[Bug 921098] New: winbindd 4.2.0 panics on start-up when Apparmor is enabled
http://bugzilla.opensuse.org/show_bug.cgi?id=921098 Bug ID: 921098 Summary: winbindd 4.2.0 panics on start-up when Apparmor is enabled Classification: openSUSE Product: openSUSE Factory Version: 201502* Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: AppArmor Assignee: suse-beta@cboltz.de Reporter: ddiss@suse.com QA Contact: qa-bugs@suse.de CC: samba-maintainers@SuSE.de Found By: --- Blocker: --- Hi Christian, With Samba 4.2.0, currently queued for openSUSE:Factory via OBS req 289602, a new DGM messaging subsystem is introduced. This subsystem uses /var/lib/samba/$PID paths for locking and synchronosation. The use of these paths is currently blocked for winbindd by AppArmor, resulting in a panic on startup: [2015/03/06 15:06:47, 1, pid=2244, effective(0, 0), real(0, 0)] ../source3/lib/messages_dgm.c:113(messaging_dgm_lockfile_create) messaging_dgm_lockfile_create: open failed: Permission denied [2015/03/06 15:06:47, 1, pid=2244, effective(0, 0), real(0, 0)] ../source3/lib/messages_dgm.c:233(messaging_dgm_init) messaging_dgm_init: messaging_dgm_create_lockfile failed: Permission denied [2015/03/06 15:06:47, 2, pid=2244, effective(0, 0), real(0, 0)] ../source3/lib/messages.c:295(messaging_init) messaging_dgm_init failed: Permission denied [2015/03/06 15:06:47, 0, pid=2244, effective(0, 0), real(0, 0)] ../source3/lib/util.c:788(smb_panic_s3) PANIC (pid 2244): Could not init winbindd's messaging context. The Apparmor profile should permit winbindd full access to these paths, like smbd. Please consider the following patch: --- /etc/apparmor.d/usr.sbin.winbindd.old 2015-03-06 16:24:28.369731700 +0100 +++ /etc/apparmor.d/usr.sbin.winbindd 2015-03-06 16:25:02.925731700 +0100 @@ -25,12 +25,8 @@ /var/cache/samba/*.tdb rwk, /var/cache/samba/netsamlogon_cache.tdb rw, - /var/lib/samba/smb_krb5/krb5.conf.* rw, - /var/lib/samba/smb_tmp_krb5.* rw, - /var/lib/samba/**.tdb rwk, + /var/lib/samba/** rwk, - /var/lib/samba/winbindd_cache.tdb* rwk, - /var/lib/samba/winbindd_privileged/pipe w, /var/log/samba/cores/ rw, /var/log/samba/cores/winbindd/ rw, /var/log/samba/cores/winbindd/** rw, -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
--- Comment #1 from David Disseldorp
The Apparmor profile should permit winbindd full access to these paths, like smbd.
Hmm, looks like abstractions/samba would be the best place to fix this, as it's included by usr.sbin.smbd and usr.sbin.winbindd . Additionally, Winbind requires /etc/samba/netlogon_creds_cli.tdb rwk access. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
--- Comment #2 from David Disseldorp
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
Christian Boltz
(In reply to David Disseldorp from comment #0)
The Apparmor profile should permit winbindd full access to these paths, like smbd.
Hmm, looks like abstractions/samba would be the best place to fix this, as it's included by usr.sbin.smbd and usr.sbin.winbindd .
FYI: abstractions/samba is also included by usr.sbin.nmbd, and the changes you propose are quite permissive (whole directory instead of some individual files). Do you see any security risks in giving nmbd those additional permissions? BTW: You should probably switch your samba profiles into complain mode with aa-complain, run samba for a while and then update the profiles with aa-logprof. That's easier than fixing one permission at a time and running into the next a minute later. Don't forget to switch the profiles back to enforce mode with aa-enforce afterwards ;-) -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
--- Comment #4 from David Disseldorp
(In reply to David Disseldorp from comment #1)
(In reply to David Disseldorp from comment #0)
The Apparmor profile should permit winbindd full access to these paths, like smbd.
Hmm, looks like abstractions/samba would be the best place to fix this, as it's included by usr.sbin.smbd and usr.sbin.winbindd .
FYI: abstractions/samba is also included by usr.sbin.nmbd, and the changes you propose are quite permissive (whole directory instead of some individual files). Do you see any security risks in giving nmbd those additional permissions?
I'm not aware of any additional risks associated with allowing full /var/lib/samba access. In general, Samba processes expect to be able to use this directory for arbitrary state storage and IPC under the constraint of the filesystem ACLs.
BTW: You should probably switch your samba profiles into complain mode with aa-complain, run samba for a while and then update the profiles with aa-logprof. That's easier than fixing one permission at a time and running into the next a minute later. Don't forget to switch the profiles back to enforce mode with aa-enforce afterwards ;-)
Will do, thanks for the tip. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
David Disseldorp
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
--- Comment #6 from Christian Boltz
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
Noel Power
Besides creating the /etc/samba/smbd.tmp/ directory, does winbindd need to read or write any files in it?
winbindd does create a msg subdirectory (e.g. /etc/samba/smbd.tmp/msg), in that 'msg' directory it additionally creates a msg.<some id> file and also seems to create a names.tdb file -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
--- Comment #8 from Christian Boltz
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
--- Comment #9 from Noel Power
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
--- Comment #10 from Noel Power
To make sure I get it right - in which directory is names.tdb created? msg.xyz & names.tdb are created in /etc/samba/smbd.tmp/msg
Which permissions are needed for /etc/samba/smbd.tmp/msg/msg.* - rw or rwk?
The easiest way is to attach the audit.log, because that ensures I get the permissions correct ;-) attached,
-- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
Noel Power
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
Christian Boltz
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
David Disseldorp
I'll (finally - sorry for the delay!) submit the package with updated profiles in some minutes.
If something is still missing, please reopen or open another bugreport.
Thanks Christian, much appreciated! -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
http://bugzilla.opensuse.org/show_bug.cgi?id=921098#c15
--- Comment #15 from Noel Power
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
http://bugzilla.opensuse.org/show_bug.cgi?id=921098#c16
Noel Power
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
http://bugzilla.opensuse.org/show_bug.cgi?id=921098#c17
Christian Boltz
unfortunately tumbleweed and latest SLE12-sp1(alpha2) share similar problems, seems we missed some things in the profiles still
see proposed fix in attachment mentioned in comment #15
+++ old/usr.sbin.nmbd 2015-07-29 20:07:14.230667945 +0100
+ /var/lib/samba/** rwk,
That is already covered via abstractions/samba (in Tumbleweed, not sure about SLE), so I don't see the need to add it to the nmbd profile. (Do you have some *.rpmnew in /etc/apparmor.d/ on your system?)
+++ old/usr.sbin.winbindd 2015-07-29 20:06:25.099322583 +0100
+ /etc/samba/smbd.tmp/** rwk, /etc/samba/smbd.tmp/msg/ rw, /etc/samba/smbd.tmp/msg/* rw,
That might be too much ;-) A quick test ("rcwinbindd start") shows missing k permissions for /etc/samba/smbd.tmp/msg/names.tdb. Therefore I propose: (winbindd profile) - /etc/samba/smbd.tmp/msg/* rw, + /etc/samba/smbd.tmp/msg/* rwk, Can you please check if this is enough? (If not, what are the actual filenames that need rwk permissions?) -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
http://bugzilla.opensuse.org/show_bug.cgi?id=921098#c18
--- Comment #18 from Noel Power
(In reply to Noel Power from comment #16)
unfortunately tumbleweed and latest SLE12-sp1(alpha2) share similar problems, seems we missed some things in the profiles still
see proposed fix in attachment mentioned in comment #15
+++ old/usr.sbin.nmbd 2015-07-29 20:07:14.230667945 +0100
+ /var/lib/samba/** rwk,
That is already covered via abstractions/samba (in Tumbleweed, not sure about SLE), so I don't see the need to add it to the nmbd profile. (Do you have some *.rpmnew in /etc/apparmor.d/ on your system? you're correct, I think I was confused by a combination of testing before/after a dup (my tumbleweed was quite old) and a fresh install of tumblewee and additionally testing SLE12 (and getting a little mixed up)
and /var/lib/samba/** rwk, this isn't in samba/abstractions in SLE (I know so little about apparmor I wasn't even aware of it ;-)) so great I can remove this entry from sbin.nmbd on SLE and use abstraction
+++ old/usr.sbin.winbindd 2015-07-29 20:06:25.099322583 +0100
+ /etc/samba/smbd.tmp/** rwk, /etc/samba/smbd.tmp/msg/ rw, /etc/samba/smbd.tmp/msg/* rw,
That might be too much ;-)
fair enough
A quick test ("rcwinbindd start") shows missing k permissions for /etc/samba/smbd.tmp/msg/names.tdb. Therefore I propose:
(winbindd profile) - /etc/samba/smbd.tmp/msg/* rw, + /etc/samba/smbd.tmp/msg/* rwk,
Can you please check if this is enough? (If not, what are the actual filenames that need rwk permissions?)
I will check (will try to get back to you as soon as but.. currently I need to check SLE first) -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
http://bugzilla.opensuse.org/show_bug.cgi?id=921098#c19
--- Comment #19 from Noel Power
(In reply to Christian Boltz from comment #17)
(In reply to Noel Power from comment #16) [...] Can you please check if this is enough? (If not, what are the actual filenames that need rwk permissions?)
It seems this is enough, thanks alot!! (at least with some quick testing here) I will try do some more testing later anyway fyi ls -lR /etc/samba/smbd.tmp/ /etc/samba/smbd.tmp/: total 0 drwx------ 1 root root 82 Jul 30 09:25 msg /etc/samba/smbd.tmp/msg: total 12 srwxrwxrwx 1 root root 0 Jul 29 20:21 msg.4469 srwxrwxrwx 1 root root 0 Jul 29 20:25 msg.5795 srwxrwxrwx 1 root root 0 Jul 29 20:28 msg.6123 srwxrwxrwx 1 root root 0 Jul 30 09:25 msg.7455 -rw-rw---- 1 root root 12288 Jul 30 09:25 names.tdb -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
http://bugzilla.opensuse.org/show_bug.cgi?id=921098#c22
Christian Boltz
http://bugzilla.opensuse.org/show_bug.cgi?id=921098
http://bugzilla.opensuse.org/show_bug.cgi?id=921098#c23
Christian Boltz
participants (1)
-
bugzilla_noreply＠novell.com