SELinux user label problem with Samba share files

Greetings - A coworker ran into a (permission denied) problem recently trying to save a file on our Samba server. So I first checked into the normal user and group permissions for the user and the file, and everything seemed fine there. So then I moved on to investigating whether it was an SELinux issue, and subsequently I think I found more problems on our Samba server than I wanted to see. A short description of the issue that I see is that while the files on my Samba share are labeled with the samba_share_t type, there is a mixture of two different SELinux user labels. Some directories/files are labeled with system_u and others are labeled with unconfined_u. The particular file that the coworker was trying to save (and received a permission denied result) had a system_u label. An example of the mixture is shown below. [root@sequoia CorporateDocs]# ls -lZ drwxrws--T. eileenm mei_office system_u:object_r:samba_share_t:s0 Amendments drwxrws--T. jeffb meiboard unconfined_u:object_r:samba_share_t:s0 Budget Materials -rwxrw----. eileenm mei_office system_u:object_r:samba_share_t:s0 Ltr_Engagement_Mclanahan.pdf drwxrws--T. jeffb meiboard unconfined_u:object_r:samba_share_t:s0 MEI Stock -rwxrw----. eileenm mei_office system_u:object_r:samba_share_t:s0 Original By-laws.pdf Our setup in this small office includes a Samba file server that is accessed by all staff through their Windows desktop/laptop systems. We have a half a dozen main directories under our primary share with only one of them restricted to a subset of the staff as diagrammed below. The restricted subset is defined by standard user and group restrictions. Ecosystem Share Projects - all staff Proposals - all staff Reference - all staff CorporateAdmin - restricted subset of staff I suspect that the mixture of selinux user labels was a result of our migration to this CentOS 6 server (a KVM guest if that matters) a couple years ago from a pre-selinux RHEL 3 server. I thought I had all my Samba selinux settings setup correctly when doing the migration, but I guess not. I am actually surprised that we haven't run into the issue earlier. My goal now is to get all the selinux user labels uniformly correct and solve the permission denied error that my coworker encountered. I am hoping the first solves the second, and doesn't conflict with it. Although I am not sure which label is correct for my situation, system_u or unconfined_u. And if it is system_u, then why the permission denied issue on that particular file. They don't have the same issue with other files in other directories that have a system_u label. I have read through the RHEL SE Linux User guide an am not sure where to go from here. So I am looking for some guidance from the experts here. I looked into the /etc/selinux/targeted/contexts/files/file_contexts.local file and see the following information. Maybe this is messed up also; or a contributing factor to my issue. # This file is auto-generated by libsemanage # Do not edit directly. /ecosystem(/.*)? system_u:object_r:samba_share_t:s0 /home/jeffb/messages system_u:object_r:user_home_t:s0 ./CorporateDocs system_u:object_r:samba_share_t:s0 Any guidance appreciated. You may cc me directly as I only get the daily digest of this list. Thanks. Jeff -- Jeff Boyce Meridian Environmental www.meridianenv.com