Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 684134 - net-fs/samba-4.8.6-r2: apparmor profile blocks smbd and nmbd
Summary: net-fs/samba-4.8.6-r2: apparmor profile blocks smbd and nmbd
Status: UNCONFIRMED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: AMD64 Linux
: Normal normal (vote)
Assignee: Gentoo's SAMBA Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-04-22 15:37 UTC by onkobu
Modified: 2022-02-06 12:37 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
emerge --info (emerge-info.txt,5.57 KB, text/plain)
2019-04-22 15:40 UTC, onkobu
Details

Note You need to log in before you can comment on or make changes to this bug.
Description onkobu 2019-04-22 15:37:27 UTC
When starting smbd/ nmbd with AppArmor enabled, creation of directories and files is denied. The rules in default profile enable it for /{,var/}run/samba/** whereas current package tries to write in /{,var/}run/lock/samba/**. In addition /{,var/}run/lock/samba/names.tdb rwk is necessary, to write database. Current (default) profile doesn't allow the latter at all (not matched by any of the patterns).

Reproducible: Always

Steps to Reproduce:
1. emerge apparmor + samba
2. enable apparmor (default profile)
3. start samba
Actual Results:  
Samba fails to start, nmbd and smbd are not allowed to write to lock-directories.

Expected Results:  
Samba starts successfully

Copying the last blocks regarding lock-directories and adding /lock as level is sufficient.
Comment 1 onkobu 2019-04-22 15:40:29 UTC
Created attachment 573824 [details]
emerge --info
Comment 2 Stefan Huber 2020-04-06 09:45:47 UTC
In my case also smbXsrv_version_global.tdb was blocked:

AVC apparmor="DENIED" operation="mknod" profile="smbd" name="/run/lock/samba/smbXsrv_version_global.tdb" pid=314283 comm="smbd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0

Replacing the suggested /{,var/}run/lock/samba/names.tdb rwk with 
/{,var/}run/lock/samba/*.tdb rwk was sufficient here to launch smb.service.

I am running net-fs/samba-4.11.6-r2 with use flags "acl ads client cups ldap pam python system-mitkrb5 systemd winbind".