Re: [gentoo-hardened] Confused about winbindd and SELinux

[Mike Edenfield]

Chris PeBenito wrote:

> type_transition statements in the policy are mechanisms for changing the
> default context on objects.  Its what makes it possible for 99% of the
> apps to be SELinux-ignorant.

Ok, that does make perfect sense.  I guess I need to look harder next 
time when trying to decipher these AVC messages.

> The above interface is for connecting to winbind over a unix domain
> socket.  If you have a list of apps that want to communicate with
> windbind over that pipe, I can fix up the policy.

Well, I have a list of apps that are trying to connect to winbind, but 
they're not using the domain from that interface.  That's kinda where my 
confusion is coming from.  The interface appears to grant access to the 
pipe from /var/cache/samba/winbindd_privileged (which is labeled 
winbind_var_run_t), but not the pipe from /tmp/.winbindd (which is 
labeled winbind_tmp_t).  My main concern was that something was wrong 
with my setup that's making winbind not cooperate with the SELinux policy.

But to actually address your email :), so far I've gotten AVC's from 
these domains that I think have a legitimate reason to access winbind:

crond_t, newrole_t, semanage_t (for genhomedircon), sshd_t, and the 
various *_sudo_t domains.

I also got warnings from portage_t.sandbox, because it runs tar.  I can 
see allow rules already in place for portage_t.sandbox -> winbind_tmp_t 
for objects of type file, dir, and lnk_file, but I'm seeing messages for 
winbind_tmp_t:sock_file as well.

There was one from run_init_t, which appears to be when it runs the 
samba startup script, and I'm not sure why it's accessing the winbind 
pipe before it transitions into the samba domains.

--Mike





-- 
gentoo-hardened@l.g.o mailing list