From e5758891e6d76b8067b48156b3fd9eefcd5803a9 Mon Sep 17 00:00:00 2001 From: John Johansen Date: Wed, 3 Apr 2024 08:43:01 +0000 Subject: [PATCH] Merge profiles/samba*: allow /etc/gnutls/config & @{HOMEDIRS} # abstractions/samba: allow /etc/gnutls/config Various samba components want to read it. Without it, shares cannot be accessed. apparmor="DENIED" operation="open" class="file" profile="nmbd" name="/etc/gnutls/config" pid=23509 comm="nmbd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 apparmor="DENIED" operation="open" class="file" profile="smbd" name="/etc/gnutls/config" pid=23508 comm="smbd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 apparmor="DENIED" operation="open" class="file" profile="samba-rpcd" name="/etc/gnutls/config" pid=24037 comm="rpcd_fsrvp" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 apparmor="DENIED" operation="open" class="file" profile="samba-rpcd" name="/etc/gnutls/config" pid=24036 comm="rpcd_epmapper" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 apparmor="DENIED" operation="open" class="file" profile="samba-rpcd" name="/etc/gnutls/config" pid=24038 comm="rpcd_lsad" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 apparmor="DENIED" operation="open" class="file" profile="samba-rpcd" name="/etc/gnutls/config" pid=24041 comm="rpcd_winreg" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 apparmor="DENIED" operation="open" class="file" profile="samba-rpcd" name="/etc/gnutls/config" pid=24039 comm="rpcd_mdssvc" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 apparmor="DENIED" operation="open" class="file" profile="samba-rpcd-spoolss" name="/etc/gnutls/config" pid=24040 comm="rpcd_spoolss" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 apparmor="DENIED" operation="open" class="file" profile="samba-rpcd-classic" name="/etc/gnutls/config" pid=24035 comm="rpcd_classic" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 # profiles/apparmor.d/samba-rpcd-classic: allow @{HOMEDIRS} Give access to @{HOMEDIRS}, just like in usr.sbin.smbd, so that usershares in /home/ can be accessed. apparmor="DENIED" operation="open" class="file" profile="samba-rpcd-classic" name="/home/user/path/to/usershare/" pid=4781 comm="rpcd_classic" requested_mask="r" denied_mask="r" fsuid=0 ouid=1000 Fixes: https://gitlab.com/apparmor/apparmor/-/issues/379 MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1200 Approved-by: John Johansen Merged-by: John Johansen (cherry picked from commit 5998a0021a4f7527fe0b64771e5b9efe71267d8e) Signed-off-by: John Johansen --- profiles/apparmor.d/abstractions/samba | 1 + profiles/apparmor.d/samba-rpcd-classic | 2 ++ 2 files changed, 3 insertions(+) diff --git a/profiles/apparmor.d/abstractions/samba b/profiles/apparmor.d/abstractions/samba index a17e31a18..27183f9e8 100644 --- a/profiles/apparmor.d/abstractions/samba +++ b/profiles/apparmor.d/abstractions/samba @@ -12,6 +12,7 @@ abi , /etc/samba/* r, + /etc/gnutls/config r, /usr/lib*/ldb/*.so mr, /usr/lib*/ldb2/*.so mr, /usr/lib*/ldb2/modules/ldb/*.so mr, diff --git a/profiles/apparmor.d/samba-rpcd-classic b/profiles/apparmor.d/samba-rpcd-classic index 84a61f312..e0ef6c1a0 100644 --- a/profiles/apparmor.d/samba-rpcd-classic +++ b/profiles/apparmor.d/samba-rpcd-classic @@ -19,6 +19,8 @@ profile samba-rpcd-classic /usr/lib*/samba/{,samba/}rpcd_classic { /usr/lib*/samba/{,samba/}rpcd_classic mr, + @{HOMEDIRS}/** lrwk, + # Site-specific additions and overrides. See local/README for details. include if exists }