SELinux在CentOS 7中使用Samba和SSSD在Kerberos Ticket生成中进行规则

我已经build立了一个简单的文件服务器与桑巴和Netatalk在CentOS 7.2上运行。 除了拒绝Samba进行身份validation的SELinux之外，所有事情都按预期工作，这是因为拒绝Kerberos票证的/var/tmp写入的策略。

这是一个SELinux问题，因为如果SELinux被禁用，并且在试图以允许模式安装SELinux的SMB时，那些条目出现在audit.log ，一切都按预期工作：

 type=AVC msg=audit(1466917992.944:493): avc: denied { write } for pid=3902 comm="smbd" name="DALARAN-044_0" dev="dm-0" ino=50452330 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file type=AVC msg=audit(1466917992.944:493): avc: denied { open } for pid=3902 comm="smbd" path="/var/tmp/DALARAN-044_0" dev="dm-0" ino=50452330 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file type=SYSCALL msg=audit(1466917992.944:493): arch=c000003e syscall=2 success=yes exit=39 a0=7fa840d08290 a1=2 a2=180 a3=7ffc93307cb0 items=0 ppid=3578 pid=3902 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=system_u:system_r:smbd_t:s0 key=(null) 

我在网上查过，但我无法find解决scheme。 已经有一些像这样的SELinux位设置：

 getsebool -a | grep -iP "samba|smb|nmb|kerberos|krb|tmp" gssd_read_tmp --> on httpd_tmp_exec --> off kerberos_enabled --> on samba_create_home_dirs --> off samba_domain_controller --> off samba_enable_home_dirs --> on samba_export_all_ro --> off samba_export_all_rw --> off samba_load_libgfapi --> off samba_portmapper --> off samba_run_unconfined --> off samba_share_fusefs --> off samba_share_nfs --> off sanlock_use_samba --> off smbd_anon_write --> off tmpreaper_use_nfs --> off tmpreaper_use_samba --> off use_samba_home_dirs --> off virt_sandbox_use_samba --> off virt_use_samba --> off 

所以缺less一些东西，我想保持SELinux的启用。

• 在Centos上为Postgresconfiguration防火墙规则的问题
• 在CentOS 7.x的configuration文件位置上
• 在CentOS 7上loggingnginx到syslog
• CentOS 7 DHCP服务器启动失败（在指定的端口上不启用）
• 所有者无法读取/ proc / $ pid / io

谢谢，

附加信息：

文件： /etc/krb5.conf

 [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] dns_lookup_realm = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false # default_realm = EXAMPLE.COM default_ccache_name = KEYRING:persistent:%{uid} [realms] # EXAMPLE.COM = { # kdc = kerberos.example.com # admin_server = kerberos.example.com # } [domain_realm] # .example.com = EXAMPLE.COM # example.com = EXAMPLE.COM 

文件： /etc/sssd/sssd.conf

 [sssd] domains = if.ufrj.br config_file_version = 2 services = nss, pam [domain/if.ufrj.br] ad_domain = if.ufrj.br krb5_realm = IF.UFRJ.BR realmd_tags = manages-system joined-with-samba cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True #use_fully_qualified_names = True fallback_homedir = /home/%u access_provider = ad 

文件： /etc/samba/smb.conf

 [global] server string = Samba Server Version %v workgroup = IF log file = /var/log/samba/log.%m max log size = 50 log level = 3 security = ads realm = IF.UFRJ.BR kerberos method = system keytab load printers = no cups options = raw printing = bsd printcap name = /dev/null [homes] comment = Home Directories browseable = no writable = yes vfs objects = catia fruit streams_xattr fruit:resource = file fruit:metadata = netatalk fruit:locking = netatalk fruit:encoding = native 

 #============= smbd_t ============== #!!!! This avc can be allowed using the boolean 'samba_export_all_rw' allow smbd_t tmp_t:file { write open }; 

 allow smbd_t smbd_tmp_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ; allow smbd_t samba_var_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ; 

 semanage fcontext -a -t smbd_tmp_t "/var/tmp/samba(/.*)?" mkdir /var/tmp/samba #(and set the file ownership and perms appropriately) restorecon -r /var/tmp/samba 

  semanage fcontext -a -t smbd_tmp_t "/var/tmp/DALARAN-044_0" restorecon -r /var/tmp/DALARAN-044_0