FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor


 
 
LinkBack Thread Tools
 
Old 05-13-2008, 02:38 PM
"Daniel B. Thurman"
 
Default Samba shares...

I am not sure what is going on. I am unable to get
samba shares to work for an NTFS filesystem. I do
have several shares working for ext3 filesystems.

Here is what I did:

1) Create an empty directory: /AV
2) chcon -t samba_share_t /AV
3) chmod 775 !$
4) chgrp avusers !$
5) Add to fstab
/dev/sda1 /AV ntfs defaults 1 2
6) mount -a

+ ls -ldZ /AV
drwxrwxrwx root root system_ubject_r:fusefs_t:s0 AV

+ chcon -t samba_share_t /AV
chcon: failed to change context of /AV to system_ubject_r:samba_share_t:s0: Operation not supported.

+ umount /AV (no errors)
+ chcon -t samba_share_t /AV (no errors)
+ mount /AV (no errors)
+ ls -ldZ /AV
drwxrwxrwx root root system_ubject_r:fusefs_t:s0 AV

So... why does the system insists of fusefs_t?
Does this mean that ntfs filesystems does not support samba_share_context?

HELP!!!

Thanks!
Dan

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 
Old 05-13-2008, 02:52 PM
Stephen Smalley
 
Default Samba shares...

On Tue, 2008-05-13 at 07:38 -0700, Daniel B. Thurman wrote:
> I am not sure what is going on. I am unable to get
> samba shares to work for an NTFS filesystem. I do
> have several shares working for ext3 filesystems.
>
> Here is what I did:
>
> 1) Create an empty directory: /AV
> 2) chcon -t samba_share_t /AV
> 3) chmod 775 !$
> 4) chgrp avusers !$
> 5) Add to fstab
> /dev/sda1 /AV ntfs defaults 1 2

Not sure if this will work, but try adding a
"context=system_ubject_r:samba_share_t" to the list of options in your
fstab.

> 6) mount -a
>
> + ls -ldZ /AV
> drwxrwxrwx root root system_ubject_r:fusefs_t:s0 AV
>
> + chcon -t samba_share_t /AV
> chcon: failed to change context of /AV to system_ubject_r:samba_share_t:s0: Operation not supported.
>
> + umount /AV (no errors)
> + chcon -t samba_share_t /AV (no errors)
> + mount /AV (no errors)
> + ls -ldZ /AV
> drwxrwxrwx root root system_ubject_r:fusefs_t:s0 AV
>
> So... why does the system insists of fusefs_t?
> Does this mean that ntfs filesystems does not support samba_share_context?
>
> HELP!!!
>
> Thanks!
> Dan
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list@redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
--
Stephen Smalley
National Security Agency

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 
Old 05-13-2008, 03:12 PM
"Daniel B. Thurman"
 
Default Samba shares...

Stephen Smalley wrote:
>> Daniel B. Thurman wrote:
>> I am not sure what is going on. I am unable to get
>> samba shares to work for an NTFS filesystem. I do
>> have several shares working for ext3 filesystems.
>>
>> Here is what I did:
>>
>> 1) Create an empty directory: /AV
>> 2) chcon -t samba_share_t /AV
>> 3) chmod 775 !$
>> 4) chgrp avusers !$
>> 5) Add to fstab
>> /dev/sda1 /AV ntfs defaults 1 2
>
> Not sure if this will work, but try adding a
> "context=system_ubject_r:samba_share_t" to the
> list of options in your fstab.

Sorry I was not able to get your reply in my inbox, it was
spam-blocked, but I have it fixed now.

Can you please tell me how to add your suggestion to
the fstab as options?

Thanks!
Dan

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 
Old 05-13-2008, 03:23 PM
Stephen Smalley
 
Default Samba shares...

On Tue, 2008-05-13 at 08:12 -0700, Daniel B. Thurman wrote:
> Stephen Smalley wrote:
> >> Daniel B. Thurman wrote:
> >> I am not sure what is going on. I am unable to get
> >> samba shares to work for an NTFS filesystem. I do
> >> have several shares working for ext3 filesystems.
> >>
> >> Here is what I did:
> >>
> >> 1) Create an empty directory: /AV
> >> 2) chcon -t samba_share_t /AV
> >> 3) chmod 775 !$
> >> 4) chgrp avusers !$
> >> 5) Add to fstab
> >> /dev/sda1 /AV ntfs defaults 1 2
> >
> > Not sure if this will work, but try adding a
> > "context=system_ubject_r:samba_share_t" to the
> > list of options in your fstab.
>
> Sorry I was not able to get your reply in my inbox, it was
> spam-blocked, but I have it fixed now.
>
> Can you please tell me how to add your suggestion to
> the fstab as options?

