@zyga-snapd: currently we face some issues with the additional out of tree patches and smbd. A user can’t connect to his samba shares. Using a kernel without the patches works with apparmor enabled. We original added the additional patches to create full confinement for snaps in Manjaro Linux. Here the details from my user.
https://forum.manjaro.org/t/unstable-update-2019-06-22-kernels-pamac-firefox-python-texlive/92104/3
For now the default profile for smbd on Manjaro is this:
phil@development ~ $ cat /etc/apparmor.d/usr.sbin.smbd
#include <tunables/global>
profile smbd /usr/{bin,sbin}/smbd {
#include <abstractions/authentication>
#include <abstractions/base>
#include <abstractions/consoles>
#include <abstractions/cups-client>
#include <abstractions/nameservice>
#include <abstractions/samba>
#include <abstractions/user-tmp>
#include <abstractions/wutmp>
capability audit_write,
capability dac_override,
capability dac_read_search,
capability fowner,
capability lease,
capability net_bind_service,
capability setgid,
capability setuid,
capability sys_admin,
capability sys_resource,
capability sys_tty_config,
/etc/mtab r,
/etc/netgroup r,
/etc/printcap r,
/etc/samba/* rwk,
@{PROC}/@{pid}/mounts r,
@{PROC}/sys/kernel/core_pattern r,
/usr/lib*/samba/vfs/*.so mr,
/usr/lib*/samba/auth/*.so mr,
/usr/lib*/samba/charset/*.so mr,
/usr/lib*/samba/gensec/*.so mr,
/usr/lib*/samba/pdb/*.so mr,
/usr/lib*/samba/{lowcase,upcase,valid}.dat r,
/usr/lib/@{multiarch}/samba/*.so{,.[0-9]*} mr,
/usr/lib/@{multiarch}/samba/**/ r,
/usr/lib/@{multiarch}/samba/**/*.so{,.[0-9]*} mr,
/usr/{bin,sbin}/smbd mr,
/usr/{bin,sbin}/smbldap-useradd Px,
/var/cache/samba/** rwk,
/var/{cache,lib}/samba/printing/printers.tdb mrw,
/var/lib/samba/** rwk,
/var/lib/sss/pubconf/kdcinfo.* r,
/{,var/}run/dbus/system_bus_socket rw,
/{,var/}run/smbd.pid rwk,
/{,var/}run/samba/** rk,
/{,var/}run/samba/ncalrpc/ rw,
/{,var/}run/samba/ncalrpc/** rw,
/{,var/}run/samba/smbd.pid rw,
/{,var/}run/samba/msg.lock/ rw,
/{,var/}run/samba/msg.lock/[0-9]* rwk,
/var/spool/samba/** rw,
@{HOMEDIRS}/** lrwk,
# Site-specific additions and overrides. See local/README for details.
#include <local/usr.sbin.smbd>
}
Shares outside of the home-dir may be whitelisted them in the profile. Temporally disableing the smbd profile might work. More about apparmor here.
Feedback from the User:
Hi Phil,
What I can tell so far is:
security=apparmor apparmor=1 is added to both 5.1 and 5.2 kernel options, but smb starts fine only on 5.2 if these options are appended. On both kernels aa-status reports that Apparmor is loaded and mounted.
I tried to remove all smb shares and the issue still persists. So this seems to happen without any shares at all. This is why I suggest you to try it on your side too since it’s just a matter of enabling smb.service along with apparmor service and kernel options. If you have the same issue, then it is something Apparmor’s smbd profile related.
Also I tried disabling smbd Apparmor profile and it worked: smb.service started without problems.
All samba related packages I have are samba and Manjaro samba settings with stock configs.
For now I have no idea what is wrong with my setup.
I don’t know, maybe symlinks to another drive that I have inside some home folders are to blame?
Here is some useful info to understand the situation:
Without apparmor=1 security=apparmor, kernel 5.1:
Summary
┬─[openm@reiwa:~]─[22:28:41] ╰─>$ smbclient -L 10.0.0.5 Unable to initialize messaging context Enter WORKGROUP\openm’s password:
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
IPC$ IPC IPC Service (Samba 4.10.5)
openm Disk Home Directories
Reconnecting with SMB1 for workgroup listing.
Server Comment
--------- -------
Workgroup Master
--------- -------
WORKGROUP
┬─[openm@reiwa:~]─[22:29:07]
╰─>$ sudo aa-status
[sudo] password for openm:
apparmor module is loaded.
apparmor filesystem is not mounted.
With apparmor=1 security=apparmor, kernel 5.1:
Summary
┬─[openm@reiwa:~]─[22:34:35]
╰─>$ smbclient -L 10.0.0.5
Unable to initialize messaging context
do_connect: Connection to 10.0.0.5 failed (Error NT_STATUS_CONNECTION_REFUSED)
┬─[openm@reiwa:~]─[22:35:02]
╰─>$ sudo aa-status
[sudo] password for openm:
apparmor module is loaded.
47 profiles are loaded.
47 profiles are in enforce mode.
/usr/lib/apache2/mpm-prefork/apache2
/usr/lib/apache2/mpm-prefork/apache2//DEFAULT_URI
/usr/lib/apache2/mpm-prefork/apache2//HANDLING_UNTRUSTED_INPUT
/usr/lib/apache2/mpm-prefork/apache2//phpsysinfo
/usr/lib/dovecot/anvil
/usr/lib/dovecot/auth
/usr/lib/dovecot/config
/usr/lib/dovecot/deliver
/usr/lib/dovecot/dict
/usr/lib/dovecot/dovecot-auth
/usr/lib/dovecot/dovecot-lda
/usr/lib/dovecot/dovecot-lda//sendmail
/usr/lib/dovecot/imap
/usr/lib/dovecot/imap-login
/usr/lib/dovecot/lmtp
/usr/lib/dovecot/log
/usr/lib/dovecot/managesieve
/usr/lib/dovecot/managesieve-login
/usr/lib/dovecot/pop3
/usr/lib/dovecot/pop3-login
/usr/lib/dovecot/ssl-params
/usr/lib/dovecot/stats
/usr/sbin/dnsmasq
/usr/sbin/dnsmasq//libvirt_leaseshelper
apache2
apache2//DEFAULT_URI
apache2//HANDLING_UNTRUSTED_INPUT
apache2//phpsysinfo
avahi-daemon
dovecot
identd
klogd
lsb_release
mdnsd
nmbd
nscd
ntpd
nvidia_modprobe
nvidia_modprobe//kmod
ping
smbd
smbldap-useradd
smbldap-useradd///etc/init.d/nscd
syslog-ng
syslogd
traceroute
winbindd
0 profiles are in complain mode.
2 processes have profiles defined.
2 processes are in enforce mode.
/usr/bin/nmbd (1628) nmbd
/usr/bin/ntpd (1621) ntpd
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
┬─[openm@reiwa:~]─[22:35:13]
╰─>$ sudo ln -s /etc/apparmor.d/usr.sbin.smbd /etc/apparmor.d/disable/
┬─[openm@reiwa:~]─[22:36:45]
╰─>$ sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.smbd
┬─[openm@reiwa:~]─[22:36:51]
╰─>$ systemctl restart smb
┬─[openm@reiwa:~]─[22:37:12]
╰─>$ smbclient -L 10.0.0.5
Unable to initialize messaging context
Enter WORKGROUP\openm’s password:
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
IPC$ IPC IPC Service (Samba 4.10.5)
openm Disk Home Directories
Reconnecting with SMB1 for workgroup listing.
Server Comment
--------- -------
Workgroup Master
--------- -------
WORKGROUP RT-AC68U-ASMT
┬─[openm@reiwa:~]─[22:37:25]
╰─>$ sudo aa-status
apparmor module is loaded.
46 profiles are loaded.
46 profiles are in enforce mode.
