profiles/apparmor.d/samba*: allow access to pid files directly in /run/

On Arch Linux, `samba-dcerpcd.pid` is in `/run/`, not `/run/samba/`.

   apparmor="DENIED" operation="mknod" profile="samba-dcerpcd" name="/run/samba-dcerpcd.pid" pid=80920 comm="samba-dcerpcd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0

The same is true for `nmbd.pid`, `smbd.pid` and probably others too.
This commit is contained in:
nl6720 2023-02-27 13:19:54 +02:00
parent 763c4ecd23
commit 6f0d2ef7fe
Failed to generate hash of commit
4 changed files with 4 additions and 5 deletions

View file

@ -14,7 +14,7 @@ profile samba-bgqd /usr/lib*/samba/{,samba/}samba-bgqd {
@{PROC}/sys/kernel/core_pattern r,
owner @{PROC}/@{pid}/fd/ r,
@{run}/samba/samba-bgqd.pid wk,
@{run}/{,samba/}samba-bgqd.pid rwk,
/usr/lib*/samba/{,samba/}samba-bgqd mr,
/var/cache/samba/printing/*.tdb rwk,

View file

@ -16,7 +16,7 @@ include <tunables/global>
profile samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {
include <abstractions/samba-rpcd>
@{run}/samba/samba-dcerpcd.pid wk,
@{run}/{,samba/}samba-dcerpcd.pid rwk,
/usr/lib*/samba/{,samba/}samba-dcerpcd mr,

View file

@ -20,7 +20,7 @@ profile samba-rpcd-spoolss /usr/lib*/samba/{,samba/}rpcd_spoolss {
/usr/lib*/samba/{,samba/}samba-bgqd Px -> samba-bgqd,
/var/cache/samba/printing/ w,
/var/cache/samba/printing/*.tdb rwk,
@{run}/samba/samba-bgqd.pid rk,
@{run}/{,samba/}samba-bgqd.pid rk,
/dev/urandom rw,

View file

@ -53,11 +53,10 @@ profile smbd /usr/{bin,sbin}/smbd {
/var/lib/samba/** rwk,
/var/lib/sss/pubconf/kdcinfo.* r,
@{run}/dbus/system_bus_socket rw,
@{run}/smbd.pid rwk,
@{run}/{,samba/}smbd.pid rwk,
@{run}/samba/** rk,
@{run}/samba/ncalrpc/ rw,
@{run}/samba/ncalrpc/** rw,
@{run}/samba/smbd.pid rw,
/var/spool/samba/** rw,
@{HOMEDIRS}/** lrwk,