It is just another mount option, so you can just do something like:
/dev/sda1 /AV ntfs defaults,context=system_ubject_r:samba_share_t 1 2


--
Stephen Smalley
National Security Agency

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 
Old 05-13-2008, 03:40 PM
"Daniel B. Thurman"
 
Default Samba shares...

Stephen Smalley
|On Tue, 2008-05-13 at 08:12 -0700, Daniel B. Thurman wrote:
|> Stephen Smalley wrote:
|> >> Daniel B. Thurman wrote:
|> >> I am not sure what is going on. I am unable to get
|> >> samba shares to work for an NTFS filesystem. I do
|> >> have several shares working for ext3 filesystems.
|> >>
|> >> Here is what I did:
|> >>
|> >> 1) Create an empty directory: /AV
|> >> 2) chcon -t samba_share_t /AV
|> >> 3) chmod 775 !$
|> >> 4) chgrp avusers !$
|> >> 5) Add to fstab
|> >> /dev/sda1 /AV ntfs defaults 1 2
[snipped!]
|
|It is just another mount option, so you can just do something like:
|/dev/sda1 /AV ntfs defaults,context=system_ubject_r:samba_share_t 1 2

Yes, I thought so. I tried that and the context does not
change. Any ideas?

Thanks!
Dan

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 
Old 05-13-2008, 05:27 PM
"Daniel B. Thurman"
 
Default Samba shares...

Daniel B. Thurman wrote:
|Stephen Smalley
||On Tue, 2008-05-13 at 08:12 -0700, Daniel B. Thurman wrote:
||> Stephen Smalley wrote:
||> >> Daniel B. Thurman wrote:
||> >> I am not sure what is going on. I am unable to get
||> >> samba shares to work for an NTFS filesystem. I do
||> >> have several shares working for ext3 filesystems.
||> >>
||> >> Here is what I did:
||> >>
||> >> 1) Create an empty directory: /AV
||> >> 2) chcon -t samba_share_t /AV
||> >> 3) chmod 775 !$
||> >> 4) chgrp avusers !$
||> >> 5) Add to fstab
||> >> /dev/sda1 /AV ntfs defaults 1 2
| [snipped!]
||
||It is just another mount option, so you can just do something like:
||/dev/sda1 /AV ntfs
|defaults,context=system_ubject_r:samba_share_t 1 2
|
|Yes, I thought so. I tried that and the context does not
|change. Any ideas?

Mounting an NTFS filesystem even with context options,
the context always remains as fusefs_t. I am allowed
to change the context on the directory before the mount,
but not after the mount. After mounting, I am not allowed
to chcon the mounted FS as it says that the Operation is
not allowed.

I even tried: setsebool -P samba_export_all_rw=1 and that
does not work, either.

If I setenforce 0, I can share the NTFS filesystem, but I
really do not want to do this. Can someone please give me
a workaround?

Thanks-
Dan

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 
Old 05-13-2008, 05:37 PM
Stephen Smalley
 
Default Samba shares...

On Tue, 2008-05-13 at 10:27 -0700, Daniel B. Thurman wrote:
> Daniel B. Thurman wrote:
> |Stephen Smalley
> ||On Tue, 2008-05-13 at 08:12 -0700, Daniel B. Thurman wrote:
> ||> Stephen Smalley wrote:
> ||> >> Daniel B. Thurman wrote:
> ||> >> I am not sure what is going on. I am unable to get
> ||> >> samba shares to work for an NTFS filesystem. I do
> ||> >> have several shares working for ext3 filesystems.
> ||> >>
> ||> >> Here is what I did:
> ||> >>
> ||> >> 1) Create an empty directory: /AV
> ||> >> 2) chcon -t samba_share_t /AV
> ||> >> 3) chmod 775 !$
> ||> >> 4) chgrp avusers !$
> ||> >> 5) Add to fstab
> ||> >> /dev/sda1 /AV ntfs defaults 1 2
> | [snipped!]
> ||
> ||It is just another mount option, so you can just do something like:
> ||/dev/sda1 /AV ntfs
> |defaults,context=system_ubject_r:samba_share_t 1 2
> |
> |Yes, I thought so. I tried that and the context does not
> |change. Any ideas?
>
> Mounting an NTFS filesystem even with context options,
> the context always remains as fusefs_t. I am allowed
> to change the context on the directory before the mount,
> but not after the mount. After mounting, I am not allowed
> to chcon the mounted FS as it says that the Operation is
> not allowed.

Can you confirm that if you umount /AV and then mount it with the
context= option that it really doesn't work for you? You do have to
umount it though if you previously mounted it w/o the context option to
make the option take affect.

