mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 16:35:02 +01:00
fa26623e6d
... instead of keeping them in the smbd profile. For details, seec09f58a364and https://bugzilla.opensuse.org/show_bug.cgi?id=1220032#c12 Also replace /usr/etc/ with @{etc_ro} to that also /etc/ is covered. Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1220032#c12 MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1191 Approved-by: John Johansen <john@jjmx.net> Merged-by: John Johansen <john@jjmx.net> (cherry picked from commitf334884787) Signed-off-by: John Johansen <john.johansen@canonical.com>
71 lines
2.1 KiB
Text
71 lines
2.1 KiB
Text
abi <abi/4.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
profile smbd /usr/{bin,sbin}/smbd {
|
|
include <abstractions/authentication>
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/cups-client>
|
|
include <abstractions/nameservice>
|
|
include <abstractions/samba>
|
|
include <abstractions/user-tmp>
|
|
include <abstractions/wutmp>
|
|
|
|
capability audit_write,
|
|
capability dac_override,
|
|
capability dac_read_search,
|
|
capability fowner,
|
|
capability lease,
|
|
capability net_bind_service,
|
|
capability setgid,
|
|
capability setuid,
|
|
capability sys_admin,
|
|
capability sys_resource,
|
|
capability sys_tty_config,
|
|
|
|
signal send set=term peer=samba-bgqd,
|
|
|
|
/etc/mtab r,
|
|
/etc/netgroup r,
|
|
/etc/printcap r,
|
|
/etc/samba/* rwk,
|
|
@{PROC}/@{pid}/mounts r,
|
|
@{PROC}/sys/kernel/core_pattern r,
|
|
/usr/lib*/samba/vfs/*.so mr,
|
|
/usr/lib*/samba/auth/*.so mr,
|
|
/usr/lib*/samba/charset/*.so mr,
|
|
/usr/lib*/samba/gensec/*.so mr,
|
|
/usr/lib*/samba/pdb/*.so mr,
|
|
/usr/lib*/samba/{,samba/}samba-bgqd Px -> samba-bgqd,
|
|
/usr/lib*/samba/{,samba/}samba-dcerpcd Px -> samba-dcerpcd,
|
|
/usr/lib*/samba/{lowcase,upcase,valid}.dat r,
|
|
/usr/lib/@{multiarch}/samba/*.so{,.[0-9]*} mr,
|
|
/usr/lib/@{multiarch}/samba/**/ r,
|
|
/usr/lib/@{multiarch}/samba/**/*.so{,.[0-9]*} mr,
|
|
/usr/share/samba/** r,
|
|
/usr/{bin,sbin}/smbd mr,
|
|
/usr/{bin,sbin}/smbldap-useradd Px,
|
|
/var/cache/samba/** rwk,
|
|
/var/{cache,lib}/samba/printing/printers.tdb mrw,
|
|
/var/lib/nscd/netgroup r,
|
|
/var/lib/samba/** rwk,
|
|
/var/lib/sss/pubconf/kdcinfo.* r,
|
|
@{run}/dbus/system_bus_socket rw,
|
|
@{run}/{,samba/}smbd.pid rwk,
|
|
@{run}/samba/** rk,
|
|
@{run}/samba/ncalrpc/ rw,
|
|
@{run}/samba/ncalrpc/** rw,
|
|
/var/spool/samba/** rw,
|
|
|
|
@{HOMEDIRS}/** lrwk,
|
|
/var/lib/samba/usershares/{,**} lrwk,
|
|
|
|
# Permissions for all configured shares (file autogenerated by
|
|
# update-apparmor-samba-profile on service startup on Debian and openSUSE)
|
|
include if exists <samba/smbd-shares>
|
|
include if exists <local/usr.sbin.smbd-shares>
|
|
|
|
# Site-specific additions and overrides. See local/README for details.
|
|
include if exists <local/usr.sbin.smbd>
|
|
}
|