selinux-policy/strict/domains/program/samba.te

183 lines
5.2 KiB
Plaintext
Raw Normal View History

2005-04-29 17:45:15 +00:00
#DESC SAMBA - SMB file server
#
# Author: Ryan Bergauer (bergauer@rice.edu)
# X-Debian-Packages: samba
#
#################################
#
# Declarations for Samba
#
daemon_domain(smbd, `, auth_chkpwd')
daemon_domain(nmbd)
type samba_etc_t, file_type, sysadmfile, usercanread;
type samba_log_t, file_type, sysadmfile, logfile;
type samba_var_t, file_type, sysadmfile;
type samba_share_t, file_type, sysadmfile, customizable;
type samba_secrets_t, file_type, sysadmfile;
typealias samba_var_t alias samba_spool_t;
# for /var/run/samba/messages.tdb
allow smbd_t nmbd_var_run_t:file rw_file_perms;
allow smbd_t self:process setrlimit;
# not sure why it needs this
tmp_domain(smbd)
ifdef(`crond.te', `
allow system_crond_t samba_etc_t:file { read getattr lock };
allow system_crond_t samba_log_t:file { read getattr lock };
#allow system_crond_t samba_secrets_t:file { read getattr lock };
')
#################################
#
# Rules for the smbd_t domain.
#
# Permissions normally found in every_domain.
general_domain_access(smbd_t)
general_proc_read_access(smbd_t)
type smbd_port_t, port_type, reserved_port_type;
allow smbd_t smbd_port_t:tcp_socket name_bind;
# Use capabilities.
allow smbd_t self:capability { setgid setuid sys_resource net_bind_service lease dac_override dac_read_search };
# Use the network.
can_network_server(smbd_t)
allow smbd_t urandom_device_t:chr_file { getattr read };
# Permissions for Samba files in /etc/samba
# either allow read access to the directory or allow the auto_trans rule to
# allow creation of the secrets.tdb file and the MACHINE.SID file
#allow smbd_t samba_etc_t:dir { search getattr };
file_type_auto_trans(smbd_t, samba_etc_t, samba_secrets_t, file)
allow smbd_t { etc_t samba_etc_t etc_runtime_t }:file r_file_perms;
# Permissions for Samba cache files in /var/cache/samba and /var/lib/samba
allow smbd_t var_lib_t:dir search;
allow smbd_t samba_var_t:dir create_dir_perms;
allow smbd_t samba_var_t:file create_file_perms;
# Permissions to write log files.
allow smbd_t samba_log_t:file { create ra_file_perms };
allow smbd_t var_log_t:dir search;
allow smbd_t samba_log_t:dir ra_dir_perms;
allow smbd_t usr_t:file { getattr read };
# Access Samba shares.
create_dir_file(smbd_t, samba_share_t)
ifdef(`logrotate.te', `
# the application should be changed
can_exec(logrotate_t, samba_log_t)
')
#################################
#
# Rules for the nmbd_t domain.
#
# Permissions normally found in every_domain.
general_domain_access(nmbd_t)
general_proc_read_access(nmbd_t)
type nmbd_port_t, port_type, reserved_port_type;
allow nmbd_t nmbd_port_t:udp_socket name_bind;
# Use capabilities.
allow nmbd_t self:capability net_bind_service;
# Use the network.
can_network_server(nmbd_t)
# Permissions for Samba files in /etc/samba
allow nmbd_t samba_etc_t:file { getattr read };
allow nmbd_t samba_etc_t:dir { search getattr };
# Permissions for Samba cache files in /var/cache/samba
allow nmbd_t samba_var_t:dir { write remove_name add_name lock getattr search };
allow nmbd_t samba_var_t:file { lock unlink create write setattr read getattr rename };
allow nmbd_t usr_t:file { getattr read };
# Permissions to write log files.
allow nmbd_t samba_log_t:file { create ra_file_perms };
allow nmbd_t var_log_t:dir search;
allow nmbd_t samba_log_t:dir ra_dir_perms;
ifdef(`cups.te', `
allow smbd_t cupsd_rw_etc_t:file { getattr read };
')
# Needed for winbindd
allow smbd_t { samba_var_t smbd_var_run_t }:sock_file create_file_perms;
# Support Samba sharing of home directories
bool samba_enable_home_dirs false;
ifdef(`mount.te', `
#
# Domain for running smbmount
#
# Derive from app. domain. Transition from mount.
application_domain(smbmount, `, fs_domain, nscd_client_domain')
domain_auto_trans(mount_t, smbmount_exec_t, smbmount_t)
# Capabilities
# FIXME: is all of this really necessary?
allow smbmount_t self:capability { net_bind_service sys_rawio sys_admin dac_override chown };
# Access samba config
allow smbmount_t samba_etc_t:file r_file_perms;
allow smbmount_t samba_etc_t:dir r_dir_perms;
# Write samba log
allow smbmount_t samba_log_t:file create_file_perms;
allow smbmount_t samba_log_t:dir r_dir_perms;
# Write stuff in var
allow smbmount_t var_log_t:dir r_dir_perms;
rw_dir_create_file(smbmount_t, samba_var_t)
# Access mtab
file_type_auto_trans(smbmount_t, etc_t, etc_runtime_t, file)
# Read nsswitch.conf
allow smbmount_t etc_t:file r_file_perms;
# Networking
can_network(smbmount_t)
can_ypbind(smbmount_t)
allow smbmount_t self:unix_dgram_socket create_socket_perms;
allow smbmount_t self:unix_stream_socket create_socket_perms;
allow kernel_t smbmount_t:tcp_socket { read write };
allow userdomain smbmount_t:tcp_socket write;
# Proc
# FIXME: is this necessary?
r_dir_file(smbmount_t, proc_t)
# Fork smbmnt
allow smbmount_t bin_t:dir r_dir_perms;
can_exec(smbmount_t, smbmount_exec_t)
allow smbmount_t self:process { fork signal_perms };
# Mount
allow smbmount_t cifs_t:filesystem mount_fs_perms;
allow smbmount_t cifs_t:dir r_dir_perms;
allow smbmount_t mnt_t:dir r_dir_perms;
allow smbmount_t mnt_t:dir mounton;
# Terminal
read_locale(smbmount_t)
access_terminal(smbmount_t, sysadm)
allow smbmount_t userdomain:fd use;
allow smbmount_t local_login_t:fd use;
')