I'm not sure why a context mount option wouldn't work for fuse - Eric?

fuse itself won't let you chcon (setxattr) the files unless the
filesystem supports setxattr, which is why you get Operation not
supported there.

> I even tried: setsebool -P samba_export_all_rw=1 and that
> does not work, either.
>
> If I setenforce 0, I can share the NTFS filesystem, but I
> really do not want to do this. Can someone please give me
> a workaround?

You can certainly generate a local policy module that gives access to
fusefs_t, but it would be better if we could get the context mount
option to work.

--
Stephen Smalley
National Security Agency

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 
Old 05-13-2008, 06:08 PM
Eric Paris
 
Default Samba shares...

On Tue, 2008-05-13 at 13:37 -0400, Stephen Smalley wrote:
> On Tue, 2008-05-13 at 10:27 -0700, Daniel B. Thurman wrote:
> > Daniel B. Thurman wrote:
> > |Stephen Smalley
> > ||On Tue, 2008-05-13 at 08:12 -0700, Daniel B. Thurman wrote:
> > ||> Stephen Smalley wrote:
> > ||> >> Daniel B. Thurman wrote:
> > ||> >> I am not sure what is going on. I am unable to get
> > ||> >> samba shares to work for an NTFS filesystem. I do
> > ||> >> have several shares working for ext3 filesystems.
> > ||> >>
> > ||> >> Here is what I did:
> > ||> >>
> > ||> >> 1) Create an empty directory: /AV
> > ||> >> 2) chcon -t samba_share_t /AV
> > ||> >> 3) chmod 775 !$
> > ||> >> 4) chgrp avusers !$
> > ||> >> 5) Add to fstab
> > ||> >> /dev/sda1 /AV ntfs defaults 1 2
> > | [snipped!]
> > ||
> > ||It is just another mount option, so you can just do something like:
> > ||/dev/sda1 /AV ntfs
> > |defaults,context=system_ubject_r:samba_share_t 1 2
> > |
> > |Yes, I thought so. I tried that and the context does not
> > |change. Any ideas?
> >
> > Mounting an NTFS filesystem even with context options,
> > the context always remains as fusefs_t. I am allowed
> > to change the context on the directory before the mount,
> > but not after the mount. After mounting, I am not allowed
> > to chcon the mounted FS as it says that the Operation is
> > not allowed.
>
> Can you confirm that if you umount /AV and then mount it with the
> context= option that it really doesn't work for you? You do have to
> umount it though if you previously mounted it w/o the context option to
> make the option take affect.
>
> I'm not sure why a context mount option wouldn't work for fuse - Eric?

No idea, but I haven't looked at what hackers fuse does either.....

-Eric

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 
Old 05-13-2008, 06:30 PM
"Daniel B. Thurman"
 
Default Samba shares...

Stephen Smalley wrote:
|On Tue, 2008-05-13 at 10:27 -0700, Daniel B. Thurman wrote:
|> Daniel B. Thurman wrote:
|> |Stephen Smalley
|> ||On Tue, 2008-05-13 at 08:12 -0700, Daniel B. Thurman wrote:
|> ||> Stephen Smalley wrote:
|> ||> >> Daniel B. Thurman wrote:
|> ||> >> I am not sure what is going on. I am unable to get
|> ||> >> samba shares to work for an NTFS filesystem. I do
|> ||> >> have several shares working for ext3 filesystems.
|> ||> >>
|> ||> >> Here is what I did:
|> ||> >>
|> ||> >> 1) Create an empty directory: /AV
|> ||> >> 2) chcon -t samba_share_t /AV
|> ||> >> 3) chmod 775 !$
|> ||> >> 4) chgrp avusers !$
|> ||> >> 5) Add to fstab
|> ||> >> /dev/sda1 /AV ntfs defaults 1 2
|> | [snipped!]
|> ||
|> ||It is just another mount option, so you can just do something like:
|> ||/dev/sda1 /AV ntfs
|> |defaults,context=system_ubject_r:samba_share_t 1 2
|> |
|> |Yes, I thought so. I tried that and the context does not
|> |change. Any ideas?
|>
|> Mounting an NTFS filesystem even with context options,
|> the context always remains as fusefs_t. I am allowed
|> to change the context on the directory before the mount,
|> but not after the mount. After mounting, I am not allowed
|> to chcon the mounted FS as it says that the Operation is
|> not allowed.
|
|Can you confirm that if you umount /AV and then mount it with the
|context= option that it really doesn't work for you? You do have to
|umount it though if you previously mounted it w/o the context option to
|make the option take affect.

Yes, I can confirm that adding context= to the option line
in /etc/fstab does not seem to do anything, i.e. the context
does not change and remains fusefs_t. I tried several times,
and even tried the fscontext= as well, neither seems to work.

