apparmor/profiles/apparmor.d/usr.sbin.nmbd

abi <abi/4.0>,

include <tunables/global>

profile nmbd /usr/{bin,sbin}/nmbd {
  include <abstractions/base>
  include <abstractions/nameservice>
  include <abstractions/samba>

  capability net_bind_service,
  capability sys_resource,

  @{PROC}/sys/kernel/core_pattern r,

  @{exec_path} mr,

  /var/{cache,lib}/samba/browse.dat* rw,
  /var/{cache,lib}/samba/gencache.dat rw,
  /var/{cache,lib}/samba/wins.dat* rw,
  /var/{cache,lib}/samba/smb_krb5/ rw,
  /var/{cache,lib}/samba/smb_krb5/krb5.conf* rw,
  /var/{cache,lib}/samba/smb_tmp_krb5.* rw,
  /var/{cache,lib}/samba/sync.* rw,
  /var/{cache,lib}/samba/unexpected rw,
  /var/cache/samba/msg/ rw,
  /var/cache/samba/msg/* w,

  @{run}/nmbd.pid rwk,
  @{run}/samba/** rwk,
  @{run}/systemd/notify w,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/usr.sbin.nmbd>
}