File samba-4-17.patch of Package apparmor.30574

Overview Repositories Revisions Requests Users Attributes Meta

File samba-4-17.patch of Package apparmor.30574

diff -ruNp apparmor-3.0.4.orig/profiles/apparmor.d/abstractions/samba apparmor-3.0.4/profiles/apparmor.d/abstractions/samba
--- apparmor-3.0.4.orig/profiles/apparmor.d/abstractions/samba	2022-12-23 18:47:52.625736048 +0100
+++ apparmor-3.0.4/profiles/apparmor.d/abstractions/samba	2022-12-23 18:49:13.908999253 +0100
@@ -25,9 +25,9 @@
   /var/log/samba/cores/** rw,
   /var/log/samba/* w,
   @{run}/{,lock/}samba/ w,
-  @{run}/{,lock/}samba/*.tdb rw,
-  @{run}/{,lock/}samba/msg.lock/ rwk,
-  @{run}/{,lock/}samba/msg.lock/[0-9]* rwk,
+  @{run}/{,lock/}samba/*.tdb rwk,
+  @{run}/{,lock/}samba/msg.{lock,sock}/ rwk,
+  @{run}/{,lock/}samba/msg.{lock,sock}/[0-9]* rwk,
   /var/cache/samba/msg.lock/ rwk,
   /var/cache/samba/msg.lock/[0-9]* rwk,
 
diff -ruNp apparmor-3.0.4.orig/profiles/apparmor.d/samba-bgqd apparmor-3.0.4/profiles/apparmor.d/samba-bgqd
--- apparmor-3.0.4.orig/profiles/apparmor.d/samba-bgqd	2022-12-23 18:47:52.629736012 +0100
+++ apparmor-3.0.4/profiles/apparmor.d/samba-bgqd	2022-12-23 18:53:18.114785651 +0100
@@ -2,7 +2,7 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-profile samba-bgqd /usr/lib*/samba/samba-bgqd {
+profile samba-bgqd /usr/lib*/samba/{,samba/}samba-bgqd {
   include <abstractions/base>
   include <abstractions/cups-client>
   include <abstractions/nameservice>
@@ -16,7 +16,8 @@ profile samba-bgqd /usr/lib*/samba/samba
 
   @{run}/samba/samba-bgqd.pid wk,
 
-  /usr/lib*/samba/samba-bgqd m,
+  /usr/lib*/samba/{,samba/}samba-bgqd mr,
+  /var/cache/samba/printing/*.tdb rwk,
 
   # Site-specific additions and overrides. See local/README for details.
   include if exists <local/samba-bgqd>
diff -ruNp apparmor-3.0.4.orig/profiles/apparmor.d/samba-dcerpcd apparmor-3.0.4/profiles/apparmor.d/samba-dcerpcd
--- apparmor-3.0.4.orig/profiles/apparmor.d/samba-dcerpcd	2022-12-23 18:47:52.629736012 +0100
+++ apparmor-3.0.4/profiles/apparmor.d/samba-dcerpcd	2022-12-23 18:53:09.022868064 +0100
@@ -13,14 +13,17 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-profile samba-dcerpcd /usr/lib*/samba/samba-dcerpcd {
+profile samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {
   include <abstractions/samba-rpcd>
 
   @{run}/samba/samba-dcerpcd.pid wk,
 
-  /usr/lib*/samba/rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg} Px -> samba-rpcd,
-  /usr/lib*/samba/rpcd_classic Px -> samba-rpcd-classic,
-  /usr/lib*/samba/rpcd_spoolss Px -> samba-rpcd-spoolss,
+  /usr/lib*/samba/{,samba/}samba-dcerpcd mr,
+
+  /usr/lib*/samba/ r,
+  /usr/lib*/samba/{,samba/}rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg} Px -> samba-rpcd,
+  /usr/lib*/samba/{,samba/}rpcd_classic Px -> samba-rpcd-classic,
+  /usr/lib*/samba/{,samba/}rpcd_spoolss Px -> samba-rpcd-spoolss,
 
   @{run}/samba/ncalrpc/ rw,
   @{run}/samba/ncalrpc/** rw,
diff -ruNp apparmor-3.0.4.orig/profiles/apparmor.d/samba-rpcd apparmor-3.0.4/profiles/apparmor.d/samba-rpcd
--- apparmor-3.0.4.orig/profiles/apparmor.d/samba-rpcd	2022-12-23 18:47:52.629736012 +0100
+++ apparmor-3.0.4/profiles/apparmor.d/samba-rpcd	2022-12-23 18:54:17.186250195 +0100
@@ -13,8 +13,12 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-profile samba-rpcd /usr/lib*/samba/rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg} {
+profile samba-rpcd /usr/lib*/samba/{,samba/}rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg} {
   include <abstractions/samba-rpcd>
+  /usr/lib*/samba/{,samba/}rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg} mr,
+
+  @{run}/samba/ncalrpc/np/winreg wr,
+
   # Site-specific additions and overrides. See local/README for details.
   include if exists <local/samba-rpcd>
 }
diff -ruNp apparmor-3.0.4.orig/profiles/apparmor.d/samba-rpcd-classic apparmor-3.0.4/profiles/apparmor.d/samba-rpcd-classic
--- apparmor-3.0.4.orig/profiles/apparmor.d/samba-rpcd-classic	2022-12-23 18:47:52.629736012 +0100
+++ apparmor-3.0.4/profiles/apparmor.d/samba-rpcd-classic	2022-12-23 18:54:44.486002731 +0100
@@ -13,10 +13,12 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-profile samba-rpcd-classic /usr/lib*/samba/rpcd_classic {
+profile samba-rpcd-classic /usr/lib*/samba/{,samba/}rpcd_classic {
   include <abstractions/samba-rpcd>
   include <abstractions/wutmp>
 
