Hello, using Fedora 16 and its samba 3.6 stack I would like to share a directory that is under a local ntfs mounted (with ntfs-3g) path... For normal dirs I'm able to share after chcon -t samba_share_t /dir/to/share/path
But for dirs under ntfs? Is there any directive to tell samba to skip selinux protection for particular shares?
Thanks in advance, Gianluca
On 01/20/2012 07:40, Gianluca Cecchi wrote:
Hello, using Fedora 16 and its samba 3.6 stack I would like to share a directory that is under a local ntfs mounted (with ntfs-3g) path... For normal dirs I'm able to share after chcon -t samba_share_t /dir/to/share/path
But for dirs under ntfs? Is there any directive to tell samba to skip selinux protection for particular shares?
Thanks in advance, Gianluca
So from what I understand ntfs-3g is a fuse filesystem. I would assume that when you do ls -Z on any file on your ntfs-3g mount that it comes back with the type fuse_t. Unfortunately fuse doesn't support finer-grained labeling with SELinux. The best thing that you will be able to do is make it so your entire ntfs-3g mount is labeled samba_share_t and then just export the folders you want. You should be able to do this by adding -o context=system_u:object_r:samba_share_t to your mount command for your ntfs-3g mount.
Dave
On 01/20/2012 09:13, David Quigley wrote:
On 01/20/2012 07:40, Gianluca Cecchi wrote:
Hello, using Fedora 16 and its samba 3.6 stack I would like to share a directory that is under a local ntfs mounted (with ntfs-3g) path... For normal dirs I'm able to share after chcon -t samba_share_t /dir/to/share/path
But for dirs under ntfs? Is there any directive to tell samba to skip selinux protection for particular shares?
Thanks in advance, Gianluca
So from what I understand ntfs-3g is a fuse filesystem. I would assume that when you do ls -Z on any file on your ntfs-3g mount that it comes back with the type fuse_t. Unfortunately fuse doesn't support finer-grained labeling with SELinux. The best thing that you will be able to do is make it so your entire ntfs-3g mount is labeled samba_share_t and then just export the folders you want. You should be able to do this by adding -o context=system_u:object_r:samba_share_t to your mount command for your ntfs-3g mount.
Dave
I just looked back at an old post I made on this very issue and it seems that there might be a problem. Unless it has been fixed the fuse mount program doesn't necessarially pass the context mount option down to the kernel to be handled. So the fix I suggested above might not work. They may have fixed that problem so give it a try anyway but if the mount option is not passed down there isn't much you can do about it.
Dave
On Fri Jan 20 16:08:49 UTC 2012 David Quigley wrote:
The best thing that you will be able to do is make it so your entire ntfs-3g mount is labeled samba_share_t and then just export the folders you want. You should be able to do this by adding -o context=system_u:object_r:samba_share_t to your mount command for your ntfs-3g mount.
I just looked back at an old post I made on this very issue and it seems that there might be a problem. Unless it has been fixed the fuse mount program doesn't necessarially pass the context mount option down to the kernel to be handled. So the fix I suggested above might not work. They may have fixed that problem so give it a try anyway but if the mount option is not passed down there isn't much you can do about it.
Dave
Unfortunately putting the line /dev/sda1 /w7 ntfs-3g context=system_u:object_r:samba_share_t 1 0
I get this when trying to mount: ntfs-3g-mount: mount failed: Invalid argument
And in messages: kernel: [14596.016616] SELinux: security_context_to_sid(system_u:object_r:samba_share_t) failed for (dev sda1, type fuseblk) errno=-22
On Fri, Jan 20, 2012 at 11:23 PM, Gianluca Cecchi gianluca.cecchi@gmail.com wrote:
Unfortunately putting the line /dev/sda1 /w7 ntfs-3g context=system_u:object_r:samba_share_t 1 0
I get this when trying to mount: ntfs-3g-mount: mount failed: Invalid argument
And in messages: kernel: [14596.016616] SELinux: security_context_to_sid(system_u:object_r:samba_share_t) failed for (dev sda1, type fuseblk) errno=-22
OK. Walking through other documents I found that the "correct" syntax is with a ":s0" at the end of the option, and also add defaults at the end, like:
context=system_u:object_r:samba_share_t:s0,defaults
This way I can correctly mount a share against a directory under the ntfs tree
ALso, creating a test.txt file from the windows network attached machine, the context properties are correctly managed from a linux point of view:
$ getfattr -n security.selinux /w7/test_share/test.txt getfattr: Removing leading '/' from absolute path names # file: w7/test_share/test.txt security.selinux="system_u:object_r:samba_share_t:s0"
Thanks, Gianluca
On 1/20/2012 5:45 PM, Gianluca Cecchi wrote:
On Fri, Jan 20, 2012 at 11:23 PM, Gianluca Cecchi gianluca.cecchi@gmail.com wrote:
Unfortunately putting the line /dev/sda1 /w7 ntfs-3g context=system_u:object_r:samba_share_t 1 0
I get this when trying to mount: ntfs-3g-mount: mount failed: Invalid argument
And in messages: kernel: [14596.016616] SELinux: security_context_to_sid(system_u:object_r:samba_share_t) failed for (dev sda1, type fuseblk) errno=-22
OK. Walking through other documents I found that the "correct" syntax is with a ":s0" at the end of the option, and also add defaults at the end, like:
context=system_u:object_r:samba_share_t:s0,defaults
This way I can correctly mount a share against a directory under the ntfs tree
ALso, creating a test.txt file from the windows network attached machine, the context properties are correctly managed from a linux point of view:
$ getfattr -n security.selinux /w7/test_share/test.txt getfattr: Removing leading '/' from absolute path names # file: w7/test_share/test.txt security.selinux="system_u:object_r:samba_share_t:s0"
Thanks, Gianluca
Its good to hear that those options are getting passed into the kernel now. Sorry about forgetting the s0 I copied and pasted the context from another post (and changed the type). I'm glad things worked out for you.
Dave