smbd_selinux(8)

1smbd_selinux(8)               SELinux Policy smbd              smbd_selinux(8)
2
3
4

NAME

6       smbd_selinux - Security Enhanced Linux Policy for the smbd processes
7

DESCRIPTION

9       Security-Enhanced  Linux secures the smbd processes via flexible manda‐
10       tory access control.
11
12       The smbd processes execute with the smbd_t SELinux type. You can  check
13       if  you  have  these processes running by executing the ps command with
14       the -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep smbd_t
19
20
21

ENTRYPOINTS

23       The smbd_t SELinux type can be entered via the smbd_exec_t file type.
24
25       The default entrypoint paths for the smbd_t domain are the following:
26
27       /usr/sbin/smbd
28

PROCESS TYPES

30       SELinux defines process types (domains) for each process running on the
31       system
32
33       You can see the context of a process using the -Z option to ps
34
35       Policy  governs  the  access confined processes have to files.  SELinux
36       smbd policy is very flexible allowing users to setup  their  smbd  pro‐
37       cesses in as secure a method as possible.
38
39       The following process types are defined for smbd:
40
41       smbd_t
42
43       Note:  semanage  permissive  -a  smbd_t can be used to make the process
44       type smbd_t permissive. SELinux does  not  deny  access  to  permissive
45       process  types, but the AVC (SELinux denials) messages are still gener‐
46       ated.
47
48

BOOLEANS

50       SELinux policy is customizable based on least  access  required.   smbd
51       policy is extremely flexible and has several booleans that allow you to
52       manipulate the policy and run smbd with the tightest access possible.
53
54
55
56       If you want to allow users to resolve user passwd entries directly from
57       ldap  rather  then  using  a  sssd server, you must turn on the authlo‐
58       gin_nsswitch_use_ldap boolean. Disabled by default.
59
60       setsebool -P authlogin_nsswitch_use_ldap 1
61
62
63
64       If you want to allow all domains to execute in fips_mode, you must turn
65       on the fips_mode boolean. Enabled by default.
66
67       setsebool -P fips_mode 1
68
69
70
71       If  you  want  to allow confined applications to run with kerberos, you
72       must turn on the kerberos_enabled boolean. Disabled by default.
73
74       setsebool -P kerberos_enabled 1
75
76
77
78       If you want to allow system to run with  NIS,  you  must  turn  on  the
79       nis_enabled boolean. Disabled by default.
80
81       setsebool -P nis_enabled 1
82
83
84
85       If  you  want to allow confined applications to use nscd shared memory,
86       you must turn on the nscd_use_shm boolean. Disabled by default.
87
88       setsebool -P nscd_use_shm 1
89
90
91
92       If you want to allow samba to create new  home  directories  (e.g.  via
93       PAM),  you must turn on the samba_create_home_dirs boolean. Disabled by
94       default.
95
96       setsebool -P samba_create_home_dirs 1
97
98
99
100       If you want to allow samba to act as the domain controller, add  users,
101       groups  and  change  passwords,  you must turn on the samba_domain_con‐
102       troller boolean. Disabled by default.
103
104       setsebool -P samba_domain_controller 1
105
106
107
108       If you want to allow samba to share users home  directories,  you  must
109       turn on the samba_enable_home_dirs boolean. Disabled by default.
110
111       setsebool -P samba_enable_home_dirs 1
112
113
114
115       If  you  want to allow samba to share any file/directory read only, you
116       must turn on the samba_export_all_ro boolean. Disabled by default.
117
118       setsebool -P samba_export_all_ro 1
119
120
121
122       If you want to allow samba to share any file/directory read/write,  you
123       must turn on the samba_export_all_rw boolean. Disabled by default.
124
125       setsebool -P samba_export_all_rw 1
126
127
128
129       If  you want to allow smbd to load libgfapi from gluster, you must turn
130       on the samba_load_libgfapi boolean. Disabled by default.
131
132       setsebool -P samba_load_libgfapi 1
133
134
135
136       If you want to allow samba to act as a portmapper, you must turn on the
137       samba_portmapper boolean. Disabled by default.
138
139       setsebool -P samba_portmapper 1
140
141
142
143       If  you want to allow samba to run unconfined scripts, you must turn on
144       the samba_run_unconfined boolean. Disabled by default.
145
146       setsebool -P samba_run_unconfined 1
147
148
149
150       If you want to allow samba to export ntfs/fusefs volumes, you must turn
151       on the samba_share_fusefs boolean. Disabled by default.
152
153       setsebool -P samba_share_fusefs 1
154
155
156
157       If  you want to allow samba to export NFS volumes, you must turn on the
158       samba_share_nfs boolean. Disabled by default.
159
160       setsebool -P samba_share_nfs 1
161
162
163

