https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c1 --- Comment #1 from Joachim Reichelt 2011-01-23 20:57:54 UTC --- *** Bug 666451 has been marked as a duplicate of this bug. *** http://bugzilla.novell.com/show_bug.cgi?id=666451 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c3 Joachim Reichelt changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW InfoProvider|Joachim.Reichelt@helmholtz- | |hzi.de | --- Comment #3 from Joachim Reichelt 2011-01-25 18:17:10 UTC --- It seems to be appamor. # rcappamor stop # rcsmb start # ps -ef | grep mbd root 3487 1 0 19:11 ? 00:00:00 /usr/sbin/nmbd -D -s /etc/samba/smb.conf root 4401 1 0 19:11 ? 00:00:00 /usr/sbin/smbd -D -s /etc/samba/smb.conf root 4403 4401 0 19:11 ? 00:00:00 /usr/sbin/smbd -D -s /etc/samba/smb.conf root 5614 5517 0 19:15 pts/0 00:00:00 grep mbd ====== I did not change anything in appamor after upgrade to 11.4m* So this is the default (or some leftover) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c5 Lars Müller changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |samba-maintainers@SuSE.de AssignedTo|samba-maintainers@SuSE.de |jeffm@novell.com --- Comment #5 from Lars Müller 2011-01-26 11:05:46 CET --- IIRC this is a known apparmor issue. But Jeff will know this for sure. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c7 Joachim Reichelt changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW InfoProvider|Joachim.Reichelt@helmholtz- | |hzi.de | --- Comment #7 from Joachim Reichelt 2011-01-26 22:38:20 UTC --- Created an attachment (id=410615) --> (http://bugzilla.novell.com/attachment.cgi?id=410615) bzip2 audit.log ... Full log. This problem is related to: # uname -a Linux Joachim-PC 2.6.37-20-desktop #1 SMP PREEMPT 2011-01-22 00:41:44 +0100 x86_64 x86_64 x86_64 GNU/Linux Look at the lines starting about line 1500. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c9 Joachim Reichelt changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW InfoProvider|Joachim.Reichelt@helmholtz- | |hzi.de | --- Comment #9 from Joachim Reichelt 2011-01-27 21:02:13 UTC --- There was a minor problem with nmbd: The right to access mode w to /var/log/samba/cores/ was missing. But: As smbd did not start at all, I added to /etc/apparmor.d/usr.sbin/smbd one line: /etc/samba/secrets.tdb rwk, Now smbd is up, but: /var/log/samba/log.smbd: # tail -20 /var/log/samba/log.smbd tdb(unnamed): tdb_open_ex: failed to get global lock on /etc/samba/secrets.tdb: Keine Berechtigung [2011/01/27 21:30:10.645532, 0] passdb/secrets.c:73(secrets_init) Failed to open /etc/samba/secrets.tdb [2011/01/27 21:30:10.645638, 0] smbd/server.c:1235(main) ERROR: smbd can not open secrets.tdb [2011/01/27 21:31:51, 0] lib/fault.c:250(dump_core_setup) Unable to setup corepath for smbd: Permission denied [2011/01/27 21:31:51, 0] smbd/server.c:1135(main) smbd version 3.5.6-2486-SUSE-SL11.4-x86_64 started. Copyright Andrew Tridgell and the Samba Team 1992-2010 [2011/01/27 21:31:51.714608, 0] passdb/pdb_tdb.c:420(tdbsam_open) tdbsam_open: Failed to open/create TDB passwd [/etc/samba/passdb.tdb] [2011/01/27 21:31:51.714710, 0] passdb/pdb_tdb.c:549(tdbsam_getsampwnam) tdbsam_getsampwnam: failed to open /etc/samba/passdb.tdb! [2011/01/27 21:31:51.721156, 0] smbd/server.c:500(smbd_open_one_socket) smbd_open_once_socket: open_socket_in: Die Adresse wird bereits verwendet [2011/01/27 21:31:51.721317, 0] smbd/server.c:500(smbd_open_one_socket) smbd_open_once_socket: open_socket_in: Die Adresse wird bereits verwendet [2011/01/27 21:34:51.908167, 0] smbd/server.c:281(remove_child_pid) Could not find child 7084 -- ignoring == /etc/apparmor.d/usr/sbin/nmbd read now: # Last Modified: Thu Jan 27 21:27:07 2011 #include /usr/sbin/nmbd { #include #include #include capability net_bind_service, /usr/sbin/nmbd mr, /var/cache/samba/browse.dat* rw, /var/lib/samba/wins.dat* rw, /var/log/samba/cores/ w, /var/log/samba/cores/nmbd/ rw, /var/log/samba/cores/nmbd/** rw, /var/run/samba/** rk, /var/run/samba/nmbd.pid