SELinux blocks smbd-notifyd from watch permission on user_home_dir_t

What were you trying to do that didn't work?

I'm not sure it prevents basic functionality - users can access and modify files.  But the alert is generated on accessing the directory from windows.

Please provide the package NVR for which bug is seen:

selinux-policy-38.1.11-2.el9_2.4.noarch

samba-4.17.5-103.el9_2.alma.x86_64

How reproducible:

So far only have the one EL9 samba server

Steps to reproduce

1. share home directories via the smb.conf [homes] directive
2. setsebool samba_enable_home_dirs=on

1. Access share from Windows (possibly Win 11)

Expected results

No AVC denials

Actual results

denied  { watch } for  pid=34247 comm="smbd-notifyd" path="HOME DIRECTORY" dev="dm-4" ino=517 scontext=system_u:system_r:smbd_t:s0 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir permissive=0

Apparently the samba_enable_home_dirs boolean enables:

{{{}
{}}}{{{}allow smbd_t user_home_dir_t:dir { add_name ioctl lock read remove_name write };
{}}}

{{but samba_export_all_rw enables:
}}

{{allow smbd_t non_security_file_type:dir { add_name create getattr ioctl link lock open read remove_name rename reparent rmdir search setattr unlink watch watch_reads write };
}}

{{It seems like (at least some of) these permissions should be added to user_home_dir_t (and related) for samba_export_all_rw.}}