samba的share模式與SELinux的關係

refer: http://andrew.sayya.org/blog/?p=193

 

範例：使用samba分享出samba-share項目,並且該項目可以讀可以寫…等，

讓匿名登入的使用者除了可以讀之外也可以進行寫的動作。

 

測試環境：RHEL 5.1 Server

# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 21
Policy from config file:        targeted

# vi /etc/samba/smb.conf

  
  
  
  


   
   
   
   
 
    
 
     
 
      
 
       

         [global] 
       
 
 
      
 
       

                 workgroup = smbgroup 
       
 
 
      
 
       

                 netbios name = smbname 
       
 
 
      
 
       

                 server string = just samba server 
       
 
 
      
 
       

                 security = share 
       
 
 
      
 
       

         [samba-share] 
       
 
 
      
 
       

                 comment = samba-share test dir 
       
 
 
      
 
       

                 path = /samba-share 
       
 
 
      
 
       

                 read only = no 
       
 
 
      
 
       

                 public = yes 
       
 
 
      
 
       

                 browseable = yes 
       
 
 
     
 
    
 
   

  
  
  
  

*如果samba server共享(不需要密碼)samba-share項目時, client要存取該項目時,SELinux預設無法存取。 

# mkdir /samba-share

# chown nobody.nobody /samba-share

# ls -Zd /samba-share/

drwxr-xr-x  nobody nobody root:object_r:root_t             /samba-share/

# service smb restart

*登入samba服務並嘗試做寫入測試：
# smbclient //localhost/samba-share
Password:
Domain=[SMBGROUP] OS=[Unix] Server=[Samba 3.0.25b-0.el5.4]
Server not using user level security and no password supplied.
smb: /> ls
  .                                   D        0  Fri Oct 17 21:23:06 2008
  ..                                  D        0  Fri Oct 17 21:23:06 2008

                50391 blocks of size 131072. 7298 blocks available
smb: /> mkdir xxx
NT_STATUS_ACCESS_DENIED making remote directory /xxx

• 奇怪為何read only = no有開啟寫入的動作，nobody的檔案權限也正確，

為何不能寫入？

  
  
  
  


   
   
   
   
 
    
 
     
 
      
 
       

         # tail -n 1 /var/log/messages 
       
 
 
      
 
       

         Oct 17 21:31:41 nis setroubleshoot:      SELinux is preventing samba (/usr/sbin/smbd) "create" to xxx (root_t). 
       
 
 
      
 
       

              For complete SELinux messages. run sealert -l db986eee-e0a6-42a1-b8a3-bfd530d4d2b3 
       
 
 
      
 
       

           
       
 
 
      
 
       

         *原來是SELinux的問題，除了sealert -l db986eee-e0a6-42a1-b8a3-bfd530d4d2b3 
       
 
 
      
 
       

         提供的解決方法外，man page也有提供參考資料。 
       
 
 
     
 
    
 
   

  
  
  
  



# man samba_selinux

  
  
  
  


   
   
   
   
 
    
 
     
 
      
 
       

         FILE_CONTEXTS 
       
 
 
      
 
       

           
       
 
 
      
 
       

             SELinux  requires files to have an extended attribute to define the file type.  Policy governs the access daemons have to these files. 
       
 
 
      
 
       

             If you want to share files other than home directories, those files must be labeled samba_share_t.  So if you created a special direc- 
       
 
 
      
 
       

             tory /var/eng, you would need to label the directory with the chcon tool. 
       
 
 
      
 
       

           
       
 
 
      
 
       

             chcon -t samba_share_t /var/eng 
       
 
 
      
 
       

           
       
 
 
      
 
       

             If you want to make this permanant, i.e. survive a relabel, you must add an entry to the file_contexts.local file. 
       
