https://bugzilla.novell.com/show_bug.cgi?id=758426 https://bugzilla.novell.com/show_bug.cgi?id=758426#c1 Lars Müller changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED CC| |samba-maintainers@SuSE.de, | |suse-beta@cboltz.de AssignedTo|samba-maintainers@SuSE.de |lmuelle@suse.com --- Comment #1 from Lars Müller 2012-04-21 23:30:04 CEST --- (In reply to comment #0) [ 8< ]

Client started (version 3.6.3-112.1-2788-SUSE-SL11.4-x86_64). Enter robber's password: tdb(/var/lib/samba/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/gencache.tdb: Permission denied

This might be another AppArmor issue. You have two ways two check this: a) Either disable AppArmor via service boot.apparmor stop And then test again. b) Allow AppArmor access to /var/lib/samba/gencache.tdb Add this to /etc/apparmor.d/usr.sbin.smbd /var/lib/samba/** rwk, -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=758426 https://bugzilla.novell.com/show_bug.cgi?id=758426#c2 --- Comment #2 from Lars Müller 2012-04-21 23:58:25 CEST --- Please only test alternative a) of comment #1. rwk as suggested in b) is already granted. If disabling AppArmor made it work please turn the AppArmor smbd profile in complain mode. See http://doc.openSUSE.org/documentation/html/openSUSE/opensuse-security/cha.ap... or call on the command line aa-complain /etc/apparmor.d/usr.sbin.smbd With aa-enforce /etc/apparmor.d/usr.sbin.smbd you can switch back to the previous setting. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=758426 https://bugzilla.novell.com/show_bug.cgi?id=758426#c4 --- Comment #4 from Roberto Bernetti 2012-04-22 06:26:09 UTC --- (In reply to comment #1)

(In reply to comment #0) [ 8< ]

...

Client started (version 3.6.3-112.1-2788-SUSE-SL11.4-x86_64). Enter robber's password: tdb(/var/lib/samba/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/gencache.tdb: Permission denied

This might be another AppArmor issue.

I'm SOrry but at the moment I have only one machine that can run the server samba and I'm forced to downgrade to 3.5.7. I can let you know that the same AppArmor issue is present in the working configuration of 3.5.7. follow the output of smbclient on the 3.5.7 server in 3.5.7 the broadcast got a positive answer about the name of my server "acer2linux" answer it didn't got from the bcast of 3.6.3 --------------------------- smbclient -d3 --list=acer2linux lp_load_ex: refreshing parameters Initialising global parameters rlimit_max: rlimit_max (1024) below minimum Windows limit (16384) params.c:pm_process() - Processing configuration file "/etc/samba/smb.conf" Processing section "[global]" added interface eth0 ip=fe80::21f:16ff:fe97:e1ae%eth0 bcast=fe80::ffff:ffff:ffff:ffff%eth0 netmask=ffff:ffff:ffff:ffff:: added interface wlan0 ip=fe80::222:fbff:fe3c:5114%wlan0 bcast=fe80::ffff:ffff:ffff:ffff%wlan0 netmask=ffff:ffff:ffff:ffff:: added interface eth0 ip=192.168.1.38 bcast=192.168.1.255 netmask=255.255.255.0 added interface wlan0 ip=192.168.1.39 bcast=192.168.1.255 netmask=255.255.255.0 Client started (version 3.5.7-3.5.1-2573-SUSE-SL11.4-x86_64). Enter robber's password: tdb(unnamed): tdb_open_ex: could not open file /var/lib/samba/gencache.tdb: Permission denied name_resolve_bcast: Attempting broadcast lookup for name acer2linux<0x20> Got a positive name query response from 192.168.1.38 ( 192.168.1.39 ) Connecting to 192.168.1.39 at port 445 Doing spnego session setup (blob length=58) got OID=1.3.6.1.4.1.311.2.2.10 got principal=NONE Got challenge flags: Got NTLMSSP neg_flags=0x608a8215 NTLMSSP: Set final flags: Got NTLMSSP neg_flags=0x60088215 NTLMSSP Sign/Seal - Initialising with flags: Got NTLMSSP neg_flags=0x60088215 Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.5.7-3.5.1-2573-SUSE-SL11.4-x86_64] Sharename Type Comment --------- ---- ------- homes Disk Home Directories profiles Disk Network Profiles Service users Disk All users groups Disk All groups print$ Disk Printer Drivers Offshore Disk Home Offshore doc Disk Documents Acer IPC$ IPC IPC Service (Acer2-Samba-Server) Officejet_4500_G510n-z_fax Printer Officejet_4500_G510n-z_fax Officejet_4500_G510n-z Printer Officejet_4500_G510n-z robber Disk Home Directories name_resolve_bcast: Attempting broadcast lookup for name acer2linux<0x20> Got a positive name query response from 192.168.1.39 ( 192.168.1.39 ) Got a positive name query response from 192.168.1.38 ( 192.168.1.39 ) Connecting to 192.168.1.39 at port 139 Doing spnego session setup (blob length=58) got OID=1.3.6.1.4.1.311.2.2.10 got principal=NONE Got challenge flags: Got NTLMSSP neg_flags=0x608a8215 NTLMSSP: Set final flags: Got NTLMSSP neg_flags=0x60088215 NTLMSSP Sign/Seal - Initialising with flags: Got NTLMSSP neg_flags=0x60088215 Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.5.7-3.5.1-2573-SUSE-SL11.4-x86_64] Server Comment --------- ------- ACER2LINUX Acer2-Samba-Server Workgroup Master --------- ------- WORKGROUP ------------------------------------------------------ -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=758426 https://bugzilla.novell.com/show_bug.cgi?id=758426#c6 --- Comment #6 from Roberto Bernetti 2012-04-22 16:23:30 UTC --- (In reply to comment #5)

