Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i have samba share set up to give me access to my linux box from my windows 7 machine, everything is fine, except i can't access the /var director for some reason through windows. however, i can access every other directory no problem

I the error i get when i try to access the /var directory is:

Z:\var is not accessible.

Access is denied.

I am using centos 5.5

root is the allowed samba user. and here is my samba configuration:

[global]
   workgroup = WORKGROUP
   netbios name = SAMBA
   server string = Samba Server %v
   map to guest = Bad User
   log file = /var/log/samba/log.%m
   max log size = 50
   socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
   preferred master = No
   local master = No
   dns proxy = No
   security = User

# Share
[root]
   path = /
   valid users = root
   read only = no
   browseable = yes
   writeable = yes
   create mask = 0777
   directory mask = 0777

here is my list of my root directory permissions & ownership

drwxr-xr-x  2 root root  4096 May 18 16:35 bin
drwxr-xr-x  4 root root  1024 May 18 16:36 boot
drwxr-xr-x 12 root root  3960 May 18 20:12 dev
drwxr-xr-x 55 root root  4096 May 19 02:05 etc
drwxrwxrwx  3 root root  4096 May 19 02:05 home
drwxr-xr-x 12 root root  4096 May 18 17:59 lib
drwx------  2 root root 16384 May 18 16:31 lost+found
drwxr-xr-x  2 root root  4096 Jan 26  2010 media
drwxr-xr-x  3 root root  4096 May 18 19:40 mnt
drwxr-xr-x  2 root root  4096 Jan 26  2010 opt
dr-xr-xr-x 86 root root     0 May 18 20:11 proc
drwxr-x---  2 root root  4096 May 18 20:10 root 
drwxr-xr-x  2 root root  4096 May 18 16:36 sbin
drwxr-xr-x  4 root root     0 May 18 20:11 selinux
drwxr-xr-x  2 root root  4096 Jan 26  2010 srv
drwxr-xr-x 11 root root     0 May 18 20:11 sys
drwxrwxrwt  3 root root  4096 May 19 01:28 tmp
drwxr-xr-x 13 root root  4096 May 18 16:34 usr
drwxr-xr-x 18 root root  4096 May 18 17:51 var

am i doing something wrong? or is this a centos security thing?

share|improve this question

1 Answer 1

Probably SELinux is preventing Samba from reading a directory in /var as it is not normally required.

  • You can turn this off using setsebool -P samba_export_all_rw=on but is will decrease Samba security, as Samba would be able to read everywhere.
  • A better way would be to move data, which would be accessed by Samba, for example to /home/samba and run setsebool -P samba_enable_home_dirs=on, as it would allow Samba to read home directories only.
  • The best is to configure SELinux allowing Samba to read a directory with particular SELinux label (for example httpd_sys_content_t in /var/www — check your directory with ls -lZ) but this is where it gets a little complicated:
    yum install selinux-policy-devel
    mkdir /etc/selinux/local
    cd /etc/selinux/local
    (
      echo 'avc: denied { manage_file_perms } for ' \
        ' scontext=system_u:system_r:smb_t ' \
        ' tcontext=system_u:object_r:httpd_sys_content_t tclass=file'
      echo 'avc: denied { manage_dir_perms } for ' \
        ' scontext=system_u:system_r:smb_t ' \
        ' tcontext=system_u:object_r:httpd_sys_content_t tclass=dir'
    ) | audit2allow -M local
    semodule -i local.pp
    
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.