Is it possible to use SELinux MCS permissions with Samba?
- by Yuri
Created a user1:
adduser --shell /sbin/nologin --no-create-home user1
passwd user1
smbpasswd -a user1
smbpasswd -e user1
semanage login -a -s "unconfined_u" -r "s0-s0:c0" user1
Added a category c0 for the folder ./123 inside the Samba share
chcat s0:c0 /share/123/
After that the user1 can't go into this folder:
type=AVC msg=audit(1332693158.129:48): avc: denied { read } for
pid=1122 comm="smbd" name="123" dev=sda1 ino=786438
scontext=system_u:system_r:smbd_t:s0
tcontext=unconfined_u:object_r:samba_share_t:s0:c0 tclass=dir
But if remove the c0 category:
restorecon -v /share/123/
user1 opens folder with no problem.
Is I'm doing something wrong or Samba doesn't support SELinux MCS?
Have installed on CentOS 6.2 are:
samba3.i686 3.6.3-44.el6 @sernet-samba
selinux-policy.noarch 3.7.19-126.el6_2.10 @updates
selinux-policy-targeted.noarch 3.7.19-126.el6_2.10 @updates