PORT TYPES

165       SELinux defines port types to represent TCP and UDP ports.
166
167       You can see the types associated with a port  by  using  the  following
168       command:
169
170       semanage port -l
171
172
173       Policy  governs  the  access  confined  processes  have to these ports.
174       SELinux smbd policy is very flexible allowing users to setup their smbd
175       processes in as secure a method as possible.
176
177       The following port types are defined for smbd:
178
179
180       smbd_port_t
181
182
183
184       Default Defined Ports:
185                 tcp 445,137-139
186

MANAGED FILES

188       The  SELinux process type smbd_t can manage files labeled with the fol‐
189       lowing file types.  The paths listed are the default  paths  for  these
190       file types.  Note the processes UID still need to have DAC permissions.
191
192       auth_cache_t
193
194            /var/cache/coolkey(/.*)?
195
196       cluster_conf_t
197
198            /etc/cluster(/.*)?
199
200       cluster_var_lib_t
201
202            /var/lib/pcsd(/.*)?
203            /var/lib/cluster(/.*)?
204            /var/lib/openais(/.*)?
205            /var/lib/pengine(/.*)?
206            /var/lib/corosync(/.*)?
207            /usr/lib/heartbeat(/.*)?
208            /var/lib/heartbeat(/.*)?
209            /var/lib/pacemaker(/.*)?
210
211       cluster_var_run_t
212
213            /var/run/crm(/.*)?
214            /var/run/cman_.*
215            /var/run/rsctmp(/.*)?
216            /var/run/aisexec.*
217            /var/run/heartbeat(/.*)?
218            /var/run/corosync-qnetd(/.*)?
219            /var/run/corosync-qdevice(/.*)?
220            /var/run/corosync.pid
221            /var/run/cpglockd.pid
222            /var/run/rgmanager.pid
223            /var/run/cluster/rgmanager.sk
224
225       ctdbd_var_lib_t
226
227            /var/lib/ctdb(/.*)?
228            /var/lib/ctdbd(/.*)?
229
230       faillog_t
231
232            /var/log/btmp.*
233            /var/log/faillog.*
234            /var/log/tallylog.*
235            /var/run/faillock(/.*)?
236
237       fusefs_t
238
239            /var/run/user/[^/]*/gvfs
240
241       glusterd_var_lib_t
242
243            /var/lib/glusterd(/.*)?
244
245       glusterd_var_run_t
246
247            /var/run/gluster(/.*)?
248            /var/run/glusterd.*
249            /var/run/glusterd.*
250            /var/run/glusterd(/.*)?
251
252       httpd_user_content_t
253
254            /home/[^/]+/((www)|(web)|(public_html))(/.+)?
255
256       initrc_var_run_t
257
258            /var/run/utmp
259            /var/run/random-seed
260            /var/run/runlevel.dir
261            /var/run/setmixer_flag
262
263       krb5_host_rcache_t
264
265            /var/cache/krb5rcache(/.*)?
266            /var/tmp/nfs_0
267            /var/tmp/DNS_25
268            /var/tmp/host_0
269            /var/tmp/imap_0
270            /var/tmp/HTTP_23
271            /var/tmp/HTTP_48
272            /var/tmp/ldap_55
273            /var/tmp/ldap_487
274            /var/tmp/ldapmap1_0
275
276       nfs_t
277
278
279       nmbd_var_run_t
280
281            /var/run/nmbd(/.*)?
282            /var/run/samba/nmbd(/.*)?
283            /var/run/samba/nmbd.pid
284            /var/run/samba/messages.tdb
285            /var/run/samba/namelist.debug
286            /var/run/samba/unexpected.tdb
287
288       non_security_file_type
289
290
291       noxattrfs
292
293            all files on file systems which do not support extended attributes
294
295       public_content_rw_t
296
297            /var/spool/abrt-upload(/.*)?
298
299       root_t
300
301            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
302            /
303            /initrd
304
305       samba_etc_t
306
307            /etc/samba(/.*)?
308
309       samba_log_t
310
311            /var/log/samba(/.*)?
312
313       samba_secrets_t
314
315            /etc/samba/smbpasswd
316            /etc/samba/passdb.tdb
317            /etc/samba/MACHINE.SID
318            /etc/samba/secrets.tdb
319
320       samba_share_t
321
322            use this label for random content that will be shared using samba
323
324       samba_spool_t
325
326            /var/spool/samba(/.*)?
327
328       samba_var_t
329
330            /var/nmbd(/.*)?
331            /var/lib/samba(/.*)?
332            /var/cache/samba(/.*)?
333
334       security_t
335
336            /selinux
337
338       smbd_tmp_t
339
340
341       smbd_tmpfs_t
342
343
344       smbd_var_run_t
345
346            /var/run/samba(/.*)?
347            /var/run/samba/smbd.pid
348            /var/run/samba/brlock.tdb
349            /var/run/samba/locking.tdb
350            /var/run/samba/gencache.tdb
351            /var/run/samba/sessionid.tdb
352            /var/run/samba/share_info.tdb
353            /var/run/samba/connections.tdb
354
355       user_home_type
356
357            all user home files
358
359       wtmp_t
360
361            /var/log/wtmp.*
362
363