/usr/lib/apache2/mpm-prefork/apache2
/usr/lib/apache2/mpm-prefork/apache2//DEFAULT_URI
/usr/lib/apache2/mpm-prefork/apache2//HANDLING_UNTRUSTED_INPUT
/usr/lib/apache2/mpm-prefork/apache2//phpsysinfo
/usr/lib/dovecot/anvil
/usr/lib/dovecot/auth
/usr/lib/dovecot/config
/usr/lib/dovecot/deliver
/usr/lib/dovecot/dict
/usr/lib/dovecot/dovecot-auth
/usr/lib/dovecot/dovecot-lda
/usr/lib/dovecot/dovecot-lda//sendmail
/usr/lib/dovecot/imap
/usr/lib/dovecot/imap-login
/usr/lib/dovecot/lmtp
/usr/lib/dovecot/log
/usr/lib/dovecot/managesieve
/usr/lib/dovecot/managesieve-login
/usr/lib/dovecot/pop3
/usr/lib/dovecot/pop3-login
/usr/lib/dovecot/ssl-params
/usr/lib/dovecot/stats
/usr/sbin/dnsmasq
/usr/sbin/dnsmasq//libvirt_leaseshelper
apache2
apache2//DEFAULT_URI
apache2//HANDLING_UNTRUSTED_INPUT
apache2//phpsysinfo
avahi-daemon
dovecot
identd
klogd
lsb_release
mdnsd
nmbd
nscd
ntpd
nvidia_modprobe
nvidia_modprobe//kmod
ping
smbldap-useradd
smbldap-useradd///etc/init.d/nscd
syslog-ng
syslogd
traceroute
winbindd
0 profiles are in complain mode.
2 processes have profiles defined.
2 processes are in enforce mode.
/usr/bin/nmbd (1628) nmbd
/usr/bin/ntpd (1621) ntpd
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
With apparmor=1 security=apparmor, kernel 5.2:
Summary
┬─[openm@reiwa:~]─[22:40:16]
╰─>$ smbclient -L 10.0.0.5
Unable to initialize messaging context
Enter WORKGROUP\openm’s password:
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
IPC$ IPC IPC Service (Samba 4.10.5)
openm Disk Home Directories
Reconnecting with SMB1 for workgroup listing.
Server Comment
--------- -------
Workgroup Master
--------- -------
WORKGROUP
┬─[openm@reiwa:~]─[22:40:37]
╰─>$ sudo aa-status
[sudo] password for openm:
apparmor module is loaded.
47 profiles are loaded.
47 profiles are in enforce mode.
/usr/lib/apache2/mpm-prefork/apache2
/usr/lib/apache2/mpm-prefork/apache2//DEFAULT_URI
/usr/lib/apache2/mpm-prefork/apache2//HANDLING_UNTRUSTED_INPUT
/usr/lib/apache2/mpm-prefork/apache2//phpsysinfo
/usr/lib/dovecot/anvil
/usr/lib/dovecot/auth
/usr/lib/dovecot/config
/usr/lib/dovecot/deliver
/usr/lib/dovecot/dict
/usr/lib/dovecot/dovecot-auth
/usr/lib/dovecot/dovecot-lda
/usr/lib/dovecot/dovecot-lda//sendmail
/usr/lib/dovecot/imap
/usr/lib/dovecot/imap-login
/usr/lib/dovecot/lmtp
/usr/lib/dovecot/log
/usr/lib/dovecot/managesieve
/usr/lib/dovecot/managesieve-login
/usr/lib/dovecot/pop3
/usr/lib/dovecot/pop3-login
/usr/lib/dovecot/ssl-params
/usr/lib/dovecot/stats
/usr/sbin/dnsmasq
/usr/sbin/dnsmasq//libvirt_leaseshelper
apache2
apache2//DEFAULT_URI
apache2//HANDLING_UNTRUSTED_INPUT
apache2//phpsysinfo
avahi-daemon
dovecot
identd
klogd
lsb_release
mdnsd
nmbd
nscd
ntpd
nvidia_modprobe
nvidia_modprobe//kmod
ping
smbd
smbldap-useradd
smbldap-useradd///etc/init.d/nscd
syslog-ng
syslogd
traceroute
winbindd
0 profiles are in complain mode.
6 processes have profiles defined.
6 processes are in enforce mode.
/usr/bin/nmbd (1585) nmbd
/usr/bin/ntpd (1581) ntpd
/usr/bin/smbd (1607) smbd
/usr/bin/smbd (1609) smbd
/usr/bin/smbd (1610) smbd
/usr/bin/smbd (1615) smbd
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
As you can see, there are no shares at all except the default one from /etc/samba/smb.conf, which is [homes] (manjaro-settings-samba package).
The only difference I am sure of are Ubuntu patches applied to linux51. Also, remember Frog’s reply? He said there was no issue on linux419 (his daily driver), which, as I have checked on Manjaro Gitlab, also (as linux52) does not have Ubuntu patches.
Yes, but that leaves Apparmor disabled.
I had such shares initially, but after removing them all, including those resided in /home as well, nothing has changed. One thing to note: I have no snapd installed, if it makes any sense. Also I have symlinks for stuff outside /home directory.