## ## SMB and CIFS client/server programs for UNIX and ## name Service Switch daemon for resolving names ## from Windows NT servers. ## ####################################### ## ## The per role template for the samba module. ## ## ##

## This template allows smbd to manage files in ## a user home directory, creating files with the ## correct type. ##

##

## This template is invoked automatically for each user, and ## generally does not need to be invoked directly ## by policy writers. ##

##
## ## ## The prefix of the user domain (e.g., user ## is the prefix for user_t). ## ## # template(`samba_per_role_template',` gen_require(` type smbd_t; ') tunable_policy(`samba_enable_home_dirs',` userdom_manage_user_home_content_dirs($1,smbd_t) userdom_manage_user_home_content_files($1,smbd_t) userdom_manage_user_home_content_symlinks($1,smbd_t) userdom_manage_user_home_content_sockets($1,smbd_t) userdom_manage_user_home_content_pipes($1,smbd_t) userdom_user_home_dir_filetrans_user_home_content($1,smbd_t,{ dir file lnk_file sock_file fifo_file }) ') ') ######################################## ## ## Execute samba net in the samba_net domain. ## ## ## ## The type of the process performing this action. ## ## # interface(`samba_domtrans_net',` gen_require(` type samba_net_t, samba_net_exec_t; ') corecmd_search_bin($1) domtrans_pattern($1,samba_net_exec_t,samba_net_t) ') ######################################## ## ## Execute samba net in the samba_net domain, and ## allow the specified role the samba_net domain. ## ## ## ## The type of the process performing this action. ## ## ## ## ## The role to be allowed the samba_net domain. ## ## ## ## ## The type of the terminal allow the samba_net domain to use. ## ## ## # interface(`samba_run_net',` gen_require(` type samba_net_t; ') samba_domtrans_net($1) role $2 types samba_net_t; allow samba_net_t $3:chr_file rw_term_perms; ') ######################################## ## ## Execute smbmount in the smbmount domain. ## ## ## ## The type of the process performing this action. ## ## # interface(`samba_domtrans_smbmount',` gen_require(` type smbmount_t, smbmount_exec_t; ') corecmd_search_bin($1) domtrans_pattern($1,smbmount_exec_t,smbmount_t) ') ######################################## ## ## Allow the specified domain to read ## samba configuration files. ## ## ## ## Domain allowed access. ## ## ## # interface(`samba_read_config',` gen_require(` type samba_etc_t; ') files_search_etc($1) read_files_pattern($1,samba_etc_t,samba_etc_t) ') ######################################## ## ## Allow the specified domain to read ## and write samba configuration files. ## ## ## ## Domain allowed access. ## ## ## # interface(`samba_rw_config',` gen_require(` type samba_etc_t; ') files_search_etc($1) rw_files_pattern($1,samba_etc_t,samba_etc_t) ') ######################################## ## ## Allow the specified domain to read samba's log files. ## ## ## ## Domain allowed access. ## ## ## # interface(`samba_read_log',` gen_require(` type samba_log_t; ') logging_search_logs($1) allow $1 samba_log_t:dir list_dir_perms; read_files_pattern($1,samba_log_t,samba_log_t) ') ######################################## ## ## Allow the specified domain to append to samba's log files. ## ## ## ## Domain allowed access. ## ## ## # interface(`samba_append_log',` gen_require(` type samba_log_t; ') logging_search_logs($1) allow $1 samba_log_t:dir list_dir_perms; allow $1 samba_log_t:file append_file_perms; ') ######################################## ## ## Execute samba log in the caller domain. ## ## ## ## The type of the process performing this action. ## ## # interface(`samba_exec_log',` gen_require(` type samba_log_t; ') logging_search_logs($1) can_exec($1,samba_log_t) ') ######################################## ## ## Allow the specified domain to read samba's secrets. ## ## ## ## Domain allowed access. ## ## # interface(`samba_read_secrets',` gen_require(` type samba_secrets_t; ') files_search_etc($1) allow $1 samba_secrets_t:file { read getattr lock }; ') ######################################## ## ## Allow the specified domain to search ## samba /var directories. ## ## ## ## Domain allowed access. ## ## # interface(`samba_search_var',` gen_require(` type samba_var_t; ') files_search_var($1) files_search_var_lib($1) allow $1 samba_var_t:dir search_dir_perms; ') ######################################## ## ## Allow the specified domain to ## read samba /var files. ## ## ## ## Domain allowed access. ## ## # interface(`samba_read_var_files',` gen_require(` type samba_var_t; ') files_search_var($1) files_search_var_lib($1) read_files_pattern($1,samba_var_t,samba_var_t) ') ######################################## ## ## Allow the specified domain to ## read and write samba /var files. ## ## ## ## Domain allowed access. ## ## # interface(`samba_rw_var_files',` gen_require(` type samba_var_t; ') files_search_var($1) files_search_var_lib($1) rw_files_pattern($1,samba_var_t,samba_var_t) ') ######################################## ## ## Allow the specified domain to ## read and write samba /var files. ## ## ## ## Domain allowed access. ## ## # interface(`samba_manage_var_files',` gen_require(` type samba_var_t; ') files_search_var($1) files_search_var_lib($1) manage_files_pattern($1,samba_var_t,samba_var_t) ') ######################################## ## ## Do not audit attempts to use file descriptors from samba. ## ## ## ## Domain to not audit. ## ## # interface(`samba_dontaudit_use_fds',` gen_require(` type smbd_t; ') dontaudit $1 smbd_t:fd use; ') ######################################## ## ## Allow the specified domain to write to smbmount tcp sockets. ## ## ## ## Domain allowed access. ## ## # interface(`samba_write_smbmount_tcp_sockets',` gen_require(` type smbmount_t; ') allow $1 smbmount_t:tcp_socket write; ') ######################################## ## ## Allow the specified domain to read and write to smbmount tcp sockets. ## ## ## ## Domain allowed access. ## ## # interface(`samba_rw_smbmount_tcp_sockets',` gen_require(` type smbmount_t; ') allow $1 smbmount_t:tcp_socket { read write }; ') ######################################## ## ## Execute winbind_helper in the winbind_helper domain. ## ## ## ## The type of the process performing this action. ## ## # interface(`samba_domtrans_winbind_helper',` gen_require(` type winbind_helper_t, winbind_helper_exec_t; ') domtrans_pattern($1,winbind_helper_exec_t,winbind_helper_t) ') ######################################## ## ## Execute winbind_helper in the winbind_helper domain, and ## allow the specified role the winbind_helper domain. ## ## ## ## The type of the process performing this action. ## ## ## ## ## The role to be allowed the winbind_helper domain. ## ## ## ## ## The type of the terminal allow the winbind_helper domain to use. ## ## ## # interface(`samba_run_winbind_helper',` gen_require(` type winbind_helper_t; ') samba_domtrans_winbind_helper($1) role $2 types winbind_helper_t; allow winbind_helper_t $3:chr_file rw_term_perms; ') ######################################## ## ## Allow the specified domain to read the winbind pid files. ## ## ## ## Domain allowed access. ## ## # interface(`samba_read_winbind_pid',` gen_require(` type winbind_var_run_t; ') files_search_pids($1) allow $1 winbind_var_run_t:file read_file_perms; ') ######################################## ## ## Connect to winbind. ## ## ## ## Domain allowed access. ## ## # interface(`samba_stream_connect_winbind',` gen_require(` type samba_var_t, winbind_t, winbind_var_run_t; ') files_search_pids($1) allow $1 samba_var_t:dir search_dir_perms; stream_connect_pattern($1,winbind_var_run_t,winbind_var_run_t,winbind_t) ')