#DESC SAMBA - SMB file server # # Author: Ryan Bergauer (bergauer@rice.edu) # X-Debian-Packages: samba # ################################# # # Declarations for Samba # daemon_domain(smbd, `, auth_chkpwd') daemon_domain(nmbd) type samba_etc_t, file_type, sysadmfile, usercanread; type samba_log_t, file_type, sysadmfile, logfile; type samba_var_t, file_type, sysadmfile; type samba_share_t, file_type, sysadmfile, customizable; type samba_secrets_t, file_type, sysadmfile; typealias samba_var_t alias samba_spool_t; # for /var/run/samba/messages.tdb allow smbd_t nmbd_var_run_t:file rw_file_perms; allow smbd_t self:process setrlimit; # not sure why it needs this tmp_domain(smbd) ifdef(`crond.te', ` allow system_crond_t samba_etc_t:file { read getattr lock }; allow system_crond_t samba_log_t:file { read getattr lock }; #allow system_crond_t samba_secrets_t:file { read getattr lock }; ') ################################# # # Rules for the smbd_t domain. # # Permissions normally found in every_domain. general_domain_access(smbd_t) general_proc_read_access(smbd_t) type smbd_port_t, port_type, reserved_port_type; allow smbd_t smbd_port_t:tcp_socket name_bind; # Use capabilities. allow smbd_t self:capability { setgid setuid sys_resource net_bind_service lease dac_override dac_read_search }; # Use the network. can_network_server(smbd_t) allow smbd_t urandom_device_t:chr_file { getattr read }; # Permissions for Samba files in /etc/samba # either allow read access to the directory or allow the auto_trans rule to # allow creation of the secrets.tdb file and the MACHINE.SID file #allow smbd_t samba_etc_t:dir { search getattr }; file_type_auto_trans(smbd_t, samba_etc_t, samba_secrets_t, file) allow smbd_t { etc_t samba_etc_t etc_runtime_t }:file r_file_perms; # Permissions for Samba cache files in /var/cache/samba and /var/lib/samba allow smbd_t var_lib_t:dir search; allow smbd_t samba_var_t:dir create_dir_perms; allow smbd_t samba_var_t:file create_file_perms; # Permissions to write log files. allow smbd_t samba_log_t:file { create ra_file_perms }; allow smbd_t var_log_t:dir search; allow smbd_t samba_log_t:dir ra_dir_perms; allow smbd_t usr_t:file { getattr read }; # Access Samba shares. create_dir_file(smbd_t, samba_share_t) ifdef(`logrotate.te', ` # the application should be changed can_exec(logrotate_t, samba_log_t) ') ################################# # # Rules for the nmbd_t domain. # # Permissions normally found in every_domain. general_domain_access(nmbd_t) general_proc_read_access(nmbd_t) type nmbd_port_t, port_type, reserved_port_type; allow nmbd_t nmbd_port_t:udp_socket name_bind; # Use capabilities. allow nmbd_t self:capability net_bind_service; # Use the network. can_network_server(nmbd_t) # Permissions for Samba files in /etc/samba allow nmbd_t samba_etc_t:file { getattr read }; allow nmbd_t samba_etc_t:dir { search getattr }; # Permissions for Samba cache files in /var/cache/samba allow nmbd_t samba_var_t:dir { write remove_name add_name lock getattr search }; allow nmbd_t samba_var_t:file { lock unlink create write setattr read getattr rename }; allow nmbd_t usr_t:file { getattr read }; # Permissions to write log files. allow nmbd_t samba_log_t:file { create ra_file_perms }; allow nmbd_t var_log_t:dir search; allow nmbd_t samba_log_t:dir ra_dir_perms; ifdef(`cups.te', ` allow smbd_t cupsd_rw_etc_t:file { getattr read }; ') # Needed for winbindd allow smbd_t { samba_var_t smbd_var_run_t }:sock_file create_file_perms; # Support Samba sharing of home directories bool samba_enable_home_dirs false; ifdef(`mount.te', ` # # Domain for running smbmount # # Derive from app. domain. Transition from mount. application_domain(smbmount, `, fs_domain, nscd_client_domain') domain_auto_trans(mount_t, smbmount_exec_t, smbmount_t) # Capabilities # FIXME: is all of this really necessary? allow smbmount_t self:capability { net_bind_service sys_rawio sys_admin dac_override chown }; # Access samba config allow smbmount_t samba_etc_t:file r_file_perms; allow smbmount_t samba_etc_t:dir r_dir_perms; # Write samba log allow smbmount_t samba_log_t:file create_file_perms; allow smbmount_t samba_log_t:dir r_dir_perms; # Write stuff in var allow smbmount_t var_log_t:dir r_dir_perms; rw_dir_create_file(smbmount_t, samba_var_t) # Access mtab file_type_auto_trans(smbmount_t, etc_t, etc_runtime_t, file) # Read nsswitch.conf allow smbmount_t etc_t:file r_file_perms; # Networking can_network(smbmount_t) can_ypbind(smbmount_t) allow smbmount_t self:unix_dgram_socket create_socket_perms; allow smbmount_t self:unix_stream_socket create_socket_perms; allow kernel_t smbmount_t:tcp_socket { read write }; allow userdomain smbmount_t:tcp_socket write; # Proc # FIXME: is this necessary? r_dir_file(smbmount_t, proc_t) # Fork smbmnt allow smbmount_t bin_t:dir r_dir_perms; can_exec(smbmount_t, smbmount_exec_t) allow smbmount_t self:process { fork signal_perms }; # Mount allow smbmount_t cifs_t:filesystem mount_fs_perms; allow smbmount_t cifs_t:dir r_dir_perms; allow smbmount_t mnt_t:dir r_dir_perms; allow smbmount_t mnt_t:dir mounton; # Terminal read_locale(smbmount_t) access_terminal(smbmount_t, sysadm) allow smbmount_t userdomain:fd use; allow smbmount_t local_login_t:fd use; ')