3

when I'm trying to mount a read-only samba share, then I get this messages on the samba server (and timeout on client side)

Nov  5 18:45:49 localhost kernel: type=1400 audit(1352137549.469:17): avc:  denied  { module_request } for  pid=3046 comm="smbd" kmod="net-pf-10" scontext=unconfined_u:system_r:smbd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system

I already tried:

setsebool -P samba_export_all_ro 1
getsebool -a | egrep -i 'smb|samba'
yum install policycoreutils-python
semanage fcontext -a -t samba_share_t '/PATH/TO/SAMBASHARE(/.*)?'
restorecon -R /PATH/TO/SAMBASHARE
/etc/init.d/smb restart

How can I configure SELinux to allow the read-only samba share? Turning off SELinux is just idiotic.

UPDATE:

[root@SERVER ~]# getsebool -a|grep -i smbd
allow_smbd_anon_write --> off
[root@SERVER ~]# setsebool -P smbd_disable_trans 1
libsemanage.dbase_llist_set: record not found in the database
libsemanage.dbase_llist_set: could not set record value
Could not change boolean smbd_disable_trans
Could not change policy booleans
3
  • OK. You can try to disable SELinux particularly for SMB service. Use smbd_disable_trans variable... In this case another protections of SELinux are still active. Nov 9, 2012 at 0:04
  • there isnt a boolean named smbd_disable_trans Nov 9, 2012 at 18:39
  • Very strange... Look here please: kangry.com/topics/viewcomment.php?index=18546 Nov 9, 2012 at 19:18

1 Answer 1

1

It appears that smbd is trying to autoload the kernel module net-pf-10, which is an alias for ipv6. This apparently isn't permitted in SELinux, since it wasn't reasonably anticipated that the module wouldn't be loaded (or that you would ask for IPv6 bindings with IPv6 disabled).

There are at least two possible ways to resolve this.

  1. Re-enable IPv6 system-wide (since you almost certainly disabled it; this is just one of many problems that disabling IPv6 will cause).
  2. Re-configure Samba to not attempt to bind to any IPv6 address. Change the interfaces line in smb.conf to bind to your desired IPv4 addresses only. An example:

    interfaces = 127.0.0.1 198.51.100.87
    bind interfaces only = yes
    

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .