dustin/configpolicy
1
1
Fork 0
Code Issues Releases Activity

r/samba-dc: Remove winbindd restorecon workaround

Browse Source 
This work-around is no longer necessary as the default Fedora policy now
covers the Samba DC daemon.  It never really worked correctly, anyway,
because Samba doesn't start `winbindd` fast enough for the
`/run/samba/winbindd` directory to be created before systemd spawns the
`restorecon` process, so it would usually fail to start the service the
first time after a reboot.
This commit is contained in:
Dustin
2022-08-22 20:32:07 -05:00
parent 2ca92f68f7
commit 8965ede50a
2 changed files with 0 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
roles/samba-dc/files/relabel-winbindd.conf
View File

@@ -1,12 +0,0 @@
# Fedora does not yet have a SELinux policy for the Samba AD DC process,
# so it runs as unconfined_service_t. This causes all of its child
# processes to run there as well, which prevents they create from being
# labelled correctly. This is particularly problematic for winbindd, as
# several outside processes need to communicate with it for identity
# mapping, etc., so its socket absolutely must have the right label.
#
# To work around this problem, restorecon is run after samba starts up
# to set the correct label on the winbindd socket directory.
[Service]
ExecStartPost=/usr/sbin/restorecon -RFv /run/samba/winbindd