netapp101::*> vserver services name-service nis-domain show-bound-debug
Bound Bound
Vserver Domain NIS Server Status
------------- ------------------- ----------------- -------------------
netapp103 nisdom 172.17.44.49 Could not connect to server
netapp101::*>
今回は「Could not connect to server」ということで、NISサーバへの接続がうまくいかない、ということだった。確認したところ、途中のfirewall設定の問題でNISに関するポートが空いていないためだった。
netapp101::*> vserver services access-check name-mapping show -vserver netapp103 -direction win-unix -name osakanataro
ATTENTION: Mapping of Data ONTAP "admin" users to UNIX user "root" is enabled, but the following information does not reflect this mapping.
'osakanataro' maps to 'osakanataro'
netapp101::*>
netapp101::*> vserver services access-check name-mapping show -vserver netapp103 -direction win-unix -name vm2\\osakanataro
ATTENTION: Mapping of Data ONTAP "admin" users to UNIX user "root" is enabled, but the following information does not reflect this mapping.
'vm2\\osakanataro' maps to 'osakanataro'
netapp101::*> vserver services access-check name-mapping show -vserver netapp103 -direction unix-win -name osakanataro
'osakanataro' maps to 'VM2\osakanataro'
netapp101::*>
なお、NISサーバにアクセスできない場合にこのコマンドを実行すると、以下の様な結果になります。
netapp101::*> vserver services access-check name-mapping show -vserver netapp103 -direction unix-win -name osakanataro
Vserver: netapp103 (internal ID: 3)
Error: RPC map name request procedure failed
[ 4 ms] Mapping Successful for Unix-user 'osakanataro' to Windows
user 'VM2*' at position 1
[ 11] Successfully connected to ip 172.17.44.49, port 445 using
TCP
[ 59] Unknown error: 12
[ 59] Failed to initiate Kerberos authentication. Trying NTLM.
[ 70] Encountered NT error (NT_STATUS_MORE_PROCESSING_REQUIRED)
for SMB command SessionSetup
[ 95] Successfully authenticated with DC
samba.adosakana.local
[ 109] Encountered NT error (NT_STATUS_PENDING) for SMB command
Read
[ 117] Could not find Windows name 'VM2*'
**[ 120] FAILURE: Name mapping for UNIX user 'osakanataro' failed.
** Explicit Mapping failed and no default mapping found
Error: command failed: Failed to find mapping for the user. Reason: "SecD
Error: The mapped user does not exist and no default user is defined".
netapp101::*>
# sudo ln -s /opt/R/${R_VERSION}/bin/R /usr/local/bin/R
# sudo ln -s /opt/R/${R_VERSION}/bin/Rscript /usr/local/bin/Rscript
# which R
/usr/local/bin/R
# R --version
R version 4.1.3 (2022-03-10) -- "One Push-Up"
Copyright (C) 2022 The R Foundation for Statistical Computing
Platform: x86_64-pc-linux-gnu (64-bit)
R is free software and comes with ABSOLUTELY NO WARRANTY.
You are welcome to redistribute it under the terms of the
GNU General Public License versions 2 or 3.
For more information about these matters see
https://www.gnu.org/licenses/.
#
# cat rstudio.te
module rstudio 1.0;
require {
type devpts_t;
type init_t;
type http_port_t;
type ptmx_t;
type user_home_t;
type unreserved_port_t;
class process { execmem setpgid };
class tcp_socket name_connect;
class file { append create execute link map open read rename setattr write };
class dir { rename reparent rmdir };
class chr_file { ioctl open read write };
}
#============= init_t ==============
#!!!! This avc is allowed in the current policy
allow init_t devpts_t:chr_file open;
#!!!! This avc is allowed in the current policy
allow init_t http_port_t:tcp_socket name_connect;
#!!!! This avc is allowed in the current policy
#!!!! This av rule may have been overridden by an extended permission av rule
allow init_t ptmx_t:chr_file { ioctl open read write };
#!!!! This avc is allowed in the current policy
allow init_t self:process { execmem setpgid };
#!!!! This avc is allowed in the current policy
allow init_t unreserved_port_t:tcp_socket name_connect;
#!!!! This avc is allowed in the current policy
allow init_t user_home_t:dir { rename reparent rmdir };
allow init_t user_home_t:file link;
#!!!! This avc is allowed in the current policy
allow init_t user_home_t:file { append create execute map open read rename setattr write };
#
# ls
rstudio.te
# cat rstudio.te
module rstudio 1.1;
require {
type devpts_t;
type init_t;
type http_port_t;
type ptmx_t;
type user_home_t;
type unreserved_port_t;
class process { execmem setpgid };
class tcp_socket name_connect;
class file { append create execute link map open read rename setattr write };
class dir { rename reparent rmdir };
class chr_file { ioctl open read write };
}
#============= init_t ==============
#!!!! This avc is allowed in the current policy
allow init_t devpts_t:chr_file open;
#!!!! This avc is allowed in the current policy
allow init_t http_port_t:tcp_socket name_connect;
#!!!! This avc is allowed in the current policy
#!!!! This av rule may have been overridden by an extended permission av rule
allow init_t ptmx_t:chr_file { ioctl open read write };
#!!!! This avc is allowed in the current policy
allow init_t self:process { execmem setpgid };
#!!!! This avc is allowed in the current policy
allow init_t unreserved_port_t:tcp_socket name_connect;
#!!!! This avc is allowed in the current policy
allow init_t user_home_t:dir { rename reparent rmdir };
allow init_t user_home_t:file link;
#!!!! This avc is allowed in the current policy
allow init_t user_home_t:file { append create execute map open read rename setattr write };
#
# cat /etc/yum.repos.d/epel.repo
[epel]
name=Extra Packages for Enterprise Linux 8 - $basearch
# It is much more secure to use the metalink, but if you wish to use a local mirror
# place its address here.
#baseurl=https://download.example/pub/epel/8/Everything/$basearch
metalink=https://mirrors.fedoraproject.org/metalink?repo=epel-8&arch=$basearch&infra=$infra&content=$contentdir
enabled=1
gpgcheck=0
countme=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-8
#
