Apparmor blocking nmbd (samba service) after recent update

As the title says. Running oS 11.4 KDE 4.8.2, tried with samba 3.5 and 3.6 (this last from samba:STABLE repo)

Got various error messages, depending on what I was using to start nmbd (Yast’s services module, etc/init.d/nmb, etc.). Errors mentioned (from memory): socket permission denied, nmbd returned code 7 (program not running), nmb running but not used, etc.

This is /var/log/samba/log.nmbd showing when it went wrong, after an update:

[2012/04/30 21:17:15,  0] nmbd/nmbd.c:857(main)
  nmbd version 3.5.7-3.5.1-257[2012/04/30 22:14:54.551204,  0] nmbd/nmbd.c:71(terminate)
  Got SIGTERM: going down...3-SUSE-SL11.4-x86_64 started.
  Copyright Andrew Tridgell and the Samba Team 1992-2010
[2012/04/30 21:17:46.709984,  0] nmbd/nmbd_become_lmb.c:395(become_local_master_stage2)
  *****
  
  Samba name server BRUNO-03 is now a local master browser for workgroup  on subnet 192.168.0.3
  
  *****
[2012/04/30 21:22:54.005734,  0] nmbd/nmbd_become_lmb.c:395(become_local_master_stage2)
  *****
  
  Samba name server BRUNO-03 is now a local master browser for workgroup  on subnet 192.168.32.1
  
  *****
[2012/04/30 21:22:54.005965,  0] nmbd/nmbd_become_lmb.c:395(become_local_master_stage2)
  *****
  
  Samba name server BRUNO-03 is now a local master browser for workgroup  on subnet 192.168.26.1
  
  *****
[2012/04/30 22:14:54.551204,  0] nmbd/nmbd.c:71(terminate)
  Got SIGTERM: going down...
[2012/04/30 22:14:54,  0] nmbd/nmbd.c:860(main)
  nmbd version 3.6.3-112.1-2788-SUSE-SL11.4-x86_64 started.
  Copyright Andrew Tridgell and the Samba Team 1992-2011
[2012/04/30 22:14:54,  0] lib/util_sock.c:1369(create_pipe_sock)
  bind failed on pipe socket /var/lib/samba/unexpected: Permission denied
[2012/04/30 22:14:54,  0] nmbd/nmbd_packets.c:48(nmbd_init_packet_server)
  ERROR: nb_packet_server_create failed: NT_STATUS_ACCESS_DENIED

And this is the /var/log/messages relevant line:

May  5 17:03:43 bruno-03 kernel:    53.591265] type=1400 audit(1336248223.266:30): apparmor="DENIED" operation="open" parent=2024 profile="/usr/sbin/nmbd" name="/proc/sys/kernel/core_pattern" pid=2025 comm="nmbd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

If I disable Apparmor in Yast nmbd loads. In Yast’s Apparmor profile editor module I can’t set nmbd to executable. What gives?

There’s an apparmor bug in 11.4. Try this:
Step 1 – alter apparmor
go to Yast → apparmor and enter the Control Panel → configure profiles area. Highlight usr.sbin.smbd and use the ToggleMode button to flip it to “complain” Similarly flip usr.sbin.nmbd to “complain”. Click Done to exit.

Step 2 – turn on Samba daemons
Go to Yast → system → runlevels. (a) Highlight nmb and make sure the setting is = yes (use the Enable button). (b) Highlight smb and make sure the setting is = yes (use the Enable button). (c) Highlight cifs and make sure the setting is = yes (use the Enable button).

Step 3: test again the command: su -c “rcnmb status;rcsmb status”
Should be good now, tell us if it isn’t

Step 4: reboot

Thanks, Swerdna!

Changing the mode in Apparmor’ nmbd profile to “complain” did the trick. i was then able to start nmb properly from Yast’s system services.

Note: cifs is not running but IINM it’s only required for clients, and this machine is just serving.

Yup, that’s right…

On 2012-05-06 01:26, brunomcl wrote:
>
> Thanks, Swerdna!
>
> Changing the mode in Apparmor’ nmbd profile to “complain” did the
> trick. i was then able to start nmb properly from Yast’s system
> services.

Remember that complain mode should be temporary, it fills the logs. You are
supposed to use those logs to correct the AA profiles, and then revert
complain mode.


Cheers / Saludos,

Carlos E. R.
(from 11.4 x86_64 “Celadon” at Telcontar)

On 05/06/2012 01:38 PM, Carlos E. R. wrote:

> Remember that complain mode should be temporary, it fills the logs. You are
> supposed to use those logs to correct the AA profiles, and then revert
> complain mode.
>

AA is still broken in 11.4. So please explain how to the profiles?

