1

I'm new to SElinux so I don't know much about how to use it. I want to run my Fedora Server using a samba share (already configured and working) and configured a podman container, mounting the same directory. But while SElinux is on, the container cannot access the mounted directory. Turning SElinux off (setenforce 0) "solves" that.

So currently I've tried using public_content_rw_t on that directory, but still not works.

# first try
$ semanage fcontext -a -t samba_share_t "/srv/downloads(/.*)?"
$ restorecon -Rv /srv/downloads

# second try
$ semanage fcontext -m -t public_content_rw_t "/srv/downloads(/.*)?"
$ restorecon -Rv /srv/downloads

In both cases, podman container is not able to access the same directory. SElinux is preventing it (logs: setroubleshoot[1232603]: SELinux is preventing java from write access on the directory /srv/downloads). For example using: podman exec -it $CONTAINER ls -l /downloads (mounted /srv/downloads:/downloads with rw).

I want to run my server with SElinux. What do I need to configure, that both processes are able to use the same directory?

4
  • Is this machine running a Samba server or a Samba client? – Michael Hampton Sep 2 '20 at 18:27
  • I'm using samba server. – Michael Hirschler Sep 3 '20 at 6:49
  • 1
    You'll have to generate a local policy module, then, as Guser314 suggested in their answer. This is only currently supported by SELinux if your filesystem was mounted as a client from some other SMB server. – Michael Hampton Sep 3 '20 at 14:16
  • Generating a local policy should be easy. What do you mean by "from some other SMB server"? If I mount the SMB share using my workstation count? – Michael Hirschler Sep 3 '20 at 18:20
2
+50

Since new to SELinux there are more tools available to help you figure it out, which I just found this last week. A starting point is here. Mainly the audit.log with audit2why and audit2allow. I setenforce to 0, cp /dev/null over audit.log, run failing commands (which succeed in Permissive mode but are still logged in the audit log), then save the log and analyze as in the link above. I used this process over the last few days to create a custom policy for a flask/apache api running python subprocesses. So not a specific answer, but the process should get you to a solution as it did me.

1
  • Thank you, maybe I can take a look and do some investigating. – Michael Hirschler Sep 3 '20 at 6:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.