FILE CONTEXTS

365       SELinux requires files to have an extended attribute to define the file
366       type.
367
368       You can see the context of a file using the -Z option to ls
369
370       Policy governs the access  confined  processes  have  to  these  files.
371       SELinux smbd policy is very flexible allowing users to setup their smbd
372       processes in as secure a method as possible.
373
374       EQUIVALENCE DIRECTORIES
375
376
377       smbd policy stores data with  multiple  different  file  context  types
378       under  the  /var/run/samba  directory.   If you would like to store the
379       data in a different directory you can use the semanage command to  cre‐
380       ate an equivalence mapping.  If you wanted to store this data under the
381       /srv dirctory you would execute the following command:
382
383       semanage fcontext -a -e /var/run/samba /srv/samba
384       restorecon -R -v /srv/samba
385
386       STANDARD FILE CONTEXT
387
388       SELinux defines the file context types for the smbd, if you  wanted  to
389       store  files  with  these types in a diffent paths, you need to execute
390       the semanage command  to  sepecify  alternate  labeling  and  then  use
391       restorecon to put the labels on disk.
392
393       semanage fcontext -a -t smbd_var_run_t '/srv/mysmbd_content(/.*)?'
394       restorecon -R -v /srv/mysmbd_content
395
396       Note:  SELinux  often  uses  regular expressions to specify labels that
397       match multiple files.
398
399       The following file types are defined for smbd:
400
401
402
403       smbd_exec_t
404
405       - Set files with the smbd_exec_t type, if you  want  to  transition  an
406       executable to the smbd_t domain.
407
408
409
410       smbd_keytab_t
411
412       - Set files with the smbd_keytab_t type, if you want to treat the files
413       as kerberos keytab files.
414
415
416
417       smbd_tmp_t
418
419       - Set files with the smbd_tmp_t type, if you want to store smbd  tempo‐
420       rary files in the /tmp directories.
421
422
423
424       smbd_tmpfs_t
425
426       - Set files with the smbd_tmpfs_t type, if you want to store smbd files
427       on a tmpfs file system.
428
429
430
431       smbd_var_run_t
432
433       - Set files with the smbd_var_run_t type, if you want to store the smbd
434       files under the /run or /var/run directory.
435
436
437       Paths:
438            /var/run/samba(/.*)?,                     /var/run/samba/smbd.pid,
439            /var/run/samba/brlock.tdb,             /var/run/samba/locking.tdb,
440            /var/run/samba/gencache.tdb,         /var/run/samba/sessionid.tdb,
441            /var/run/samba/share_info.tdb, /var/run/samba/connections.tdb
442
443
444       Note: File context can be temporarily modified with the chcon  command.
445       If  you want to permanently change the file context you need to use the
446       semanage fcontext command.  This will modify the SELinux labeling data‐
447       base.  You will need to use restorecon to apply the labels.
448
449

SHARING FILES

451       If  you  want to share files with multiple domains (Apache, FTP, rsync,
452       Samba), you can set a file context of public_content_t and  public_con‐
453       tent_rw_t.   These  context  allow any of the above domains to read the
454       content.  If you want a particular domain to write to  the  public_con‐
455       tent_rw_t domain, you must set the appropriate boolean.
456
457       Allow  smbd  servers to read the /var/smbd directory by adding the pub‐
458       lic_content_t file type to the directory  and  by  restoring  the  file
459       type.
460
461       semanage fcontext -a -t public_content_t "/var/smbd(/.*)?"
462       restorecon -F -R -v /var/smbd
463
464       Allow  smbd  servers to read and write /var/smbd/incoming by adding the
465       public_content_rw_t type to the directory and  by  restoring  the  file
466       type.  You also need to turn on the smbd_anon_write boolean.
467
468       semanage fcontext -a -t public_content_rw_t "/var/smbd/incoming(/.*)?"
469       restorecon -F -R -v /var/smbd/incoming
470       setsebool -P smbd_anon_write 1
471
472
473       If  you want to allow samba to modify public files used for public file
474       transfer  services.   Files/Directories  must  be  labeled  public_con‐
475       tent_rw_t., you must turn on the smbd_anon_write boolean.
476
477       setsebool -P smbd_anon_write 1
478
479

COMMANDS

481       semanage  fcontext  can also be used to manipulate default file context
482       mappings.
483
484       semanage permissive can also be used to manipulate  whether  or  not  a
485       process type is permissive.
486
487       semanage  module can also be used to enable/disable/install/remove pol‐
488       icy modules.
489
490       semanage port can also be used to manipulate the port definitions
491
492       semanage boolean can also be used to manipulate the booleans
493
494
495       system-config-selinux is a GUI tool available to customize SELinux pol‐
496       icy settings.
497
498

AUTHOR

500       This manual page was auto-generated using sepolicy manpage .
501
502