Hi,
I’m trying to determine whether this is a missing SELinux policy rule for cifs.upcall when using Samba/winbind with Kerberos-authenticated multiuser CIFS mounts.
I originally encountered this while testing a RHEL 10.2 client and have now reproduced the same behavior on Fedora 44.
Fedora test system
Fedora release 44 (Forty Four)
Kernel: 7.1.8-200.fc44.x86_64
samba-winbind-4.24.5-1.fc44.x86_64
samba-winbind-clients-4.24.5-1.fc44.x86_64
samba-common-tools-4.24.5-1.fc44.x86_64
cifs-utils-7.6-2.fc44.x86_64
keyutils-1.6.3-7.fc44.x86_64
sssd-kcm-2.13.1-2.fc44.x86_64
selinux-policy-44.6-1.fc44.noarch
selinux-policy-targeted-44.6-1.fc44.noarch
The system is an AD domain member using Samba/winbind. Kerberos credential caches are KCM.
The CIFS share is mounted through autofs:
/etc/auto.master:
/cifs /etc/auto.cifs
/etc/auto.cifs:
Proj -fstype=cifs,sec=krb5i,multiuser,cruid=$UID,vers=3.1.1 ://server.mydomain.com/Proj
The resulting mount is:
//server.mydomain.com/Proj on /cifs/Proj type cifs
(rw,relatime,vers=3.1.1,sec=krb5i,cruid=201234,cache=strict,
upcall_target=app,multiuser,...)
Reproduction
With SELinux enforcing and the stock Fedora policy:
- Log in as an AD user.
- Verify the user has a valid Kerberos TGT.
- Access
/cifs/Proj, causing autofs to mount the share. - The Kerberos CIFS access fails.
With SELinux permissive, the same mount/access succeeds.
cifs.upcall runs in the cifs_helper_t domain. The relevant AVC includes:
avc: denied { getattr } for comm="cifs.upcall"
name="pipe"
scontext=system_u:system_r:cifs_helper_t:s0
tcontext=system_u:object_r:winbind_var_run_t:s0
tclass=sock_file
permissive=0
The object is the winbind pipe under:
/run/samba/winbindd/pipe
There was also an AVC for:
cifs_helper_t -> systemd_userdbd_runtime_t:dir { read }
but testing showed that permission is not required for the CIFS mount to work.
dontaudit hides part of the failure
While troubleshooting I disabled dontaudit rules with:
sudo semodule -DB
This exposed an additional required interaction between cifs_helper_t and winbind_t.
After testing, I restored the normal policy with:
sudo semodule -B
I confirmed that the normal Fedora policy contains:
dontaudit domain domain:kcm_socket { read write };
so part of this failure is normally suppressed from the audit log.
Minimal local policy
After reducing the policy to only the permissions actually required for the mount to work, this is sufficient:
module local-cifs-winbind 1.0;
require {
type cifs_helper_t;
type winbind_t;
type winbind_var_run_t;
class sock_file { getattr write };
class unix_stream_socket connectto;
}
allow cifs_helper_t winbind_var_run_t:sock_file { getattr write };
allow cifs_helper_t winbind_t:unix_stream_socket connectto;
With this module installed:
- SELinux remains Enforcing
- normal
dontauditbehavior is restored withsemodule -B - the Kerberos
multiuserCIFS automount succeeds - the AD user can access the share normally
- there are no remaining AVCs from the successful access:
$ sudo ausearch -m AVC,USER_AVC -ts recent -i
<no matches>
I specifically did not add an allow rule for the systemd_userdbd_runtime_t:dir read denial, since the mount works without it.
Question
Does this look like a missing rule in the Fedora SELinux policy for the cifs.upcall → winbind credential lookup path?
Specifically, should Fedora’s policy permit:
allow cifs_helper_t winbind_var_run_t:sock_file { getattr write };
allow cifs_helper_t winbind_t:unix_stream_socket connectto;
for this configuration?
The same basic failure was reproduced during earlier RHEL 10.2 testing, where adding these permissions also allowed the Kerberos CIFS mount to work with SELinux enforcing.
I’m happy to provide complete AVC records, sesearch output, Samba/winbind configuration, or additional testing if useful. If this is a missing selinux-policy rule, I’m also happy to file a bug against selinux-policy if that’s the appropriate next step.
Thanks!