[gentoo-hardened] Confused about winbindd and SELinux

[Mike Edenfield]

I'm trying to track down a bunch of AVC denials related to winbindd on 
one of our file servers, and I'm confused as to how winbindd is supposed 
to work with SELinux.  Specifically, it looks like the UNIX pipe used to 
talk to winbindd is in a different place on my system than SELinux 
expects to find it.

I have a pipe in /tmp/.winbindd/pipe which was labelled winbind_tmp_t. 
However, when I check the file_contexts file, and the .fc files from the 
reference policy, I don't see any mention of /tmp/.winbindd.  So my 
first question is, how is this file getting a label that doesn't seem to 
exist in the policy?

More importantly, the interface file for samba includes an interface 
macro to grant access to winbind's communication pipe, but it looks like 
this:

interface(`samba_stream_connect_winbind',`
         gen_require(`
                 type samba_var_t, winbind_t, winbind_var_run_t;
         ')

         files_search_pids($1)
         allow $1 samba_var_t:dir search_dir_perms;
 
stream_connect_pattern($1,winbind_var_run_t,winbind_var_run_t,winbind_t)
')

I don't see any mention of winbind_tmp_t there, but I do see 
winbind_var_run_t.  I've also seen other posts to this list that seem to 
indicate winbind creates it's UNIX pipe in /var/run/winbindd, which *is* 
listed in file_contexts but isn't anywhere on my system.  The 
documentation for samba also makes no mention of /var/run/winbindd, but 
does specifically mention /tmp/.winbindd.

Is there something I missed when installing samba, or some setting for 
winbindd that I overlooked?

Thanks for any help,

--Mike
-- 
gentoo-hardened@l.g.o mailing list