33 lines
1.5 KiB
Diff
33 lines
1.5 KiB
Diff
From 88a28fc843a9e3a0039647d0b6fdd5ac7895a286 Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Tue, 21 Jun 2022 16:02:49 +0200
|
|
Subject: [PATCH] Allow samba-dcerpcd work with sssd
|
|
|
|
Addresses the following AVC denials:
|
|
|
|
type=AVC msg=audit(1655206265.325:3211): avc: denied { open } for pid=33521 comm="samba-dcerpcd" path="/var/lib/sss/mc/initgroups" dev="vda3" ino=25205857 scontext=system_u:system_r:winbind_rpcd_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=1
|
|
type=AVC msg=audit(1655206265.325:3214): avc: denied { connectto } for pid=33521 comm="samba-dcerpcd" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:winbind_rpcd_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=unix_stream_socket permissive=1
|
|
type=AVC msg=audit(1655206265.325:3214): avc: denied { write } for pid=33521 comm="samba-dcerpcd" name="nss" dev="vda3" ino=17045861 scontext=system_u:system_r:winbind_rpcd_t:s0 tcontext=system_u:object_r:sssd_var_lib_t:s0 tclass=sock_file permissive=1
|
|
|
|
Resolves: rhbz#2096825
|
|
---
|
|
policy/modules/contrib/samba.te | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
diff --git a/policy/modules/contrib/samba.te b/policy/modules/contrib/samba.te
|
|
index 5e851af84a..091e016fd0 100644
|
|
--- a/policy/modules/contrib/samba.te
|
|
+++ b/policy/modules/contrib/samba.te
|
|
@@ -1215,6 +1215,11 @@ optional_policy(`
|
|
logging_send_syslog_msg(winbind_rpcd_t)
|
|
')
|
|
|
|
+optional_policy(`
|
|
+ sssd_read_public_files(winbind_rpcd_t)
|
|
+ sssd_stream_connect(winbind_rpcd_t)
|
|
+')
|
|
+
|
|
optional_policy(`
|
|
sysnet_read_config(winbind_rpcd_t)
|
|
')
|