Show Table of Contents
Updating a machine account password with
Chapter 10. Authentication and Interoperability
Updating a machine account password with adcli in some cases fails with SELinux error
When attempting to update the machine account password using the
adcli tool in Red Hat Enterprise Linux 6.10, the system security services daemon (SSSD) sometimes tries to update an internal Samba database that contains also the machine account password. As a consequence, the SELinux access vector cache (AVC) states that SSSD and its subprocesses are not allowed to run Samba's net command to update the internal Samba database.
To work around this problem, you can add a local SELinux policy by creating a
sssd_samba.te file with the following content:
module sssd_samba 1.0;
require {
type sssd_t;
type samba_net_exec_t;
class file execute;
}
#============= sssd_t ==============
allow sssd_t samba_net_exec_t:file execute;
And then enter the following commands:
# yum install selinux-policy-devel # make -f /usr/share/selinux/devel/Makefile sssd_samba.pp # semodule -i sssd_samba.pp
As a result, SSSD with
adcli can update Samba's internal database without an SELinux AVC error. (BZ#1558428)
Where did the comment section go?
Red Hat's documentation publication system recently went through an upgrade to enable speedier, more mobile-friendly content. We decided to re-evaluate our commenting platform to ensure that it meets your expectations and serves as an optimal feedback mechanism. During this redesign, we invite your input on providing feedback on Red Hat documentation via the discussion platform.