mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-09-03 07:45:50 +00:00
Code Issues Releases Wiki Activity

Samba profile updates for ActiveDirectory / Kerberos

Browse Source 
The Samba package used by the INVIS server (based on openSUSE) needs
some additional Samba permissions for the added ActiveDirectory /
Kerberos support.

As discussed with Seth, add /var/lib/sss/mc/initgroups read permissions
to abstractions/nameservice instead of only to the smbd profile because
it's probably needed by more than just Samba if someone uses sss.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for 2.9, 2.10, 2.11 and trunk.
This commit is contained in:
Christian Boltz
2017-08-29 13:31:20 +02:00
parent ae692bfb3b
commit 84cd523d8c
3 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
profiles/apparmor.d/abstractions/nameservice
View File

@@ -29,6 +29,7 @@
# When using sssd, the passwd and group files are stored in an alternate path # When using sssd, the passwd and group files are stored in an alternate path
# and the nss plugin also needs to talk to a pipe # and the nss plugin also needs to talk to a pipe
/var/lib/sss/mc/group r, /var/lib/sss/mc/group r,
/var/lib/sss/mc/initgroups r,
/var/lib/sss/mc/passwd r, /var/lib/sss/mc/passwd r,
/var/lib/sss/pipes/nss rw, /var/lib/sss/pipes/nss rw,

1
profiles/apparmor.d/abstractions/samba
View File

@@ -11,6 +11,7 @@
/etc/samba/* r, /etc/samba/* r,
/usr/lib*/ldb/*.so mr, /usr/lib*/ldb/*.so mr,
/usr/lib*/samba/ldb/*.so mr,
/usr/share/samba/*.dat r, /usr/share/samba/*.dat r,
/usr/share/samba/codepages/{lowcase,upcase,valid}.dat r, /usr/share/samba/codepages/{lowcase,upcase,valid}.dat r,
/var/cache/samba/ w, /var/cache/samba/ w,

1
profiles/apparmor.d/usr.sbin.winbindd
View File

@@ -20,6 +20,7 @@
@{PROC}/sys/kernel/core_pattern r, @{PROC}/sys/kernel/core_pattern r,
/tmp/.winbindd/ w, /tmp/.winbindd/ w,
/tmp/krb5cc_* rwk, /tmp/krb5cc_* rwk,
/usr/lib*/samba/gensec/krb*.so mr,
/usr/lib*/samba/idmap/*.so mr, /usr/lib*/samba/idmap/*.so mr,
/usr/lib*/samba/nss_info/*.so mr, /usr/lib*/samba/nss_info/*.so mr,
/usr/lib*/samba/pdb/*.so mr, /usr/lib*/samba/pdb/*.so mr,