Samba Permission denied

Question

I need to deploy Samba Sharing between Linux Host (Samba Server) and Linux (Client) and Windows (Client) . Now this folder on Server will share documents between Linux and Windows Client machines. On Samba Server i made two test users lets call them venice and john. Now on Samba Server I set the file context for samba and enabled RO and RW booleans and set the permissions for john and venice

> getfacl: Removing leading '/' from absolute path names
> # file: samba/docs/
> # owner: venice
> # group: venice user::rwx user:venice:rwx user:john:rwx group::r-x mask::rwx other::r-x default:user::rwx default:user:venice:rwx
> default:user:john:rwx default:group::r-x default:mask::rwx
> default:other::r-x

and in samba configuration file i did following configuration

[smbdocs]
        comment = Documents share
        path = /samba/docs
        browseable = yes
        read only = yes
        write list = venice john
        guest ok = no
        printable = no
        hosts allow = 10.8.8.51

While mounting on samba using

mount.cifs //10.8.8.50/smbdocs -o username=venice,password=pass /samba/docs/ 

im not able to create files using venice and john users, even though it is allowed from system level permission and Samba level.

Now if i mount using the uid and gid of venice

mount.cifs //10.8.8.50/smbdocs -o username=venice,password=pass,uid=1001,gid=1001 /samba/docs/ 

im able to create the file using venice user but john still not able to create the files or edit the files

Any advice

Host OS version RHEL 7.4

Answer 1

RHEL 7 has SELinux enabled by default, and it will restrict Samba's access to the filesystem. When you create your own Samba share in a custom path like /samba/docs, you must apply suitable SELinux labeling to that path.

If you need the directories accessible by Samba and other services, you should use SELinux context type label public_content_rw_t and set the smbd_anon_write SELinux boolean to allow Samba write access to files and directories in public_content_rw_t contexts with full control of file ownerships:

setsebool -P smbd_anon_write=1
semanage fcontext -a -t public_content_rw_t "/samba/docs(/.*)?"
restorecon -Rv /samba/docs

If you don't plan on accessing /samba/docs through any other service (like httpd or ftpd), you can use samba_share_t context instead, and then you don't need the boolean setting:

semanage fcontext -a -t samba_share_t "/samba/docs(/.*)?"
restorecon -Rv /samba/docs

The semanage fcontext -a... command will add the regular expression that defines the new labeling persistently into SELinux configuration, and restorecon will apply the new labeling to the actual filesystem. You could also use chcon to change SELinux context labels, but then your changes would be lost whenever restorecon was executed (e.g. after restoring a backup). Storing the labeling information into SELinux configuration first ensures it can be restored even if your backup methods are not specifically SELinux aware - as long as the SELinux configuration under /etc is also backed up.