mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix some DENIES for smbd when honouring pam restrictions

Browse source 
with smbd.conf param 'obey pam restrictions = yes'

on tumbleweed we get some new DENIES (which can prevent login)

e.g.

type=AVC msg=audit(1709113104.674:533): apparmor="DENIED" operation="exec" class="file" profile="smbd" name="/usr/sbin/unix_chkpwd" pid=3509 comm="smbd[127.0.0.1]" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
type=AVC msg=audit(1709110904.602:345): apparmor="DENIED" operation="open" class="file" profile="smbd" name="/usr/etc/security/limits.d/" pid=3746 comm="smbd[127.0.0.1]" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
type=AVC msg=audit(1709110904.602:346): apparmor="DENIED" operation="open" class="file" profile="smbd" name="/proc/3746/loginuid" pid=3746 comm="smbd[127.0.0.1]" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
type=AVC msg=audit(1709110904.602:347): apparmor="DENIED" operation="open" class="file" profile="smbd" name="/usr/etc/environment" pid=3746 comm="smbd[127.0.0.1]" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1220032

Signed-off-by: Noel Power <noel.power@suse.com>
This commit is contained in:
Noel Power 2024-02-28 09:59:55 +00:00
parent 909e330fd0
commit c09f58a364
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
profiles/apparmor.d/usr.sbin.smbd
View file

@ -33,6 +33,9 @@ profile smbd /usr/{bin,sbin}/smbd {
/etc/samba/* rwk,
@{PROC}/@{pid}/mounts r,
@{PROC}/sys/kernel/core_pattern r,
/usr/etc/environment r,
/usr/etc/security/limits.d/ r,
/usr/etc/security/limits.d/*.conf r,
/usr/lib*/samba/vfs/*.so mr,
/usr/lib*/samba/auth/*.so mr,
/usr/lib*/samba/charset/*.so mr,
@ -47,6 +50,7 @@ profile smbd /usr/{bin,sbin}/smbd {
/usr/share/samba/** r,
/usr/{bin,sbin}/smbd mr,
/usr/{bin,sbin}/smbldap-useradd Px,
/usr/sbin/unix_chkpwd Px,
/var/cache/samba/** rwk,
/var/{cache,lib}/samba/printing/printers.tdb mrw,
/var/lib/nscd/netgroup r,
@ -59,6 +63,8 @@ profile smbd /usr/{bin,sbin}/smbd {
@{run}/samba/ncalrpc/** rw,
/var/spool/samba/** rw,
owner /proc/@{pid}/loginuid r,
@{HOMEDIRS}/** lrwk,
/var/lib/samba/usershares/{,**} lrwk,