 
 
      
 
       

           
       
 
 
      
 
       

             /etc/selinux/POLICYTYPE/contexts/files/file_contexts.local 
       
 
 
      
 
       

                 /var/eng(/.*)? system_u:object_r:samba_share_t 
       
 
 
     
 
    
 
   

  
  
  
  


處理方式1：
      
      
      
      


       
       
       
       
 
        
 
         
 
          
 
           

             # ls -dZ /samba-share/ 
           
 
 
          
 
           

             drwxr-xr-x nobody nobody root:object_r:root_t /samba-share/ 
           
 
 
          
 
           

               
           
 
 
          
 
           

             # chcon -R -t samba_share_t /samba-share/ 
           
 
 
          
 
           

               
           
 
 
          
 
           

             # ls -dZ /samba-share/ 
           
 
 
          
 
           

             drwxr-xr-x nobody nobody root:object_r:samba_share_t /samba-share/ 
           
 
 
         
 
        
 
       

      
      
      
      




*登入samba服務並嘗試做寫入測試：
# smbclient //localhost/samba-share
Password:
Domain=[SMBGROUP] OS=[Unix] Server=[Samba 3.0.25b-0.el5.4]
Server not using user level security and no password supplied.
smb: /> mkdir xxx
smb: /> ls
  .                                   D        0  Fri Oct 17 21:35:22 2008
  ..                                  D        0  Fri Oct 17 21:49:09 2008
  xxx                                 D        0  Fri Oct 17 21:35:22 2008

                50391 blocks of size 131072. 7294 blocks available
========================================================
處理方式2：
# man samba_selinux

      
      
      
      


       
       
       
       
 
        
 
         
 
          
 
           

             ... 
           
 
 
          
 
           

             SHARING FILES 
           
 
 
          
 
           

                 If you want to share files with multiple domains (Apache, FTP, rsync, Samba), you can set a file context of public_content_t and pub- 
           
 
 
          
 
           

                 lic_content_rw_t. These context allow any of the above domains to read the content. If you want a particular domain to write to the 
           
 
 
          
 
           

                 public_content_rw_t domain, you must set the appropriate boolean. allow_DOMAIN_anon_write. So for samba you would execute: 
           
 
 
          
 
           

               
           
 
 
          
 
           

                 setsebool -P allow_smbd_anon_write=1 
           
 
 
          
 
           

             ... 
           
 
 
         
 
        
 
       

      
      
      
      



      
      
      
      


       
       
       
       
 
        
 
         
 
          
 
           

             # ls -dZ /samba-share/ 
           
 
 
          
 
           

             drwxr-xr-x  root root root:object_r:root_t             /samba-share/ 
           
 
 
          
 
           

               
           
 
 
          
 
           

             # chcon -R -t public_content_rw_t /samba-share/ 
           
 
 
          
 
           

               
           
 
 
          
 
           

             # ls -dZ /samba-share/ 
           
 
 
          
 
           

             drwxr-xr-x  nobody nobody root:object_r:public_content_rw_t /samba-share/ 
           
 
 
          
 
           

               
           
 
 
          
 
           

             註：public_content_t(讀)與public_content_rw_t(寫)是所有domain 
           
 
 
          
 
           

             共同可以存取的檔案type，後者通常需要打開allow_xxx_anon_write項目 
           
 
 
          
 
           

             的布林值，否則只具備讀的權限而已。 
           
 
 
         
 
        
 
       

      
      
      
      

• SELinux預設不開啟這個布林值，所以只能讀取不能寫入。

# getsebool -a | grep allow_smbd_anon_write

allow_smbd_anon_write --> off

• 開啟這個布林值之後就可以做寫入的動作。

# setsebool -P allow_smbd_anon_write=1

*登入samba服務並嘗試做寫入測試：
# smbclient //localhost/samba-share
Password:
Domain=[SMBGROUP] OS=[Unix] Server=[Samba 3.0.25b-0.el5.4]
Server not using user level security and no password supplied.
smb: /> mkdir xxx
smb: /> ls
  .                                   D        0  Fri Oct 17 21:50:21 2008
  ..                                  D        0  Fri Oct 17 21:49:09 2008
  xxx                                 D        0  Fri Oct 17 21:50:21 2008

                50391 blocks of size 131072. 7294 blocks available