We need the answers to the question raised with comment #2 and comment #3.

As long as we don't get the requested answers we're not able to process with this issue any further and must close it with the resolution state 'no response'.

Hoping this can help, I did the test on the server 3.5.7 that gives the same error, and it seems that now there is no more complaint about file access... acer2:/home/robber # service boot.apparmor stop Unloading AppArmor profiles done acer2:/home/robber # aa-complain /etc/apparmor.d/usr.sbin.smbd Impostazione di /etc/apparmor.d/usr.sbin.smbd in modalità complain. acer2:/home/robber # smbclient -d3 --list=acer2linux lp_load_ex: refreshing parameters Initialising global parameters rlimit_max: rlimit_max (1024) below minimum Windows limit (16384) params.c:pm_process() - Processing configuration file "/etc/samba/smb.conf" Processing section "[global]" added interface eth0 ip=fe80::21f:16ff:fe97:e1ae%eth0 bcast=fe80::ffff:ffff:ffff:ffff%eth0 netmask=ffff:ffff:ffff:ffff:: added interface eth0 ip=192.168.1.38 bcast=192.168.1.255 netmask=255.255.255.0 Client started (version 3.5.7-3.5.1-2573-SUSE-SL11.4-x86_64). Enter robber's password: name_resolve_bcast: Attempting broadcast lookup for name acer2linux<0x20> Got a positive name query response from 192.168.1.38 ( 192.168.1.38 ) Connecting to 192.168.1.38 at port 445 Doing spnego session setup (blob length=58) got OID=1.3.6.1.4.1.311.2.2.10 got principal=NONE Got challenge flags: Got NTLMSSP neg_flags=0x608a8215 NTLMSSP: Set final flags: Got NTLMSSP neg_flags=0x60088215 NTLMSSP Sign/Seal - Initialising with flags: Got NTLMSSP neg_flags=0x60088215 Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.5.7-3.5.1-2573-SUSE-SL11.4-x86_64] Sharename Type Comment --------- ---- ------- homes Disk Home Directories profiles Disk Network Profiles Service users Disk All users groups Disk All groups print$ Disk Printer Drivers Offshore Disk Home Offshore doc Disk Documents Acer IPC$ IPC IPC Service (Acer2-Samba-Server) Officejet_4500_G510n-z_fax Printer Officejet_4500_G510n-z_fax Officejet_4500_G510n-z Printer Officejet_4500_G510n-z robber Disk Home Directories Connecting to 192.168.1.38 at port 139 Doing spnego session setup (blob length=58) got OID=1.3.6.1.4.1.311.2.2.10 got principal=NONE Got challenge flags: Got NTLMSSP neg_flags=0x608a8215 NTLMSSP: Set final flags: Got NTLMSSP neg_flags=0x60088215 NTLMSSP Sign/Seal - Initialising with flags: Got NTLMSSP neg_flags=0x60088215 Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.5.7-3.5.1-2573-SUSE-SL11.4-x86_64] Server Comment --------- ------- ACER2LINUX Acer2-Samba-Server ACER2WIN VBOXXP Phenom4 Virtual Box Workgroup Master --------- ------- WORKGROUP ACER2LINUX -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=758426 https://bugzilla.novell.com/show_bug.cgi?id=758426#c8 --- Comment #8 from Roberto Bernetti 2012-04-22 17:38:29 UTC --- Created an attachment (id=487336) --> (http://bugzilla.novell.com/attachment.cgi?id=487336) audit.log -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=758426 https://bugzilla.novell.com/show_bug.cgi?id=758426#c Lars Müller changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #487336|text/x-log |text/plain mime type| | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=758426 https://bugzilla.novell.com/show_bug.cgi?id=758426#c11 Christian Boltz changed: What |Removed |Added ---------------------------------------------------------------------------- InfoProvider|suse-beta@cboltz.de |roberto.bernetti@poste.it --- Comment #11 from Christian Boltz 2012-04-23 13:45:18 CEST --- According to the audit.log, we need (at least) the following changes to the smbd profile: + capability fowner, + capability lease, + /proc/sys/kernel/core_pattern r, @Lars: Needless to say that those were included in my proposal from bug 757545 comment 3 ;-) The audit.log also requests + /home/ r, which is