我在RHEL 6 x86_64系统上使用Fedora 12 pam_mount / libHX RPM，从configuration了NTFS-only安全性的NetApp系统自动安装主目录
AD绑定login工作正常 – 我有问题，使其自动挂载和映射用户homedir股份。 它抱怨最初被拒绝的权限，但是我可以很好地cd到主目录。
$ ssh username@hostname NOTE: This system is for the use of authorized users only username@hostname's password: Last login: Mon Feb 27 10:54:09 2012 from another.hostname Could not chdir to home directory /home/AD/username: Permission denied -bash-4.1$ cd -bash-4.1$ pwd /home/AD/username 这是/etc/security/pam_mount.conf.xml：
<?xml version="1.0" encoding="utf-8" ?> <!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd"> <pam_mount> <mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other,workgroup,nosetuids,noexec,nosuid,noserverino" /> <mntoptions require="nosuid,nodev" /> <logout wait="2" hup="0" term="yes" kill="0" /> <mkmountpoint enable="1" remove="true" /> <debug enable="0" /> <volume fstype="cifs" server="home.ad" path="%(USER)" mountpoint="/home/AD/%(USER)" options="workgroup=ad,uid=%(USER),dir_mode=0700,file_mode=0700,nosuid,nodev,noserverino" /> </pam_mount>
这是/etc/pam.d/password-auth：
# cat /etc/pam.d/password-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth required pam_mount.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_krb5.so use_first_pass auth sufficient pam_winbind.so use_first_pass auth required pam_deny.so account required pam_access.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_krb5.so account [default=bad success=ok user_unknown=ignore] pam_winbind.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_krb5.so use_authtok password sufficient pam_winbind.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_oddjob_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_mount.so session optional pam_krb5.so
在login时，我在/ var / log / messages中看到以下错误：
Feb 27 14:28:49 hostname kernel: type=1400 audit(1330381729.009:4304): avc: denied { search } for pid=3855 comm="sshd" name="/" dev=cifs ino=143 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cifs_t:s0 tclass=dir
只是closuresSELinux不是一个选项 – 我想弄清楚如何解决它，因为我认为这是根本原因。 有人能给我一些指针吗？
似乎没有任何相关的政策，允许这个默认情况下。 这是因为pam正在sshd_t上下文中加载模块，并试图做一些通常与sshd_ttypes应该做的事情不相关的时髦东西。
要修复这个棍子下面的文件，可能叫它mysshd.te;
policy_module(mysshd, 0.0.1) gen_require(` type cifs_t; type sshd_t; ') read_files_pattern(sshd_t, cifs_t, cifs_t, { file, dir}) # If that doesnt work, try this #manage_files_pattern(sshd_t, cifs_t, cifs_t {file, dir})
通过运行以下命令来编译它：
make -f /usr/share/selinux/devel/Makefile
制作并加载它：
make -f /usr/share/selinux/devel/Makefile load
然后，再试一次。