
       force directory mode = 0770
       hide unreadable = Yes
       access based share enum = Yes

When I try to connect from a Windows box (logged as domain user) I get a message stating that I have no access rights to the share. I have to make setenforce Permissive in order to access the share.

The domain configuration seems ok. I can login with a domain user, check users of domain groups and so on.

In the other hand, I just did create a directory (not a filesystem) in /samba/test and replied the steps with it; it worked without problem so the issue seems to be when sharing a mounted filesystem.

Any suggestions?

Answer 1

Ok, my bad. I keep repassing the process, and investigating what did the instructions do.

When looking at semanage found ls -Z and I found that the samba_share_t permission/object/whatever was not sticking to the mounted filesystem.

What I did was change fstab to add a mount option, now it reads

/dev/mapper/VolGroup-lv_seg       /samba/seg    ext4    context="system_u:object_r:samba_share_t:s0" 1 2 

That did the trick.

Answer 2

• semanage fcontext -a -t samba_share_t /samba/seg

Replace the above command with this one:

semanage fcontext -a -t samba_share_t /samba/seg(/.*)?

E.g. see Procedure 5.8. Changing a Directory and its Contents Types" at https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security-enhanced_linux/sect-security-enhanced_linux-selinux_contexts_labeling_files-persistent_changes_semanage_fcontext