Regards
swerdna

On 2012-05-06 07:10, swerdna wrote:
> On 05/06/2012 01:38 PM, Carlos E. R. wrote:

> AA is still broken in 11.4. So please explain how to the profiles?

In 11.4? It works fine in my 11.4, I don’t have problems.

See susepaste


Cheers / Saludos,

Carlos E. R.
(from 11.4 x86_64 “Celadon” at Telcontar)

So far all I can figure out is that you are probably technically very competent, OK? If you are attempting to give advice about AppArmor, please be clearer. Use longer sentences. I can’t understand your cryptic comments, what hope has the OP to understand you?

On 2012-05-06 23:56, swerdna wrote:

> So far all I can figure out is that you are probably technically very
> competent, OK? If you are attempting to give advice about AppArmor,
> please be clearer. Use longer sentences. I can’t understand your cryptic
> comments, what hope has the OP to understand you?

I don’t see anything cryptic. You said, not the OP, that AA is broken in
11.4 and I say it is not. It is you who has to explain the point, not me.


Cheers / Saludos,

Carlos E. R.
(from 11.4 x86_64 “Celadon” at Telcontar)

On 2012-05-06 23:56, swerdna wrote:

> I can’t understand your cryptic
> comments, what hope has the OP to understand you?

And I can not understand your broken English. You said:

> So please explain how to the profiles?

“Howto the profiles?” What is that? What do you mean? I can not reply to
that part of your post. You also said:

> AA is still broken in 11.4.

And I said that it is not. So you have to explain to me how AA is broken in
11.4.


Cheers / Saludos,

Carlos E. R.
(from 11.4 x86_64 “Celadon” at Telcontar)

On 2012-05-06 23:56, swerdna wrote:
> So far all I can figure out is that you are probably technically very
> competent, OK? If you are attempting to give advice about AppArmor,
> please be clearer.

I only wanted to say that your previous advice was incomplete, that you can
not leave complain mode for ever. I was not explaining how to do it to the
OP, I was mentioning a fact to you.


Cheers / Saludos,

Carlos E. R.
(from 11.4 x86_64 “Celadon” at Telcontar)

At last, a post that is straightforward, clear, not “clever”, informative

@carlos: your susepaste shows smbd profile. There is no problem with this profile in apparmor, the problem happens with the nmbd profile.

I’ll keep a look at the logs - although /var/log/apparmor is still empty, perhaps due to logging level - so I doubt it will fill up my HD.

If you actually want to help you could post your nmbd apparmor profile here, if you are running a samba server in 11.4 64 bits, so we can compare with the defective ones. Thank you in advance.

@swerdna: TY for a helpful answer (as always). It might not have been exhaustively complete and inclusive, but it was good enough. Also your site on samba and nfs servers is a bookmark reference for me, thank you for your outstanding work.

On 2012-05-07 15:56, brunomcl wrote:
>
> @carlos: your susepaste shows smbd profile. There is no problem with
> this profile in apparmor, the problem happens with the nmbd profile.

I only wanted to show that apparmour and the yast modules run. I never said
that there is no problem with the nmbd profile. Please!

> I’ll keep a look at the logs - although /var/log/apparmor is still
> empty, perhaps due to logging level - so I doubt it will fill up my HD.

You probably have to restart the affected (nmbd) service.

> If you actually want to help you could post your nmbd apparmor profile
> here, if you are running a samba server in 11.4 64 bits, so we can
> compare with the defective ones. Thank you in advance.

Sorry, I’m not using nmbd.

Tell you what, I’ll try to start it. It dies. So, I start the apparmour
wizzard - and presto, it discovers problems with nmbd.

It needs r access to /proc/core/pattern, so I allow it.
w to /var/lib/samba/unexpected → allow.

Finish.

I try to start again nmbd, and it does start. See? Two minutes work.
I try again the wizard, for completeness, nothing found.

The resulting profile is… no, you try the wizard and learn how to solve
these problems yourself :slight_smile:

(because it is possible that some more things are blocked by AA that I have
not seen, as I have not my system configured to use nmbd; so you have to
know how to find them and solve)

And then you can post a Bugzilla with the solution. More karma points to you.

There is a difference between saying that apparmour does not work, or that
a profile is wrong. AA in 11.4 works. It is in 12.1 where it has more problems.

And do not forget to put the nmbd profile back in normal or enforce mode.
Complain mode is a temporary measure to get logs entries without stopping
the watched program to feed the wizard - it is not intended to be left
active for ever (it can fill the logs if the program keeps trying). If you
want to disable a profile, just move the file somewhere else.


Cheers / Saludos,

Carlos E. R.
(from 11.4 x86_64 “Celadon” at Telcontar)