0

I like to take snapshots of a Btrfs subvolume (mysubvol, using snapper) and share the .snapshots directory using samba. I can either assign the samba_share_t context to .snapshots and will then be able to browse it with samba -- but then I'm unable to take snapshots. Or, I can assign the snapperd_data_t context and take snapshots, but samba can then not share the directory.

How can I either assign both contexts to .snapshots or create a common context that allows both? What are possible solutions? A solution should survive relabeling with restorecon -R -v .snapshots.

chcon -t snapperd_data_t .snapshots
la -Z
# drwxr-xr-x. 1 root  root  system_u:object_r:snapperd_data_t:s0      38 Nov 25 20:00 .snapshots
# drwx------. 1 someuser someuser unconfined_u:object_r:samba_share_t:s0   298 Nov 24 15:33 mydata
snapper -c samba_share create # works
# new snapshot is created, but .snapshots is not browsable with samba...

chcon -t samba_share_t /home/samba/.snapshots/
la -Z 
# drwxr-xr-x. 1 root  root  system_u:object_r:samba_share_t:s0        42 Nov 25 20:45 .snapshots
# drwx------. 1 someuser someuser unconfined_u:object_r:samba_share_t:s0   298 Nov 24 15:33 mydata
snapper -c samba-timeline create 
# IO Error (mkdir failed errno:13 (Permission denied)).
# but .snapshots is browsable with samba
sudo ausearch -m avc -ts recent
# time->Fri Nov 25 20:47:57 2022
# type=AVC msg=audit(1669409277.513:2728): avc:  denied  { create } for  pid=9114 comm="snapperd" name="16" scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:samba_share_t:s0 tclass=dir permissive=0

How can I have both, being able to take snapshots and having access with samba (and SELinux active)?

1
  • This probably needs to be done through a SELinux boolean or a custom policy module. Also, I'm not sure why these particular labels are applied (they are in /home, I would expect user_home_t labels). To replicate and help out, we need to know: a) which OS? b) Are snapper and Samba installed through the package manager? If so, which packages (names+versions) exactly? And if by source, which source versions?
    – Edward
    Nov 29, 2022 at 7:26

1 Answer 1

0

One possible solution is to create a custom type, such as samba_snapperd_data_t, that combines both the samba_share_t and snapperd_data_t contexts. Then, you can assign that custom type to the .snapshots directory and both samba and snapper will be able to access it. This solution should survive relabeling with restorecon -R -v .snapshots.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .