3

when I'm trying to mount a read-only samba share, then I get this messages on the samba server (and timeout on client side)

Nov  5 18:45:49 localhost kernel: type=1400 audit(1352137549.469:17): avc:  denied  { module_request } for  pid=3046 comm="smbd" kmod="net-pf-10" scontext=unconfined_u:system_r:smbd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system

I already tried:

setsebool -P samba_export_all_ro 1
getsebool -a | egrep -i 'smb|samba'
yum install policycoreutils-python
semanage fcontext -a -t samba_share_t '/PATH/TO/SAMBASHARE(/.*)?'
restorecon -R /PATH/TO/SAMBASHARE
/etc/init.d/smb restart

How can I configure SELinux to allow the read-only samba share? Turning off SELinux is just idiotic.

UPDATE:

[root@SERVER ~]# getsebool -a|grep -i smbd
allow_smbd_anon_write --> off
[root@SERVER ~]# setsebool -P smbd_disable_trans 1
libsemanage.dbase_llist_set: record not found in the database
libsemanage.dbase_llist_set: could not set record value
Could not change boolean smbd_disable_trans
Could not change policy booleans
1

It appears that smbd is trying to autoload the kernel module net-pf-10, which is an alias for ipv6. This apparently isn't permitted in SELinux, since it wasn't reasonably anticipated that the module wouldn't be loaded (or that you would ask for IPv6 bindings with IPv6 disabled).

There are at least two possible ways to resolve this.

  1. Re-enable IPv6 system-wide (since you almost certainly disabled it; this is just one of many problems that disabling IPv6 will cause).
  2. Re-configure Samba to not attempt to bind to any IPv6 address. Change the interfaces line in smb.conf to bind to your desired IPv4 addresses only. An example:

    interfaces = 127.0.0.1 198.51.100.87
    bind interfaces only = yes
    

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.