Centos7+Samba+Winbind+AD=polkit ZOMBIE

#!/bin/bash

# Интерфейс, на котором будут видны smb-шары.
eth="ens18"
domain=`hostname -d`
DOMAIN=`echo "$domain" | tr '[:lower:]' '[:upper:]'`
host=`hostname -s`
workgroup="${domain%%.*}"
adusername="admin"
aduserlist=""

# Ввод в домен AD.
yum install -y realmd.x86_64 adcli.x86_64 sssd.x86_64 krb5-workstation.x86_64 oddjob-mkhomedir.x86_64 samba-common-tools.x86_64 policycoreutils-python.x86_64 samba.x86_64
cat << EOF > /etc/realmd.conf
[users]
default-home = /home/%u
default-shell = /bin/bash
EOF
cat << EOF > /etc/krb5.conf
[logging]
        default = FILE:/var/log/krb5libs.log
        kdc = FILE:/var/log/krb5kdc.log
        admin_server = FILE:/var/log/kadmind.log

[libdefaults]
        dns_lookup_realm = false
        ticket_lifetime = 24h
        renew_lifetime = 7d
        forwardable = true
        rdns = false
        default_realm = $DOMAIN
        default_ccache_name = KEYRING:persistent:%{uid}

[realms]
        $DOMAIN = {
                kdc = $domain
                admin_server = $domain
        }

[domain_realm]
        .$domain = $DOMAIN
        .$workgroup = $DOMAIN
        $domain = $DOMAIN
        $workgroup = $DOMAIN
EOF
realm discover $domain
realm join $domain -U $adusername
realm deny --all

# Разрешить вход под логинами без указания домена.
sed -i 's/^use_fully_qualified_names =.*$/use_fully_qualified_names = False/g' /etc/sssd/sssd.conf

systemctl restart sssd.service

realm permit $adusername
usermod -a -G wheel,users $adusername
for user in $aduserlist
do
    realm permit $user
    usermod -a -G wheel,users $user
done
sed -i 's/^.*GSSAPIAuthentication.*$/GSSAPIAuthentication yes/g' /etc/ssh/sshd_config
sed -i 's/^.*GSSAPICleanupCredentials.*$/GSSAPICleanupCredentials yes/g' /etc/ssh/sshd_config
systemctl restart sshd.service

cat << EOF > /etc/samba/smb.conf
[global]
    interfaces = $eth
    workgroup = $workgroup
    realm = $domain
    security = ads
    netbios name = "$host"
    wins support = no
    wins proxy = no

    password server = $domain
    kerberos method = dedicated keytab
    dedicated keytab file = /etc/krb5.keytab
    log level = 3
    log file = /var/log/samba/%m.log

    vfs objects = acl_xattr
    map acl inherit = Yes
    store dos attributes = Yes

    load printers = no
    show add printer wizard = no
    printing = bsd
    printcap name = /dev/null
    disable spoolss = yes
# [its]
#     # У шары должен быть контекст samba_share_t. Запустить от рута:
#     # semanage fcontext -a -t 'samba_share_t' '/path/to/share(/.*)?'
#     # Далее: # restorecon -rv /path/to/share/
#     path = /path/to/share
#     read only = no
#     valid users = @wheel
EOF

module smb 1.0;

require {
        type krb5_host_rcache_t;
        type smbd_tmp_t;
        type smbd_t;
        type sshd_t;
        class file { create getattr lock open read setattr unlink write };
}

#============= smbd_t ==============
allow smbd_t krb5_host_rcache_t:file { create getattr lock open read setattr unlink write };

#============= sshd_t ==============
# samba портит /var/tmp/host_0 и при пересоздании устанавливает ему контекст smbd_tmp_t.
allow sshd_t smbd_tmp_t:file { create getattr lock open read setattr unlink write };

[global] 
interfaces = eth0 
realm = CGB.LOCAL 
log file = /var/log/samba/%m.log 
disable spoolss = Yes 
load printers = No 
printcap name = /dev/null 
show add printer wizard = No 
dedicated keytab file = /etc/krb5.keytab 
kerberos method = dedicated keytab 
security = ADS 
idmap config cgb:range = 10000-999999 
idmap config cgb:backend = rid 
idmap config * : range = 3000-7999 
idmap config * : backend = tdb 
store dos attributes = Yes 
printing = bsd 
map acl inherit = Yes 
vfs objects = acl_xattr

[homes] 
comment = Home Directories 
browseable = No 
inherit acls = Yes 
read only = No 
valid users = %S %D%w%S

[share$] 
path = /share$ 
browseable = No 
hide unreadable = Yes 
create mask = 0777 
read list = «+CGB\пользователи домена» «+CGB\администраторы домена» +web-irbis\admins 
read only = No 
valid users = «+CGB\пользователи домена» «+CGB\администраторы домена» root admins +web-irbis\admins 
write list = «+CGB\пользователи домена» «+CGB\администраторы домена» +web-irbis\admins

[sssd] 
domains = cgb.local 
config_file_version = 2 
services = nss, pam 
[domain/cgb.local] 
ad_domain = cgb.local 
krb5_realm = CGB.LOCAL 
realmd_tags = manages-system joined-with-samba 
cache_credentials = True 
id_provider = ad 
krb5_store_password_if_offline = True 
default_shell = /bin/bash 
ldap_id_mapping = True 
use_fully_qualified_names = False 
fallback_homedir = /home/%u 
access_provider = simple 
simple_allow_users = admins

# Configuration snippets may be placed in this directory as well includedir /etc/krb5.conf.d/

[logging] 
default = FILE:/var/log/krb5libs.log 
kdc = FILE:/var/log/krb5kdc.log 
admin_server = FILE:/var/log/kadmind.log

[libdefaults] 
dns_lookup_realm = false 
ticket_lifetime = 24h 
renew_lifetime = 7d 
forwardable = true 
rdns = false 
default_realm = CGB.LOCAL 
default_ccache_name = KEYRING:persistent:%{uid}

[realms] 
CGB.LOCAL = { 
kdc = cgb.local 
admin_server = cgb.local 
}

[domain_realm] 
.cgb.local = CGB.LOCAL 
cgb.local = CGB.LOCAL

Chain INPUT (policy ACCEPT) target prot opt source destination

Chain FORWARD (policy ACCEPT) target prot opt source destination

Chain OUTPUT (policy ACCEPT) target prot opt source destination 

read list = @"пользователи домена" @"администраторы домена" и т.п.