mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

profiles/apparmor.d: Add new profiles needed for samba-4.16

Browse source 
samba-4.16 has a completely new dcerpc subsystem, services that
used to be built into the smbd daemon itself (and deployed in forked
instances) are now hosted in standalone binaries. The following new
binaries now need new profiles

  rpcd_classic
  rpcd_epmapper
  rpcd_fsrvp
  rpcd_lsad
  rpcd_mdssvc
  rpcd_rpcecho
  rpcd_spoolss
  rpcd_winreg
  samba-dcerpcd

Mostly these are captured in a single common profile 'samba-rpcd'

Additionally smbd & winbindd need new entries because they exec
samba-dcerpcd

Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1198309

Signed-off-by: Noel Power <noel.power@suse.com>
This commit is contained in:
Noel Power 2022-04-13 14:31:05 +01:00
parent 41b4436710
commit c785bcbe47
7 changed files with 126 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
profiles/apparmor.d/abstractions/samba-rpcd Normal file
View file

@ -0,0 +1,30 @@
# ------------------------------------------------------------------
#
# Copyright (C) 2022 SUSE LLC
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
# vim:syntax=apparmor
# This file contains basic permissions for samba rpcd_xyz services
abi <abi/3.0>,
include <abstractions/base>
include <abstractions/nameservice>
include <abstractions/samba>
capability setgid,
capability setuid,
signal receive set=term peer=smbd,
@{PROC}/sys/kernel/core_pattern r,
owner @{PROC}/@{pid}/fd/ r,
# Include additions to the abstraction
include if exists <abstractions/samba-rpcd.d>

29
profiles/apparmor.d/samba-dcerpcd Normal file
View file

@ -0,0 +1,29 @@
# ------------------------------------------------------------------
#
# Copyright (C) 2022 SUSE LLC
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
# vim:syntax=apparmor
abi <abi/3.0>,
include <tunables/global>
profile samba-dcerpcd /usr/lib*/samba/samba-dcerpcd {
include <abstractions/samba-rpcd>
@{run}/samba/samba-dcerpcd.pid wk,
/usr/lib*/samba/rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg} Px -> samba-rpcd,
/usr/lib*/samba/rpcd_classic Px -> samba-rpcd-classic,
/usr/lib*/samba/rpcd_spoolss Px -> samba-rpcd-spoolss,
@{run}/samba/ncalrpc/ rw,
@{run}/samba/ncalrpc/** rw,
# Site-specific additions and overrides. See local/README for details.
include if exists <local/samba-dcerpcd>
}

20
profiles/apparmor.d/samba-rpcd Normal file
View file

@ -0,0 +1,20 @@
# ------------------------------------------------------------------
#
# Copyright (C) 2022 SUSE LLC
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
# vim:syntax=apparmor
abi <abi/3.0>,
include <tunables/global>
profile samba-rpcd /usr/lib*/samba/rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg} {
include <abstractions/samba-rpcd>
# Site-specific additions and overrides. See local/README for details.
include if exists <local/samba-rpcd>
}

22
profiles/apparmor.d/samba-rpcd-classic Normal file
View file

@ -0,0 +1,22 @@
# ------------------------------------------------------------------
#
# Copyright (C) 2022 SUSE LLC
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
# vim:syntax=apparmor
abi <abi/3.0>,
include <tunables/global>
profile samba-rpcd-classic /usr/lib*/samba/rpcd_classic {
include <abstractions/samba-rpcd>
include <abstractions/wutmp>
# Site-specific additions and overrides. See local/README for details.
include if exists <local/samba-rpcd-classic>
}

23
profiles/apparmor.d/samba-rpcd-spoolss Normal file
View file

@ -0,0 +1,23 @@
# ------------------------------------------------------------------
#
# Copyright (C) 2022 SUSE LLC
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
# vim:syntax=apparmor
abi <abi/3.0>,
include <tunables/global>
profile samba-rpcd-spoolss /usr/lib*/samba/rpcd_spoolss {
include <abstractions/samba-rpcd>
/usr/lib*/samba/samba-bgqd Px -> samba-bgqd,
# Site-specific additions and overrides. See local/README for details.
include if exists <local/samba-rpcd-spoolss>
}

1
profiles/apparmor.d/usr.sbin.smbd
View file

@ -39,6 +39,7 @@ profile smbd /usr/{bin,sbin}/smbd {
/usr/lib*/samba/gensec/*.so mr,
/usr/lib*/samba/pdb/*.so mr,
/usr/lib*/samba/samba-bgqd Px -> samba-bgqd,
/usr/lib*/samba/samba-dcerpcd Px -> samba-dcerpcd,
/usr/lib*/samba/{lowcase,upcase,valid}.dat r,
/usr/lib/@{multiarch}/samba/*.so{,.[0-9]*} mr,
/usr/lib/@{multiarch}/samba/**/ r,

1
profiles/apparmor.d/usr.sbin.winbindd
View file

@ -26,6 +26,7 @@ profile winbindd /usr/{bin,sbin}/winbindd {
/usr/lib*/samba/idmap/*.so mr,
/usr/lib*/samba/nss_info/*.so mr,
/usr/lib*/samba/pdb/*.so mr,
/usr/lib*/samba/samba-dcerpcd Px -> samba-dcerpcd,
/usr/{bin,sbin}/winbindd mr,
/var/cache/krb5rcache/* rwk,
/var/cache/samba/*.tdb rwk,