Samba and apparmor problems

[samo_dadela]

Hi,
after latest update samba has still issues with apparmor (or viceversa). According to FS#74614 : [apparmor] new profiles needed for samba-4.16 this should already be fixed apparmor 3.0.6-1…

[  943.022870] audit: type=1400 audit(1665084122.476:172): apparmor="DENIED" operation="rename_src" profile="smbd" name="/var/log/samba/log.127.0.0.1" pid=4309 comm="smbd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

[  943.022877] audit: type=1300 audit(1665084122.476:172): arch=c000003e syscall=82 success=no exit=-13 a0=55fcb7ed6520 a1=7ffd08ffa610 a2=0 a3=0 items=0 ppid=3850 pid=4309 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="smbd" exe="/usr/bin/smbd" subj=smbd (enforce) key=(null)

[  943.022880] audit: type=1327 audit(1665084122.476:172): proctitle=2F7573722F62696E2F736D6264002D2D666F726567726F756E64002D2D6E6F2D70726F636573732D67726F7570

[  943.023791] audit: type=1400 audit(1665084122.476:173): apparmor="DENIED" operation="rename_src" profile="smbd" name="/var/log/samba/log.cheetah" pid=4309 comm="smbd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

[  943.023794] audit: type=1300 audit(1665084122.476:173): arch=c000003e syscall=82 success=no exit=-13 a0=55fcb7ed6520 a1=7ffd08ffa780 a2=0 a3=0 items=0 ppid=3850 pid=4309 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="smbd" exe="/usr/bin/smbd" subj=smbd (enforce) key=(null)

[  943.023797] audit: type=1327 audit(1665084122.476:173): proctitle=2F7573722F62696E2F736D6264002D2D666F726567726F756E64002D2D6E6F2D70726F636573732D67726F7570

[  943.023928] audit: type=1400 audit(1665084122.476:174): apparmor="DENIED" operation="open" profile="smbd" name="/hddpool/tmp/" pid=4309 comm="smbd" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

[  943.023931] audit: type=1300 audit(1665084122.476:174): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7ffd08ff96a0 a2=10000 a3=0 items=0 ppid=3850 pid=4309 auid=4294967295 uid=1000 gid=0 euid=1000 suid=0 fsuid=1000 egid=1001 sgid=0 fsgid=1001 tty=(none) ses=4294967295 comm="smbd" exe="/usr/bin/smbd" subj=smbd (enforce) key=(null)

[  943.023933] audit: type=1327 audit(1665084122.476:174): proctitle=2F7573722F62696E2F736D6264002D2D666F726567726F756E64002D2D6E6F2D70726F636573732D67726F7570

Best regards,
Samo

[samo_dadela]

There’s also a thread here, but no solution… can someone please look into this?

[root tip] [How To] Basic Samba Setup and Troubleshooting

Thanks for your reply & suggestions. I’d however argue that this is related to the recent update and changes made in how samba does rpc calls and its interaction with apparmor. My system was properly configured and working. This is a server providing samba services to multiple clients and no error related to shares/priviliges/permissions was ever reported. My guess is that the update from 4.16.3-1 → 4.16.4-1 (around end of July / early August) is the culprit. As I mentioned I have tried the a…

[jrichard326]

Use aa-complain to restore functionality:
In terminal:

sudo aa-complain /usr/bin/smbd
sudo aa-complain samba-dcerpcd samba-bgqd samba-rpcd samba-rpcd-classic samba-rpcd-spoolss

restart

[samo_dadela]

@jrichard326 That works indeed. I ran that commands and rebooted my machine - the changes are persisted and samba works.

Thanks a lot!