Mailinglist Archive: opensuse-factory (1029 mails)

< Previous Next >
Re: [opensuse-factory] samba woes with apparmor
On Fri, 2013-11-01 at 10:14 +0100, lynn wrote:
13.1 rc2 domain client with 13.1 rc2 file server
Hi
We cannot connect to the smbd file server unless apparmor is disabled.
here is a user logging in and requesting his home directory on the
client
1. With apprpmor enabled on the file server:

:00 altet kernel: [ 197.753781] FS-Cache: Netfs 'c
ifs' registered for caching
2013-11-01T09:44:04.729844+01:00 altet kernel: [ 197.753872] Key type
cifs.spne
go registered
2013-11-01T09:44:04.729861+01:00 altet kernel: [ 197.753917] Key type
cifs.idma
p registered
2013-11-01T09:44:10.981390+01:00 altet kernel: [ 204.006781] CIFS VFS:
Error co
nnecting to socket. Aborting operation.
2013-11-01T09:44:10.988813+01:00 altet kerne


2. With apparmor disabled on the fle server:

2013-11-01T10:01:13.830490+01:00 altet cifs.upcall: key description:
cifs.spnego
;3000022;20513;39010000;ver=0x2;host=altea;ip4=192.168.1.100;sec=krb5;uid=0x2dc6
d6;creduid=0x2dc6d6;pid=0x4ae
2013-11-01T10:01:13.833652+01:00 altet cifs.upcall: ver=2
2013-11-01T10:01:13.843315+01:00 altet cifs.upcall: host=altea
2013-11-01T10:01:13.850828+01:00 altet cifs.upcall: ip=192.168.1.100
2013-11-01T10:01:13.852993+01:00 altet cifs.upcall: sec=1
2013-11-01T10:01:13.856451+01:00 altet cifs.upcall: uid=3000022
2013-11-01T10:01:13.859580+01:00 altet cifs.upcall: creduid=3000022
2013-11-01T10:01:13.861792+01:00 altet cifs.upcall: pid=1198
2013-11-01T10:01:13.863942+01:00 altet cifs.upcall: find_krb5_cc:
considering /tmp/krb5cc_3000022_7DxCVc
2013-11-01T10:01:13.871110+01:00 altet cifs.upcall: find_krb5_cc:
FILE:/tmp/krb5cc_3000022_7DxCVc is valid ccache
2013-11-01T10:01:13.875609+01:00 altet cifs.upcall: find_krb5_cc:
considering /tmp/krb5cc_3000021_dOfJgo
2013-11-01T10:01:13.876966+01:00 altet cifs.upcall:
find_krb5_cc: /tmp/krb5cc_30/var/log/messages lines 1413-1427/1489 96%
is owned by 0, not 3000022
2013-11-01T10:01:13.881795+01:00 altet cifs.upcall: handle_krb5_mech:
getting service ticket for altea
2013-11-01T10:01:13.883698+01:00 altet cifs.upcall: handle_krb5_mech:
obtained service ticket
2013-11-01T10:01:13.885387+01:00 altet cifs.upcall: Exit status 0
2013-11-01T10:01:14.172911+01:00 altet systemd[1198]: Stopped target
Sound Card.
2013-11-01T10:01:14.181817+01:00 altet systemd[1198]: Starting Default.
2013-11-01T10:01:14.196334+01:00 altet systemd[1198]: Reached target
Default.
2013-11-01T10:01:14.204224+01:00 altet systemd[1198]: Startup finished
in 491ms.
2013-11-01T10:01:14.216885+01:00 altet systemd[1]: Started User Manager
for 3000022.

With apparmor, cifs cannot get through. No firewall is running on the
file server.
Any ideas anyone? Do we need apparmor on an internal network anyway?
Thanks,
L x



Sorry. Here are the apparmor messages:

