mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 08:24:42 +01:00
profiles/apparmor.d/samba*: allow access to pid files directly in /run/
On Arch Linux, `samba-dcerpcd.pid` is in `/run/`, not `/run/samba/`. apparmor="DENIED" operation="mknod" profile="samba-dcerpcd" name="/run/samba-dcerpcd.pid" pid=80920 comm="samba-dcerpcd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0 The same is true for `nmbd.pid`, `smbd.pid` and probably others too.
This commit is contained in:
parent
763c4ecd23
commit
6f0d2ef7fe
4 changed files with 4 additions and 5 deletions
|
@ -14,7 +14,7 @@ profile samba-bgqd /usr/lib*/samba/{,samba/}samba-bgqd {
|
|||
@{PROC}/sys/kernel/core_pattern r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
@{run}/samba/samba-bgqd.pid wk,
|
||||
@{run}/{,samba/}samba-bgqd.pid rwk,
|
||||
|
||||
/usr/lib*/samba/{,samba/}samba-bgqd mr,
|
||||
/var/cache/samba/printing/*.tdb rwk,
|
||||
|
|
|
@ -16,7 +16,7 @@ include <tunables/global>
|
|||
profile samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {
|
||||
include <abstractions/samba-rpcd>
|
||||
|
||||
@{run}/samba/samba-dcerpcd.pid wk,
|
||||
@{run}/{,samba/}samba-dcerpcd.pid rwk,
|
||||
|
||||
/usr/lib*/samba/{,samba/}samba-dcerpcd mr,
|
||||
|
||||
|
|
|
@ -20,7 +20,7 @@ profile samba-rpcd-spoolss /usr/lib*/samba/{,samba/}rpcd_spoolss {
|
|||
/usr/lib*/samba/{,samba/}samba-bgqd Px -> samba-bgqd,
|
||||
/var/cache/samba/printing/ w,
|
||||
/var/cache/samba/printing/*.tdb rwk,
|
||||
@{run}/samba/samba-bgqd.pid rk,
|
||||
@{run}/{,samba/}samba-bgqd.pid rk,
|
||||
|
||||
/dev/urandom rw,
|
||||
|
||||
|
|
|
@ -53,11 +53,10 @@ profile smbd /usr/{bin,sbin}/smbd {
|
|||
/var/lib/samba/** rwk,
|
||||
/var/lib/sss/pubconf/kdcinfo.* r,
|
||||
@{run}/dbus/system_bus_socket rw,
|
||||
@{run}/smbd.pid rwk,
|
||||
@{run}/{,samba/}smbd.pid rwk,
|
||||
@{run}/samba/** rk,
|
||||
@{run}/samba/ncalrpc/ rw,
|
||||
@{run}/samba/ncalrpc/** rw,
|
||||
@{run}/samba/smbd.pid rw,
|
||||
/var/spool/samba/** rw,
|
||||
|
||||
@{HOMEDIRS}/** lrwk,
|
||||
|
|
Loading…
Add table
Reference in a new issue