Re: Problem with SELinux and Squid+Winbind+Samba

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Tue, Dec 07, 2004 at 09:19:14AM -0200, Luis Fernando C. Talora wrote:
> Fellows,
>  
> I?m trying to put a server running Squid with Microsoft Windows Active
> Directory integrated authentication (using Samba 3 and Winbind). When I
> start the squid service, I get the following message (it repeats itself many
> times):
>  
> Dec  7 08:48:56 svux8-250 kernel: audit(1102416536.028:0): avc:  denied  {
> getattr } for  pid=3825 exe=/usr/lib/squid/wb_ntlmauth
> path=/var/run/winbindd/pipe dev=hda7 ino=627398
> scontext=root:system_r:squid_t tcontext=root:object_r:var_run_t
> tclass=sock_file
  
> Since I?m new in SELinux, I have no idea how to solve this. Could someone
> give some help?
 
  ah.   there's quite a lot involved!

  the first thing is, ideally, to write a separate policy for winbindd,
  esp. making /var/run/winbindd have its own file context.

  then you can grant wb_ntlmmauth (or squid_t) the right to access
  /var/run/winbindd/pipe.

 ... anyone got any opinions as to whether winbind should be creating a
 socket in /var/run?  is that FHS compliant?

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.