probably caused by this config section: [users] comment = All users path = /home @Lars: Is this part of the default smb.conf or something Roberto added? Depending on the answer, we'll have to add the "/home/ r," line to the profile. (BTW: "/home/ r," is not even in the latest upstream profile.) @Roberto: The last lines in audit.log indicate that AppArmor was stopped, so we might need more changes. Please add the following lines to /etc/apparmor.d/usr.sbin.smbd (inside the { ... } block): capability fowner, capability lease, /proc/sys/kernel/core_pattern r, Then run the following commands: echo "using the updated smbd profile" >> /var/log/audit/audit.log rcapparmor reload rcsmb reload Then use Samba for a while and attach your audit.log again. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=758426 https://bugzilla.novell.com/show_bug.cgi?id=758426#c12 Roberto Bernetti changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED InfoProvider|roberto.bernetti@poste.it | --- Comment #12 from Roberto Bernetti 2012-05-07 19:14:09 UTC --- Created an attachment (id=489842) --> (http://bugzilla.novell.com/attachment.cgi?id=489842) performing action incomment #11 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=758426 https://bugzilla.novell.com/show_bug.cgi?id=758426#c14 Lars Müller changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED InfoProvider|lmuelle@suse.com | --- Comment #14 from Lars Müller 2012-05-07 22:29:43 CEST --- Please ignore the [users] share. Either we have to adjust the profile or we remove this share in a future releases. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=758426 https://bugzilla.novell.com/show_bug.cgi?id=758426#c16 --- Comment #16 from Swamp Workflow Management 2012-05-08 16:10:54 UTC --- openSUSE-RU-2012:0597-1: An update that has four recommended fixes can now be installed. Category: recommended (low) Bug References: 725967,738041,757545,758426 CVE References: Sources used: openSUSE 11.4 (src): apparmor-2.5.1.r1445-52.126.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=758426 https://bugzilla.novell.com/show_bug.cgi?id=758426#c18 --- Comment #18 from Roberto Bernetti 2012-05-22 15:21:02 UTC --- I applied the patches proposed by the online update but I still get samba not working. This is the output of smbclient smbclient -d3 --list=acer2linux lp_load_ex: refreshing parameters Initialising global parameters rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384) params.c:pm_process() - Processing configuration file "/etc/samba/smb.conf" Processing section "[global]" WARNING: The "username" option is deprecated added interface eth0 ip=fe80::21f:16ff:fe97:e1ae%eth0 bcast=fe80::ffff:ffff:ffff:ffff%eth0 netmask=ffff:ffff:ffff:ffff:: added interface eth0 ip=192.168.1.38 bcast=192.168.1.255 netmask=255.255.255.0 Client started (version 3.6.3-115.1-2797-SUSE-SL11.4-x86_64). Enter robber's password: tdb(/var/lib/samba/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/gencache.tdb: Permission denied name_resolve_bcast: Attempting broadcast lookup for name acer2linux<0x20> Got a positive name query response from 192.168.1.38 ( 192.168.1.38 ) Connecting to 192.168.1.38 at port 445 Connecting to 192.168.1.38 at port 139 Error connecting to 192.168.1.38 (Connessione rifiutata) Connection to acer2linux failed (Error NT_STATUS_CONNECTION_REFUSED) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=758426 https://bugzilla.novell.com/show_bug.cgi?id=758426#c20 --- Comment #20 from Roberto Bernetti 2012-05-22 16:36:33 UTC --- Now my samba server doesn't work neither with 3.6.3 nor with 3.5.7 samba version ;( -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=758426 https://bugzilla.novell.com/show_bug.cgi?id=758426#c22 Christian Boltz changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution| |FIXED --- Comment #22 from Christian Boltz 2012-05-22 20:09:21 CEST --- (In reply to comment #21)

