mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-09 02:41:03 +01:00
a33c5822a9
add machine script = /usr/sbin/smbldap-useradd -t 5 -w "%u" smbd obviously needs x permissions for smbldap-useradd. The commit also adds a new profile for usr.sbin.smbldap-useradd (based on the audit.log from Alexis Pellicier). Additionally, I moved the "/etc/samba/* rwk" rule next to the other /etc-related rules in the smbd profile. References: https://bugzilla.novell.com/show_bug.cgi?id=738041
51 lines
1.3 KiB
Text
51 lines
1.3 KiB
Text
#include <tunables/global>
|
|
|
|
/usr/sbin/smbd {
|
|
#include <abstractions/authentication>
|
|
#include <abstractions/base>
|
|
#include <abstractions/consoles>
|
|
#include <abstractions/cups-client>
|
|
#include <abstractions/nameservice>
|
|
#include <abstractions/samba>
|
|
#include <abstractions/user-tmp>
|
|
#include <abstractions/wutmp>
|
|
|
|
capability dac_override,
|
|
capability dac_read_search,
|
|
capability fowner,
|
|
capability lease,
|
|
capability net_bind_service,
|
|
capability setgid,
|
|
capability setuid,
|
|
capability sys_resource,
|
|
capability sys_tty_config,
|
|
|
|
/etc/mtab r,
|
|
/etc/netgroup r,
|
|
/etc/printcap r,
|
|
/etc/samba/* rwk,
|
|
/proc/*/mounts r,
|
|
/proc/sys/kernel/core_pattern r,
|
|
/usr/lib*/samba/vfs/*.so mr,
|
|
/usr/lib*/samba/charset/*.so mr,
|
|
/usr/lib*/samba/auth/script.so mr,
|
|
/usr/lib*/samba/{lowercase,upcase,valid}.dat r,
|
|
/usr/sbin/smbd mr,
|
|
/usr/sbin/smbldap-useradd Px,
|
|
/var/cache/samba/** rwk,
|
|
/var/cache/samba/printing/printers.tdb mrw,
|
|
/var/lib/samba/** rwk,
|
|
/var/lib/samba/printers/** rw,
|
|
/{,var/}run/cups/cups.sock rw,
|
|
/{,var/}run/dbus/system_bus_socket rw,
|
|
/{,var/}run/samba/** rk,
|
|
/{,var/}run/samba/smbd.pid rw,
|
|
/var/log/samba/cores/smbd/ rw,
|
|
/var/log/samba/cores/smbd/** rw,
|
|
/var/spool/samba/** rw,
|
|
|
|
@{HOMEDIRS}/** lrwk,
|
|
|
|
# Site-specific additions and overrides. See local/README for details.
|
|
#include <local/usr.sbin.smbd>
|
|
}
|