samba selinux adding new PC to domain

[Scott Tsai]

On Wed, 26 Apr 2006 13:34:01 -0400, mroselinux wrote:
> How can I always leave enforcing on?  

You could create a local policy module to grant useradd the additional
permisions.

1. Create a file t.log with the relevant avc messages.
cat <<-EOF > t.log
	audit(1145984005.084:160): avc:  denied  { append } for  pid=24952
	comm="useradd" name="log.mslib2k10w" dev=dm-0 ino=8674237
	scontext=root:system_r:useradd_t:s0 tcontext=root:object_r:samba_log_t:s0
	tclass=file
	audit(1145984005.088:162): avc:  denied  { read write } for  pid=24952
	comm="useradd" name="passwd" dev=dm-0 ino=1964129 scontext=root:system_r:useradd_t:s0 tcontext=system_u:object_r:etc_runtime_t:s0 tclass=file
EOF

2. Build a selinux policy module with audit2allow
audit2allow -M local_samba_useradd -i t.log

3. Load the policy module into the kernel
semodule -i local_samba_useradd.pp

4. If you want to keep this setting across reboot, 
I guess you'll have to put the "semodule -i" line into /etc/rc.d/rc.local ?

I'm a bit suspicious about why the "passwd" file was labeled
"etc_runtime_t" in the first place.

See Also:
http://fedoraproject.org/wiki/SELinux/LoadableModules/Audit2allow