rw, } This is apparmor as in openSUSE 11.4-factory just now. Now trying from security:... zypper se -si apparmor Daten des Repositorys laden ... Installierte Pakete lesen ... S | Name | Typ | Version | Arch | Repository --+--------------------------------+-------+------------------+--------+------------------ i | apparmor-docs | Paket | 2.5.1-45.1 | x86_64 | (Systempakete) i | apparmor-parser | Paket | 2.5.1.r1445-64.1 | x86_64 | Security-Apparmor i | apparmor-profiles | Paket | 2.5.1.r1445-64.1 | x86_64 | Security-Apparmor i | apparmor-utils | Paket | 2.5.1.r1445-64.1 | noarch | Security-Apparmor i | libapparmor1 | Paket | 2.5.1.r1445-64.1 | x86_64 | Security-Apparmor i | libapparmor1-32bit | Paket | 2.5.1-45.1 | x86_64 | (Systempakete) i | pam_apparmor-32bit | Paket | 2.5.1-45.1 | x86_64 | (Systempakete) i | patterns-openSUSE-apparmor_opt | Paket | 11.3-42.1 | x86_64 | Factory-OSS i | perl-apparmor | Paket | 2.5.1.r1445-64.1 | x86_64 | Security-Apparmor i | yast2-apparmor | Paket | 2.20.0-1.2 | noarch | Factory-OSS but the problem is the same. nmbd is fixed the same way as before, smbd cannot read/write /etc/samba/passdb.tdb -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c11 Chuck Taylor changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chucktr@trcompu.com --- Comment #11 from Chuck Taylor 2011-02-06 00:22:03 UTC --- Well, let me throw in a monkey wrench. I do NOT have apparmor running at all and I still can not get smb or nmb to run. The complaint is ... cannot read the files in /etc/samba. What has changed on the permissions since 11.3 and are we now making it a requirement to run apparmor??? By the way, what is this secrets.tbd file. There is not one on my system. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c13 --- Comment #13 from Joachim Reichelt 2011-02-20 20:29:50 UTC --- Created an attachment (id=415186) --> (http://bugzilla.novell.com/attachment.cgi?id=415186) /etc/apparmor.d/usr.sbin.*mbd as tar Working files for samba: /etc/apparmor.d/usr.sbin.smbd /etc/apparmor.d/usr.sbin.nmbd -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c15 --- Comment #15 from Joachim Reichelt 2011-03-08 21:37:18 UTC --- Created an attachment (id=418197) --> (http://bugzilla.novell.com/attachment.cgi?id=418197) /etc/apparmor.d/usr.sbin.nmbd There is one line to change! /var/lib/samba/browse.dat. rw, I had only "w" as the file was empty that time. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c17 Jeff Mahoney changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO InfoProvider| |Joachim.Reichelt@helmholtz- | |hzi.de --- Comment #17 from Jeff Mahoney 2011-03-14 19:00:48 UTC --- I've added the files and dirs to the profiles. Test packages should appear at http://download.opensuse.org/repositories/home:/jeff_mahoney:/branches:/open... shortly. Please test and report back. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c19 James McDonough changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |squealernet@googlemail.com --- Comment #19 from James McDonough 2011-03-15 15:34:26 UTC --- *** Bug 679501 has been marked as a duplicate of this bug. *** http://bugzilla.novell.com/show_bug.cgi?id=679501 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c21 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |maintenance@opensuse.org, | |meissner@novell.com --- Comment #21 from Marcus Meissner 2011-03-16 12:25:11 UTC --- needinfo maintenance@opensuse.org for an update when done -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c23 --- Comment #23 from Marcus Meissner 2011-03-17 20:35:49 UTC --- you can run "logprof" to check for apparmor denied events and allow them or the YAST AppArmor -> Update ? Prfoiles? wizard -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c25 Jeff Mahoney changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO InfoProvider| |chrysantine@hotmail.com --- Comment #25 from Jeff Mahoney 2011-03-21 15:24:34 UTC --- (In reply to comment #22)

I upgraded an old server and tested with Jeff's packages (latest) and ran into at least one file that is not covered by the AppArmor profile there and will cause issues issues;

[2011/03/17 20:48:32.485909, 1] lib/server_mutex.c:64(grab_named_mutex) Could not open mutex.tdb: Permission denied

/var/lib/samba/mutex.tdb

Can you attach your /var/log/audit/audit.log? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c27 P Linnell changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW CC| |mrdocs@opensuse.org InfoProvider|chrysantine@hotmail.com | --- Comment #27 from P Linnell 2011-04-01 19:45:41 UTC --- I installed the rpms from Jeff's repos and then switched apparmor to enforce mode, then restarted all the samba daemons and all is well. However, when I tried to start the event logger I get this error: rcaaeventd start Starting AppArmor Event daemon done 1server:/home # Can't locate File/Tail.pm in @INC (@INC contains: /usr/lib/perl5/site_perl/5.12.3/i586-linux-thread-multi /usr/lib/perl5/site_perl/5.12.3 /usr/lib/perl5/vendor_perl/5.12.3/i586-linux-thread-multi /usr/lib/perl5/vendor_perl/5.12.3 /usr/lib/perl5/5.12.3/i586-linux-thread-multi /usr/lib/perl5/5.12.3 .) at /usr/sbin/aa-eventd line 33. BEGIN failed--compilation aborted at /usr/sbin/aa-eventd line 33. zypper in perl-File-Tail added the missing module and now aaeventd starts, samba is working and apparmor seems to be working fine in enforce mode. So, there is a missing Build:Requires or Requires somewhere. After reporting this, I will look in OBS and if possible send an SR for the fix. That said, I think this should be a priority maintenance fix. Samba not working out of the box on a default install is not good. Let me know if you need more info or testing. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c29 --- Comment #29 from Heidi Lahtinen 2011-04-15 09:25:44 UTC --- (In reply to comment #28)

Test packages again at:

Works like coffee in the morning - push 'em out? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c31 Christian Boltz changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW CC| |suse-beta@cboltz.de InfoProvider|Joachim.Reichelt@helmholtz- | |hzi.de | --- Comment #31 from Christian Boltz 2011-04-17 13:52:27 CEST --- (Resetting needinfo to Joachim - IMHO there was enough feedback from other people. Joachim, you may still add your comment of course ;-) (In reply to comment #30)

...parent=2686 profile="/usr/sbin/smbd" name="/mnt/d04/pub/" pid=10299 ...

You are opening a can of worms ;-) because samba shares can basically be every directory on your system depending on the samba config. The profile has @{HOMEDIRS}/** lrwk, which means read and write permissions for home directories (/home/*). There are two options to solve this in a clean way: a) edit /etc/apparmor.d/tunables/home or (better) /etc/apparmor.d/tunables/home.d/site.local and add your /mnt/d04/pub directory to @{HOMEDIRS} b) have a separate tunable for samba shares, maybe /etc/apparmor.d/tunables/samba. It could contain: @{SMBSHARE}=@{HOMEDIRS} /mnt/d04/pub (default value should be @{HOMEDIRS}) Jeff, what do you think about having a separate @{SMBSHARE} tunable? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c33 Jeff Mahoney changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #33 from Jeff Mahoney 2011-04-17 15:39:59 UTC --- Ah. I didn't update the status on this one. The package has already been pushed to the update process. @cboltz: Yeah, that's definitely the right idea, and what AppArmor 2.6 already does. I wouldn't be opposed to adding tunable profiles like that, so long as they match what's upstream already. Dmitri, can you open a separate report for that? This one should be closed as the original issue has been fixed. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c35 --- Comment #35 from Bernhard Wiedemann 2011-04-28 13:51:46 CEST --- This is an autogenerated message for OBS integration: This bug (666450) was mentioned in https://build.opensuse.org/request/show/66464 https://build.opensuse.org/request/show/66522 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c37 --- Comment #37 from Bernhard Wiedemann 2011-06-23 21:00:22 CEST --- This is an autogenerated message for OBS integration: This bug (666450) was mentioned in https://build.opensuse.org/request/show/74415 11.4 / apparmor -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c39 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard| |maint:running:41833:low --- Comment #39 from Swamp Workflow Management 2011-06-25 19:57:59 UTC --- The SWAMPID for this issue is 41833. This issue was rated as low. Please submit fixed packages until 2011-07-25. Also create a patchinfo file using this link: https://swamp.suse.de/webswamp/wf/41833 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=666450 https://bugzilla.novell.com/show_bug.cgi?id=666450#c Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|maint:running:41833:low |maint:released:11.4:41905 |maint:released:11.4:41905 | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.