I was forced to reboot sometimes since I was not at times
able to unmount the /AV filesystem, it sometimes reports
that the /AV filesystem was 'busy'. This seems to happen
if I mount/unmount several times then it says 'busy',
preventing me from unmounting. Hmm.

|I'm not sure why a context mount option wouldn't work for fuse - Eric?
|
|fuse itself won't let you chcon (setxattr) the files unless the
|filesystem supports setxattr, which is why you get Operation not
|supported there.
|
|> I even tried: setsebool -P samba_export_all_rw=1 and that
|> does not work, either.
|>
|> If I setenforce 0, I can share the NTFS filesystem, but I
|> really do not want to do this. Can someone please give me
|> a workaround?
|
|You can certainly generate a local policy module that gives access to
|fusefs_t, but it would be better if we could get the context mount
|option to work.

I will try anything you suggest. Let me know if you can
resolve this issue, otherwise let me know (in detail) how
to write a policy as a last resort?

Thanks much!
Dan

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 
Old 05-13-2008, 06:46 PM
Daniel J Walsh
 
Default Samba shares...

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Daniel B. Thurman wrote:
> Stephen Smalley wrote:
> |On Tue, 2008-05-13 at 10:27 -0700, Daniel B. Thurman wrote:
> |> Daniel B. Thurman wrote:
> |> |Stephen Smalley
> |> ||On Tue, 2008-05-13 at 08:12 -0700, Daniel B. Thurman wrote:
> |> ||> Stephen Smalley wrote:
> |> ||> >> Daniel B. Thurman wrote:
> |> ||> >> I am not sure what is going on. I am unable to get
> |> ||> >> samba shares to work for an NTFS filesystem. I do
> |> ||> >> have several shares working for ext3 filesystems.
> |> ||> >>
> |> ||> >> Here is what I did:
> |> ||> >>
> |> ||> >> 1) Create an empty directory: /AV
> |> ||> >> 2) chcon -t samba_share_t /AV
> |> ||> >> 3) chmod 775 !$
> |> ||> >> 4) chgrp avusers !$
> |> ||> >> 5) Add to fstab
> |> ||> >> /dev/sda1 /AV ntfs defaults 1 2
> |> | [snipped!]
> |> ||
> |> ||It is just another mount option, so you can just do something like:
> |> ||/dev/sda1 /AV ntfs
> |> |defaults,context=system_ubject_r:samba_share_t 1 2
> |> |
> |> |Yes, I thought so. I tried that and the context does not
> |> |change. Any ideas?
> |>
> |> Mounting an NTFS filesystem even with context options,
> |> the context always remains as fusefs_t. I am allowed
> |> to change the context on the directory before the mount,
> |> but not after the mount. After mounting, I am not allowed
> |> to chcon the mounted FS as it says that the Operation is
> |> not allowed.
> |
> |Can you confirm that if you umount /AV and then mount it with the
> |context= option that it really doesn't work for you? You do have to
> |umount it though if you previously mounted it w/o the context option to
> |make the option take affect.
>
> Yes, I can confirm that adding context= to the option line
> in /etc/fstab does not seem to do anything, i.e. the context
> does not change and remains fusefs_t. I tried several times,
> and even tried the fscontext= as well, neither seems to work.
>
> I was forced to reboot sometimes since I was not at times
> able to unmount the /AV filesystem, it sometimes reports
> that the /AV filesystem was 'busy'. This seems to happen
> if I mount/unmount several times then it says 'busy',
> preventing me from unmounting. Hmm.
>
> |I'm not sure why a context mount option wouldn't work for fuse - Eric?
> |
> |fuse itself won't let you chcon (setxattr) the files unless the
> |filesystem supports setxattr, which is why you get Operation not
> |supported there.
> |
> |> I even tried: setsebool -P samba_export_all_rw=1 and that
> |> does not work, either.
> |>
> |> If I setenforce 0, I can share the NTFS filesystem, but I
> |> really do not want to do this. Can someone please give me
> |> a workaround?
> |
> |You can certainly generate a local policy module that gives access to
> |fusefs_t, but it would be better if we could get the context mount
> |option to work.
>
> I will try anything you suggest. Let me know if you can
> resolve this issue, otherwise let me know (in detail) how
> to write a policy as a last resort?
>
> Thanks much!
> Dan
This looks like a bug.

If you are using fedora 9 policy it has a boolean

samba_share_fusefs

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkgp4e4ACgkQrlYvE4MpobN14ACg1mVCa9sxAo DThvTwSMW5v+2C
etcAoIVXMYbp+hBFVWzjDjVP2VYh7Iaf
=VZTf
-----END PGP SIGNATURE-----

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 

Thread Tools




All times are GMT. The time now is 03:55 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org