2013-11-01T09:45:38.403856+01:00 altea kernel: [ 22.064252] type=1400
audit(1383295533.160:11): apparmor="STATUS" operation="profile_load"
name="/usr/lib/dovecot/deliver" pid=402 comm="apparmor_parser"
2013-11-01T09:45:46.565992+01:00 altea kernel: [ 35.461728] type=1400
audit(1383295546.556:31): apparmor="DENIED" operation="open" parent=1
profile="/usr/sbin/smbd" name="/var/lib/sss/mc/passwd" pid=673
comm="smbd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
2013-11-01T09:45:46.771902+01:00 altea kernel: [ 35.671857] type=1400
audit(1383295546.764:32): apparmor="DENIED" operation="open" parent=1
profile="/usr/sbin/smbd" name="/var/lib/sss/mc/passwd" pid=673
comm="smbd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
2013-11-01T09:45:46.851116+01:00 altea kernel: [ 35.746084] type=1400
audit(1383295546.840:33): apparmor="DENIED" operation="open" parent=1
profile="/usr/sbin/smbd" name="/var/lib/sss/mc/passwd" pid=673
comm="smbd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
2013-11-01T09:45:47.551447+01:00 altea kernel: [ 36.449978] type=1400
audit(1383295547.544:34): apparmor="DENIED" operation="open" parent=1
profile="/usr/sbin/smbd" name="/var/lib/sss/pubconf/kdcinfo.HH3.SITE"
pid=673 comm="smbd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
2013-11-01T09:45:47.576550+01:00 altea kernel: [ 36.473864] type=1400
audit(1383295547.568:35): apparmor="DENIED" operation="open" parent=1
profile="/usr/sbin/smbd" name="/var/lib/sss/pubconf/kdcinfo.HH3.SITE"
pid=673 comm="smbd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
2013-11-01T09:45:47.588061+01:00 altea kernel: [ 36.487841] type=1400
audit(1383295547.580:36): apparmor="DENIED" operation="open" parent=1
profile="/usr/sbin/smbd" name="/var/lib/sss/pubconf/kdcinfo.HH3.SITE"
pid=673 comm="smbd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
2013-11-01T09:45:47.607179+01:00 altea kernel: [ 36.505737] type=1400
audit(1383295547.600:37): apparmor="DENIED" operation="open" parent=1
profile="/usr/sbin/smbd" name="/var/lib/sss/pubconf/kdcinfo.HH3.SITE"
pid=673 comm="smbd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
2013-11-01T09:45:47.628763+01:00 altea kernel: [ 36.526730] type=1400
audit(1383295547.620:38): apparmor="DENIED" operation="open" parent=1
profile="/usr/sbin/smbd" name="/var/lib/sss/pubconf/kdcinfo.HH3.SITE"
pid=673 comm="smbd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
2013-11-01T09:45:47.655155+01:00 altea kernel: [ 36.552607] type=1400
audit(1383295547.648:39): apparmor="DENIED" operation="open" parent=1
profile="/usr/sbin/smbd" name="/var/lib/sss/pubconf/kdcinfo.HH3.SITE"
pid=673 comm="smbd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
2013-11-01T09:45:47.663271+01:00 altea kernel: [ 36.563998] type=1400
audit(1383295547.656:40): apparmor="DENIED" operation="open" parent=1
profile="/usr/sbin/smbd" name="/var/lib/sss/pubconf/kdcinfo.HH3.SITE"
pid=673 comm="smbd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
2013-11-01T09:46:04.195179+01:00 altea kernel: [ 53.093252] type=1400
audit(1383295564.188:42): apparmor="DENIED" operation="file_lock"
parent=673 profile="/usr/sbin/smbd" name="/etc/krb5.keytab" pid=908
comm="smbd" requested_mask="k" denied_mask="k" fsuid=0 ouid=0
2013-11-01T09:47:09.651449+01:00 altea kernel: [ 118.550091] type=1400
audit(1383295629.644:43): apparmor="DENIED" operation="file_lock"
parent=673 profile="/usr/sbin/smbd" name="/etc/krb5.keytab" pid=912
comm="smbd" requested_mask="k" denied_mask="k" fsuid=0 ouid=0
2013-11-01T09:52:52.798811+01:00 altea kernel: [ 459.429987] type=1400
audit(1383295972.791:44): apparmor="DENIED" operation="file_lock"
parent=673 profile="/usr/sbin/smbd" name="/etc/krb5.keytab" pid=921
comm="smbd" requested_mask="k" denied_mask="k" fsuid=0 ouid=0

Have we considered kerberos, sssd in combo with smbd with the profiles?
Thanks,
L x


--
To unsubscribe, e-mail: opensuse-factory+unsubscribe@xxxxxxxxxxxx
To contact the owner, e-mail: opensuse-factory+owner@xxxxxxxxxxxx

< Previous Next >
Follow Ups
References