29f71f58a2
- Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED operation="file_mmap" violation in SLE15-SP4; (bsc#1192336). OBS-URL: https://build.opensuse.org/request/show/941674 OBS-URL: https://build.opensuse.org/package/show/security:apparmor/apparmor?expand=0&rev=312
63 lines
1.9 KiB
Diff
63 lines
1.9 KiB
Diff
commit 85e53a5d040cdf3f7705da9e625b85041694aa4c
|
|
Author: Christian Boltz <apparmor@cboltz.de>
|
|
Date: Fri Oct 15 22:02:36 2021 +0200
|
|
|
|
Add profile for samba-bgqd
|
|
|
|
... and some rules in the smbd profile to execute it and send it a term
|
|
signal.
|
|
|
|
samba-bgqd is (quoting its manpage) "an internal helper program
|
|
performing asynchronous printing-related jobs."
|
|
|
|
samba-bgqd was added in Samba 4.15.
|
|
|
|
Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1191532
|
|
|
|
Index: apparmor-3.0.3/profiles/apparmor.d/samba-bgqd
|
|
===================================================================
|
|
--- /dev/null
|
|
+++ apparmor-3.0.3/profiles/apparmor.d/samba-bgqd
|
|
@@ -0,0 +1,20 @@
|
|
+abi <abi/3.0>,
|
|
+
|
|
+include <tunables/global>
|
|
+
|
|
+profile samba-bgqd /usr/lib*/samba/samba-bgqd {
|
|
+ include <abstractions/base>
|
|
+ include <abstractions/cups-client>
|
|
+ include <abstractions/nameservice>
|
|
+ include <abstractions/samba>
|
|
+
|
|
+ signal receive set=term peer=smbd,
|
|
+
|
|
+ @{PROC}/sys/kernel/core_pattern r,
|
|
+ @{run}/samba/samba-bgqd.pid wk,
|
|
+
|
|
+ /usr/lib*/samba/samba-bgqd m,
|
|
+
|
|
+ # Site-specific additions and overrides. See local/README for details.
|
|
+ include if exists <local/samba-bgqd>
|
|
+}
|
|
Index: apparmor-3.0.3/profiles/apparmor.d/usr.sbin.smbd
|
|
===================================================================
|
|
--- apparmor-3.0.3.orig/profiles/apparmor.d/usr.sbin.smbd
|
|
+++ apparmor-3.0.3/profiles/apparmor.d/usr.sbin.smbd
|
|
@@ -24,6 +24,8 @@ profile smbd /usr/{bin,sbin}/smbd {
|
|
capability sys_resource,
|
|
capability sys_tty_config,
|
|
|
|
+ signal send set=term peer=samba-bgqd,
|
|
+
|
|
/etc/mtab r,
|
|
/etc/netgroup r,
|
|
/etc/printcap r,
|
|
@@ -35,6 +37,7 @@ profile smbd /usr/{bin,sbin}/smbd {
|
|
/usr/lib*/samba/charset/*.so mr,
|
|
/usr/lib*/samba/gensec/*.so mr,
|
|
/usr/lib*/samba/pdb/*.so mr,
|
|
+ /usr/lib*/samba/samba-bgqd Px -> samba-bgqd,
|
|
/usr/lib*/samba/{lowcase,upcase,valid}.dat r,
|
|
/usr/lib/@{multiarch}/samba/*.so{,.[0-9]*} mr,
|
|
/usr/lib/@{multiarch}/samba/**/ r,
|