+  /usr/lib*/samba/{,samba/}rpcd_classic mr,
+
   # Site-specific additions and overrides. See local/README for details.
   include if exists <local/samba-rpcd-classic>
 }
diff -ruNp apparmor-3.0.4.orig/profiles/apparmor.d/samba-rpcd-spoolss apparmor-3.0.4/profiles/apparmor.d/samba-rpcd-spoolss
--- apparmor-3.0.4.orig/profiles/apparmor.d/samba-rpcd-spoolss	2022-12-23 18:47:52.629736012 +0100
+++ apparmor-3.0.4/profiles/apparmor.d/samba-rpcd-spoolss	2022-12-23 18:55:10.177769851 +0100
@@ -13,10 +13,19 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-profile samba-rpcd-spoolss /usr/lib*/samba/rpcd_spoolss {
+profile samba-rpcd-spoolss /usr/lib*/samba/{,samba/}rpcd_spoolss {
   include <abstractions/samba-rpcd>
 
-  /usr/lib*/samba/samba-bgqd Px -> samba-bgqd,
+  /usr/lib*/samba/{,samba/}rpcd_spoolss mr,
+  /usr/lib*/samba/{,samba/}samba-bgqd Px -> samba-bgqd,
+  /var/cache/samba/printing/ w,
+  /var/cache/samba/printing/*.tdb rwk,
+  @{run}/samba/samba-bgqd.pid rk,
+
+  /dev/urandom rw,
+
+  @{run}/samba/ncalrpc/ rw,
+  @{run}/samba/ncalrpc/** rw,
 
   # Site-specific additions and overrides. See local/README for details.
   include if exists <local/samba-rpcd-spoolss>
diff -ruNp apparmor-3.0.4.orig/profiles/apparmor.d/usr.sbin.smbd apparmor-3.0.4/profiles/apparmor.d/usr.sbin.smbd
--- apparmor-3.0.4.orig/profiles/apparmor.d/usr.sbin.smbd	2022-12-23 18:47:52.629736012 +0100
+++ apparmor-3.0.4/profiles/apparmor.d/usr.sbin.smbd	2022-12-23 18:56:03.581285769 +0100
@@ -38,12 +38,13 @@ profile smbd /usr/{bin,sbin}/smbd {
   /usr/lib*/samba/charset/*.so mr,
   /usr/lib*/samba/gensec/*.so mr,
   /usr/lib*/samba/pdb/*.so mr,
-  /usr/lib*/samba/samba-bgqd Px -> samba-bgqd,
-  /usr/lib*/samba/samba-dcerpcd Px -> samba-dcerpcd,
+  /usr/lib*/samba/{,samba/}samba-bgqd Px -> samba-bgqd,
+  /usr/lib*/samba/{,samba/}samba-dcerpcd Px -> samba-dcerpcd,
   /usr/lib*/samba/{lowcase,upcase,valid}.dat r,
   /usr/lib/@{multiarch}/samba/*.so{,.[0-9]*} mr,
   /usr/lib/@{multiarch}/samba/**/ r,
   /usr/lib/@{multiarch}/samba/**/*.so{,.[0-9]*} mr,
+  /usr/share/samba/** r,
   /usr/{bin,sbin}/smbd mr,
   /usr/{bin,sbin}/smbldap-useradd Px,
   /var/cache/samba/** rwk,
@@ -61,9 +62,10 @@ profile smbd /usr/{bin,sbin}/smbd {
   @{HOMEDIRS}/** lrwk,
   /var/lib/samba/usershares/{,**} lrwk,
 
-  # permissions for all configured shares
-  # autogenerated by update-apparmor-samba-profile at samba start
-  include <local/usr.sbin.smbd-shares>
+  # Permissions for all configured shares (file autogenerated by
+  # update-apparmor-samba-profile on service startup on Debian and openSUSE)
+  include if exists <samba/smbd-shares>
+  include if exists <local/usr.sbin.smbd-shares>
 
   # Site-specific additions and overrides. See local/README for details.
   include if exists <local/usr.sbin.smbd>
diff -ruNp apparmor-3.0.4.orig/profiles/apparmor.d/usr.sbin.winbindd apparmor-3.0.4/profiles/apparmor.d/usr.sbin.winbindd
--- apparmor-3.0.4.orig/profiles/apparmor.d/usr.sbin.winbindd	2022-12-23 18:47:52.629736012 +0100
+++ apparmor-3.0.4/profiles/apparmor.d/usr.sbin.winbindd	2022-12-23 18:56:24.553095669 +0100
@@ -26,7 +26,7 @@ profile winbindd /usr/{bin,sbin}/winbind
   /usr/lib*/samba/idmap/*.so mr,
   /usr/lib*/samba/nss_info/*.so mr,
   /usr/lib*/samba/pdb/*.so mr,
-  /usr/lib*/samba/samba-dcerpcd Px -> samba-dcerpcd,
+  /usr/lib*/samba/{,samba/}samba-dcerpcd Px -> samba-dcerpcd,
   /usr/{bin,sbin}/winbindd mr,
   /var/cache/krb5rcache/* rwk,
   /var/cache/samba/*.tdb rwk,

Places

File samba-4-17.patch of Package apparmor.30574

Places