/etc/apparmor.d/usr.sbin.smbd.rpmnew and /etc/apparmor.d/usr.sbin.smbd

I just wrote a comment asking for a *.rpmnew which resulted in a mid-air collission with your comment ;-) Closing as fixed again - feel free to reopen (or open a new bugreport) if you still see any problems. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=758426 https://bugzilla.novell.com/show_bug.cgi?id=758426#c24 --- Comment #24 from Roberto Bernetti 2012-05-23 07:10:06 UTC --- Hi moving from my home network to my office network samba (version 3.6.3) stop working while 3.5.7 not works fine showimg my laptop share to my office computer. I attached my new smb.conf and audit file This is the output of the smbclient at office smbclient -d3 --list=acer2linux lp_load_ex: refreshing parameters Initialising global parameters rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384) params.c:pm_process() - Processing configuration file "/etc/samba/smb.conf" Processing section "[global]" WARNING: The "username" option is deprecated added interface eth0 ip=fe80::21f:16ff:fe97:e1ae%eth0 bcast=fe80::ffff:ffff:ffff:ffff%eth0 netmask=ffff:ffff:ffff:ffff:: added interface eth0 ip=192.168.1.130 bcast=192.168.1.255 netmask=255.255.255.0 Client started (version 3.6.3-115.1-2797-SUSE-SL11.4-x86_64). Enter robber's password: tdb(/var/lib/samba/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/gencache.tdb: Permission denied name_resolve_bcast: Attempting broadcast lookup for name acer2linux<0x20> Got a positive name query response from 192.168.1.130 ( 192.168.1.130 ) Connecting to 192.168.1.130 at port 445 Connecting to 192.168.1.130 at port 139 Error connecting to 192.168.1.130 (Connessione rifiutata) Connection to acer2linux failed (Error NT_STATUS_CONNECTION_REFUSED) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=758426 https://bugzilla.novell.com/show_bug.cgi?id=758426#c26 --- Comment #26 from Roberto Bernetti 2012-05-23 07:13:28 UTC --- Created an attachment (id=492046) --> (http://bugzilla.novell.com/attachment.cgi?id=492046) adding command to stick to eth0 interface -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=758426 https://bugzilla.novell.com/show_bug.cgi?id=758426#c28 --- Comment #28 from Roberto Bernetti 2012-05-23 19:56:18 UTC --- Back at home I need to restart samba to make it work. In 3.5.7 no need to run rcsmb. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.