0

i have samba share set up to give me access to my linux box from my windows 7 machine, everything is fine, except i can't access the /var director for some reason through windows. however, i can access every other directory no problem

I the error i get when i try to access the /var directory is:

Z:\var is not accessible.

Access is denied.

I am using centos 5.5

root is the allowed samba user. and here is my samba configuration:

[global]
   workgroup = WORKGROUP
   netbios name = SAMBA
   server string = Samba Server %v
   map to guest = Bad User
   log file = /var/log/samba/log.%m
   max log size = 50
   socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
   preferred master = No
   local master = No
   dns proxy = No
   security = User

# Share
[root]
   path = /
   valid users = root
   read only = no
   browseable = yes
   writeable = yes
   create mask = 0777
   directory mask = 0777

here is my list of my root directory permissions & ownership

drwxr-xr-x  2 root root  4096 May 18 16:35 bin
drwxr-xr-x  4 root root  1024 May 18 16:36 boot
drwxr-xr-x 12 root root  3960 May 18 20:12 dev
drwxr-xr-x 55 root root  4096 May 19 02:05 etc
drwxrwxrwx  3 root root  4096 May 19 02:05 home
drwxr-xr-x 12 root root  4096 May 18 17:59 lib
drwx------  2 root root 16384 May 18 16:31 lost+found
drwxr-xr-x  2 root root  4096 Jan 26  2010 media
drwxr-xr-x  3 root root  4096 May 18 19:40 mnt
drwxr-xr-x  2 root root  4096 Jan 26  2010 opt
dr-xr-xr-x 86 root root     0 May 18 20:11 proc
drwxr-x---  2 root root  4096 May 18 20:10 root 
drwxr-xr-x  2 root root  4096 May 18 16:36 sbin
drwxr-xr-x  4 root root     0 May 18 20:11 selinux
drwxr-xr-x  2 root root  4096 Jan 26  2010 srv
drwxr-xr-x 11 root root     0 May 18 20:11 sys
drwxrwxrwt  3 root root  4096 May 19 01:28 tmp
drwxr-xr-x 13 root root  4096 May 18 16:34 usr
drwxr-xr-x 18 root root  4096 May 18 17:51 var

am i doing something wrong? or is this a centos security thing?

1
  • why you want to share / ? this isn't a good idea.
    – c4f4t0r
    Aug 23, 2015 at 22:00

1 Answer 1

1

Probably SELinux is preventing Samba from reading a directory in /var as it is not normally required.

  • You can turn this off using setsebool -P samba_export_all_rw=on but is will decrease Samba security, as Samba would be able to read everywhere.
  • A better way would be to move data, which would be accessed by Samba, for example to /home/samba and run setsebool -P samba_enable_home_dirs=on, as it would allow Samba to read home directories only.
  • The best is to configure SELinux allowing Samba to read a directory with particular SELinux label (for example httpd_sys_content_t in /var/www — check your directory with ls -lZ) but this is where it gets a little complicated:
    yum install selinux-policy-devel
    mkdir /etc/selinux/local
    cd /etc/selinux/local
    (
      echo 'avc: denied { manage_file_perms } for ' \
        ' scontext=system_u:system_r:smb_t ' \
        ' tcontext=system_u:object_r:httpd_sys_content_t tclass=file'
      echo 'avc: denied { manage_dir_perms } for ' \
        ' scontext=system_u:system_r:smb_t ' \
        ' tcontext=system_u:object_r:httpd_sys_content_t tclass=dir'
    ) | audit2allow -M local
    semodule -i local.pp
    

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .