1 policy_module(samba, 1.13.0)
3 #################################
10 ## Allow samba to modify public files used for public file
11 ## transfer services. Files/Directories must be labeled
12 ## public_content_rw_t.
15 gen_tunable(allow_smbd_anon_write, false)
19 ## Allow samba to create new home directories (e.g. via PAM)
22 gen_tunable(samba_create_home_dirs, false)
26 ## Allow samba to act as the domain controller, add users,
27 ## groups and change passwords.
31 gen_tunable(samba_domain_controller, false)
35 ## Allow samba to share users home directories.
38 gen_tunable(samba_enable_home_dirs, false)
42 ## Allow samba to share any file/directory read only.
45 gen_tunable(samba_export_all_ro, false)
49 ## Allow samba to share any file/directory read/write.
52 gen_tunable(samba_export_all_rw, false)
56 ## Allow samba to run unconfined scripts
59 gen_tunable(samba_run_unconfined, false)
63 ## Allow samba to export NFS volumes.
66 gen_tunable(samba_share_nfs, false)
70 ## Allow samba to export ntfs/fusefs volumes.
73 gen_tunable(samba_share_fusefs, false)
77 init_daemon_domain(nmbd_t, nmbd_exec_t)
80 files_pid_file(nmbd_var_run_t)
83 files_config_file(samba_etc_t)
85 type samba_initrc_exec_t;
86 init_script_file(samba_initrc_exec_t)
89 logging_log_file(samba_log_t)
92 type samba_net_exec_t;
93 application_domain(samba_net_t, samba_net_exec_t)
94 role system_r types samba_net_t;
97 files_tmp_file(samba_net_tmp_t)
100 files_type(samba_secrets_t)
102 type samba_share_t; # customizable
103 files_type(samba_share_t)
106 files_type(samba_var_t)
109 type smbcontrol_exec_t;
110 application_domain(smbcontrol_t, smbcontrol_exec_t)
111 role system_r types smbcontrol_t;
115 init_daemon_domain(smbd_t, smbd_exec_t)
118 files_tmp_file(smbd_tmp_t)
121 files_pid_file(smbd_var_run_t)
124 domain_type(smbmount_t)
126 type smbmount_exec_t;
127 domain_entry_file(smbmount_t, smbmount_exec_t)
132 domain_entry_file(swat_t, swat_exec_t)
133 role system_r types swat_t;
136 files_tmp_file(swat_tmp_t)
139 files_pid_file(swat_var_run_t)
143 init_daemon_domain(winbind_t, winbind_exec_t)
145 type winbind_helper_t;
146 domain_type(winbind_helper_t)
147 role system_r types winbind_helper_t;
149 type winbind_helper_exec_t;
150 domain_entry_file(winbind_helper_t, winbind_helper_exec_t)
153 logging_log_file(winbind_log_t)
156 files_tmp_file(winbind_tmp_t)
158 type winbind_var_run_t;
159 files_pid_file(winbind_var_run_t)
161 ########################################
163 # Samba net local policy
165 allow samba_net_t self:capability { sys_chroot sys_nice dac_read_search dac_override };
166 allow samba_net_t self:process { getsched setsched };
167 allow samba_net_t self:unix_dgram_socket create_socket_perms;
168 allow samba_net_t self:unix_stream_socket create_stream_socket_perms;
169 allow samba_net_t self:udp_socket create_socket_perms;
170 allow samba_net_t self:tcp_socket create_socket_perms;
172 allow samba_net_t samba_etc_t:file read_file_perms;
174 manage_files_pattern(samba_net_t, samba_etc_t, samba_secrets_t)
175 filetrans_pattern(samba_net_t, samba_etc_t, samba_secrets_t, file)
177 manage_dirs_pattern(samba_net_t, samba_net_tmp_t, samba_net_tmp_t)
178 manage_files_pattern(samba_net_t, samba_net_tmp_t, samba_net_tmp_t)
179 files_tmp_filetrans(samba_net_t, samba_net_tmp_t, { file dir })
181 manage_dirs_pattern(samba_net_t, samba_var_t, samba_var_t)
182 manage_files_pattern(samba_net_t, samba_var_t, samba_var_t)
183 manage_lnk_files_pattern(samba_net_t, samba_var_t, samba_var_t)
185 kernel_read_proc_symlinks(samba_net_t)
186 kernel_read_system_state(samba_net_t)
188 corenet_all_recvfrom_unlabeled(samba_net_t)
189 corenet_all_recvfrom_netlabel(samba_net_t)
190 corenet_tcp_sendrecv_generic_if(samba_net_t)
191 corenet_udp_sendrecv_generic_if(samba_net_t)
192 corenet_raw_sendrecv_generic_if(samba_net_t)
193 corenet_tcp_sendrecv_generic_node(samba_net_t)
194 corenet_udp_sendrecv_generic_node(samba_net_t)
195 corenet_raw_sendrecv_generic_node(samba_net_t)
196 corenet_tcp_sendrecv_all_ports(samba_net_t)
197 corenet_udp_sendrecv_all_ports(samba_net_t)
198 corenet_tcp_bind_generic_node(samba_net_t)
199 corenet_udp_bind_generic_node(samba_net_t)
200 corenet_tcp_connect_smbd_port(samba_net_t)
202 dev_read_urand(samba_net_t)
204 domain_use_interactive_fds(samba_net_t)
206 files_read_etc_files(samba_net_t)
207 files_read_usr_symlinks(samba_net_t)
209 auth_use_nsswitch(samba_net_t)
210 auth_manage_cache(samba_net_t)
212 logging_send_syslog_msg(samba_net_t)
214 miscfiles_read_localization(samba_net_t)
216 samba_read_var_files(samba_net_t)
218 userdom_use_user_terminals(samba_net_t)
219 userdom_list_user_home_dirs(samba_net_t)
222 pcscd_read_pub_files(samba_net_t)
226 kerberos_use(samba_net_t)
229 ########################################
233 allow smbd_t self:capability { chown fowner setgid setuid sys_nice sys_resource lease dac_override dac_read_search };
234 dontaudit smbd_t self:capability sys_tty_config;
235 allow smbd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
236 allow smbd_t self:process setrlimit;
237 allow smbd_t self:fd use;
238 allow smbd_t self:fifo_file rw_fifo_file_perms;
239 allow smbd_t self:msg { send receive };
240 allow smbd_t self:msgq create_msgq_perms;
241 allow smbd_t self:sem create_sem_perms;
242 allow smbd_t self:shm create_shm_perms;
243 allow smbd_t self:sock_file read_sock_file_perms;
244 allow smbd_t self:tcp_socket create_stream_socket_perms;
245 allow smbd_t self:udp_socket create_socket_perms;
246 allow smbd_t self:unix_dgram_socket { create_socket_perms sendto };
247 allow smbd_t self:unix_stream_socket { create_stream_socket_perms connectto };
249 allow smbd_t nmbd_t:process { signal signull };
251 allow smbd_t nmbd_var_run_t:file rw_file_perms;
253 allow smbd_t samba_etc_t:file { rw_file_perms setattr };
255 manage_dirs_pattern(smbd_t, samba_log_t, samba_log_t)
256 manage_files_pattern(smbd_t, samba_log_t, samba_log_t)
258 allow smbd_t samba_net_tmp_t:file getattr;
260 manage_files_pattern(smbd_t, samba_secrets_t, samba_secrets_t)
261 filetrans_pattern(smbd_t, samba_etc_t, samba_secrets_t, file)
263 manage_dirs_pattern(smbd_t, samba_share_t, samba_share_t)
264 manage_files_pattern(smbd_t, samba_share_t, samba_share_t)
265 manage_lnk_files_pattern(smbd_t, samba_share_t, samba_share_t)
266 allow smbd_t samba_share_t:filesystem getattr;
268 manage_dirs_pattern(smbd_t, samba_var_t, samba_var_t)
269 manage_files_pattern(smbd_t, samba_var_t, samba_var_t)
270 manage_lnk_files_pattern(smbd_t, samba_var_t, samba_var_t)
271 manage_sock_files_pattern(smbd_t, samba_var_t, samba_var_t)
273 allow smbd_t smbcontrol_t:process { signal signull };
275 manage_dirs_pattern(smbd_t, smbd_tmp_t, smbd_tmp_t)
276 manage_files_pattern(smbd_t, smbd_tmp_t, smbd_tmp_t)
277 files_tmp_filetrans(smbd_t, smbd_tmp_t, { file dir })
279 manage_dirs_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t)
280 manage_files_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t)
281 manage_sock_files_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t)
282 files_pid_filetrans(smbd_t, smbd_var_run_t, file)
284 allow smbd_t swat_t:process signal;
286 allow smbd_t winbind_var_run_t:sock_file rw_sock_file_perms;
288 allow smbd_t winbind_t:process { signal signull };
290 kernel_getattr_core_if(smbd_t)
291 kernel_getattr_message_if(smbd_t)
292 kernel_read_network_state(smbd_t)
293 kernel_read_fs_sysctls(smbd_t)
294 kernel_read_kernel_sysctls(smbd_t)
295 kernel_read_software_raid_state(smbd_t)
296 kernel_read_system_state(smbd_t)
298 corecmd_exec_shell(smbd_t)
299 corecmd_exec_bin(smbd_t)
301 corenet_all_recvfrom_unlabeled(smbd_t)
302 corenet_all_recvfrom_netlabel(smbd_t)
303 corenet_tcp_sendrecv_generic_if(smbd_t)
304 corenet_udp_sendrecv_generic_if(smbd_t)
305 corenet_raw_sendrecv_generic_if(smbd_t)
306 corenet_tcp_sendrecv_generic_node(smbd_t)
307 corenet_udp_sendrecv_generic_node(smbd_t)
308 corenet_raw_sendrecv_generic_node(smbd_t)
309 corenet_tcp_sendrecv_all_ports(smbd_t)
310 corenet_udp_sendrecv_all_ports(smbd_t)
311 corenet_tcp_bind_generic_node(smbd_t)
312 corenet_udp_bind_generic_node(smbd_t)
313 corenet_tcp_bind_smbd_port(smbd_t)
314 corenet_tcp_connect_ipp_port(smbd_t)
315 corenet_tcp_connect_smbd_port(smbd_t)
317 dev_read_sysfs(smbd_t)
318 dev_read_urand(smbd_t)
319 dev_getattr_mtrr_dev(smbd_t)
320 dev_dontaudit_getattr_usbfs_dirs(smbd_t)
321 # For redhat bug 566984
322 dev_getattr_all_blk_files(smbd_t)
323 dev_getattr_all_chr_files(smbd_t)
325 fs_getattr_all_fs(smbd_t)
326 fs_get_xattr_fs_quotas(smbd_t)
327 fs_search_auto_mountpoints(smbd_t)
328 fs_getattr_rpc_dirs(smbd_t)
329 fs_list_inotifyfs(smbd_t)
331 auth_use_nsswitch(smbd_t)
332 auth_domtrans_chk_passwd(smbd_t)
333 auth_domtrans_upd_passwd(smbd_t)
334 auth_manage_cache(smbd_t)
336 domain_use_interactive_fds(smbd_t)
337 domain_dontaudit_list_all_domains_state(smbd_t)
339 files_list_var_lib(smbd_t)
340 files_read_etc_files(smbd_t)
341 files_read_etc_runtime_files(smbd_t)
342 files_read_usr_files(smbd_t)
343 files_search_spool(smbd_t)
344 # smbd seems to getattr all mountpoints
345 files_dontaudit_getattr_all_dirs(smbd_t)
346 # Allow samba to list mnt_t for potential mounted dirs
347 files_list_mnt(smbd_t)
351 logging_search_logs(smbd_t)
352 logging_send_syslog_msg(smbd_t)
354 miscfiles_read_localization(smbd_t)
355 miscfiles_read_public_files(smbd_t)
357 userdom_use_unpriv_users_fds(smbd_t)
358 userdom_search_user_home_content(smbd_t)
359 userdom_signal_all_users(smbd_t)
361 usermanage_read_crack_db(smbd_t)
363 term_use_ptmx(smbd_t)
365 ifdef(`hide_broken_symptoms', `
366 files_dontaudit_getattr_default_dirs(smbd_t)
367 files_dontaudit_getattr_boot_dirs(smbd_t)
368 fs_dontaudit_getattr_tmpfs_dirs(smbd_t)
371 tunable_policy(`allow_smbd_anon_write',`
372 miscfiles_manage_public_files(smbd_t)
375 tunable_policy(`samba_domain_controller',`
380 usermanage_domtrans_passwd(smbd_t)
381 usermanage_kill_passwd(smbd_t)
382 usermanage_domtrans_useradd(smbd_t)
383 usermanage_domtrans_groupadd(smbd_t)
384 allow smbd_t self:passwd passwd;
387 tunable_policy(`samba_enable_home_dirs',`
388 userdom_manage_user_home_content_dirs(smbd_t)
389 userdom_manage_user_home_content_files(smbd_t)
390 userdom_manage_user_home_content_symlinks(smbd_t)
391 userdom_manage_user_home_content_sockets(smbd_t)
392 userdom_manage_user_home_content_pipes(smbd_t)
393 userdom_user_home_dir_filetrans_user_home_content(smbd_t, { dir file lnk_file sock_file fifo_file })
396 # Support Samba sharing of NFS mount points
397 tunable_policy(`samba_share_nfs',`
398 fs_manage_nfs_dirs(smbd_t)
399 fs_manage_nfs_files(smbd_t)
400 fs_manage_nfs_symlinks(smbd_t)
401 fs_manage_nfs_named_pipes(smbd_t)
402 fs_manage_nfs_named_sockets(smbd_t)
405 # Support Samba sharing of ntfs/fusefs mount points
406 tunable_policy(`samba_share_fusefs',`
407 fs_manage_fusefs_dirs(smbd_t)
408 fs_manage_fusefs_files(smbd_t)
410 fs_search_fusefs(smbd_t)
415 cups_read_rw_config(smbd_t)
416 cups_stream_connect(smbd_t)
421 kerberos_keytab_template(smbd, smbd_t)
429 qemu_manage_tmp_dirs(smbd_t)
430 qemu_manage_tmp_files(smbd_t)
434 rpc_search_nfs_state_data(smbd_t)
438 seutil_sigchld_newrole(smbd_t)
445 tunable_policy(`samba_create_home_dirs',`
446 allow smbd_t self:capability chown;
447 userdom_create_user_home_dirs(smbd_t)
448 userdom_home_filetrans_user_home_dir(smbd_t)
451 tunable_policy(`samba_export_all_ro',`
452 fs_read_noxattr_fs_files(smbd_t)
453 auth_read_all_dirs_except_shadow(smbd_t)
454 auth_read_all_files_except_shadow(smbd_t)
455 fs_read_noxattr_fs_files(nmbd_t)
456 auth_read_all_dirs_except_shadow(nmbd_t)
457 auth_read_all_files_except_shadow(nmbd_t)
460 tunable_policy(`samba_export_all_rw',`
461 fs_read_noxattr_fs_files(smbd_t)
462 auth_manage_all_files_except_shadow(smbd_t)
463 fs_read_noxattr_fs_files(nmbd_t)
464 auth_manage_all_files_except_shadow(nmbd_t)
465 userdom_user_home_dir_filetrans_user_home_content(nmbd_t, { file dir })
468 ########################################
473 dontaudit nmbd_t self:capability sys_tty_config;
474 allow nmbd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
475 allow nmbd_t self:fd use;
476 allow nmbd_t self:fifo_file rw_fifo_file_perms;
477 allow nmbd_t self:msg { send receive };
478 allow nmbd_t self:msgq create_msgq_perms;
479 allow nmbd_t self:sem create_sem_perms;
480 allow nmbd_t self:shm create_shm_perms;
481 allow nmbd_t self:sock_file read_sock_file_perms;
482 allow nmbd_t self:tcp_socket create_stream_socket_perms;
483 allow nmbd_t self:udp_socket create_socket_perms;
484 allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto };
485 allow nmbd_t self:unix_stream_socket { create_stream_socket_perms connectto };
487 manage_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t)
488 files_pid_filetrans(nmbd_t, nmbd_var_run_t, file)
490 read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
491 read_lnk_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
493 manage_dirs_pattern(nmbd_t, samba_log_t, samba_log_t)
494 manage_files_pattern(nmbd_t, samba_log_t, samba_log_t)
496 manage_files_pattern(nmbd_t, samba_var_t, samba_var_t)
498 allow nmbd_t smbcontrol_t:process signal;
500 allow nmbd_t smbd_var_run_t:dir rw_dir_perms;
502 kernel_getattr_core_if(nmbd_t)
503 kernel_getattr_message_if(nmbd_t)
504 kernel_read_kernel_sysctls(nmbd_t)
505 kernel_read_network_state(nmbd_t)
506 kernel_read_software_raid_state(nmbd_t)
507 kernel_read_system_state(nmbd_t)
509 corenet_all_recvfrom_unlabeled(nmbd_t)
510 corenet_all_recvfrom_netlabel(nmbd_t)
511 corenet_tcp_sendrecv_generic_if(nmbd_t)
512 corenet_udp_sendrecv_generic_if(nmbd_t)
513 corenet_tcp_sendrecv_generic_node(nmbd_t)
514 corenet_udp_sendrecv_generic_node(nmbd_t)
515 corenet_tcp_sendrecv_all_ports(nmbd_t)
516 corenet_udp_sendrecv_all_ports(nmbd_t)
517 corenet_udp_bind_generic_node(nmbd_t)
518 corenet_udp_bind_nmbd_port(nmbd_t)
519 corenet_sendrecv_nmbd_server_packets(nmbd_t)
520 corenet_sendrecv_nmbd_client_packets(nmbd_t)
521 corenet_tcp_connect_smbd_port(nmbd_t)
523 dev_read_sysfs(nmbd_t)
524 dev_getattr_mtrr_dev(nmbd_t)
526 fs_getattr_all_fs(nmbd_t)
527 fs_search_auto_mountpoints(nmbd_t)
529 domain_use_interactive_fds(nmbd_t)
531 files_read_usr_files(nmbd_t)
532 files_read_etc_files(nmbd_t)
533 files_list_var_lib(nmbd_t)
535 auth_use_nsswitch(nmbd_t)
537 logging_search_logs(nmbd_t)
538 logging_send_syslog_msg(nmbd_t)
540 miscfiles_read_localization(nmbd_t)
542 userdom_use_unpriv_users_fds(nmbd_t)
543 userdom_dontaudit_search_user_home_dirs(nmbd_t)
546 seutil_sigchld_newrole(nmbd_t)
553 ########################################
555 # smbcontrol local policy
558 # internal communication is often done using fifo and unix sockets.
559 allow smbcontrol_t self:fifo_file rw_file_perms;
560 allow smbcontrol_t self:unix_stream_socket create_stream_socket_perms;
562 allow smbcontrol_t nmbd_t:process { signal signull };
564 allow smbcontrol_t nmbd_var_run_t:file { read lock };
566 allow smbcontrol_t smbd_t:process signal;
568 allow smbcontrol_t winbind_t:process { signal signull };
570 samba_read_config(smbcontrol_t)
571 samba_rw_var_files(smbcontrol_t)
572 samba_search_var(smbcontrol_t)
573 samba_read_winbind_pid(smbcontrol_t)
575 domain_use_interactive_fds(smbcontrol_t)
577 files_read_etc_files(smbcontrol_t)
579 miscfiles_read_localization(smbcontrol_t)
581 userdom_use_user_terminals(smbcontrol_t)
583 ########################################
585 # smbmount Local policy
588 allow smbmount_t self:capability { sys_rawio sys_admin dac_override chown }; # FIXME: is all of this really necessary?
589 allow smbmount_t self:process { fork signal_perms };
590 allow smbmount_t self:tcp_socket create_stream_socket_perms;
591 allow smbmount_t self:udp_socket connect;
592 allow smbmount_t self:unix_dgram_socket create_socket_perms;
593 allow smbmount_t self:unix_stream_socket create_socket_perms;
595 allow smbmount_t samba_etc_t:dir list_dir_perms;
596 allow smbmount_t samba_etc_t:file read_file_perms;
598 can_exec(smbmount_t, smbmount_exec_t)
600 allow smbmount_t samba_log_t:dir list_dir_perms;
601 allow smbmount_t samba_log_t:file manage_file_perms;
603 allow smbmount_t samba_secrets_t:file manage_file_perms;
605 manage_files_pattern(smbmount_t, samba_var_t, samba_var_t)
606 manage_lnk_files_pattern(smbmount_t, samba_var_t, samba_var_t)
607 files_list_var_lib(smbmount_t)
609 kernel_read_system_state(smbmount_t)
611 corenet_all_recvfrom_unlabeled(smbmount_t)
612 corenet_all_recvfrom_netlabel(smbmount_t)
613 corenet_tcp_sendrecv_generic_if(smbmount_t)
614 corenet_raw_sendrecv_generic_if(smbmount_t)
615 corenet_udp_sendrecv_generic_if(smbmount_t)
616 corenet_tcp_sendrecv_generic_node(smbmount_t)
617 corenet_raw_sendrecv_generic_node(smbmount_t)
618 corenet_udp_sendrecv_generic_node(smbmount_t)
619 corenet_tcp_sendrecv_all_ports(smbmount_t)
620 corenet_udp_sendrecv_all_ports(smbmount_t)
621 corenet_tcp_bind_generic_node(smbmount_t)
622 corenet_udp_bind_generic_node(smbmount_t)
623 corenet_tcp_connect_all_ports(smbmount_t)
625 fs_getattr_cifs(smbmount_t)
626 fs_mount_cifs(smbmount_t)
627 fs_remount_cifs(smbmount_t)
628 fs_unmount_cifs(smbmount_t)
629 fs_list_cifs(smbmount_t)
630 fs_read_cifs_files(smbmount_t)
632 storage_raw_read_fixed_disk(smbmount_t)
633 storage_raw_write_fixed_disk(smbmount_t)
635 corecmd_list_bin(smbmount_t)
637 files_list_mnt(smbmount_t)
638 files_mounton_mnt(smbmount_t)
639 files_manage_etc_runtime_files(smbmount_t)
640 files_etc_filetrans_etc_runtime(smbmount_t, file)
641 files_read_etc_files(smbmount_t)
643 auth_use_nsswitch(smbmount_t)
645 miscfiles_read_localization(smbmount_t)
647 mount_use_fds(smbmount_t)
649 locallogin_use_fds(smbmount_t)
651 logging_search_logs(smbmount_t)
653 userdom_use_user_terminals(smbmount_t)
654 userdom_use_all_users_fds(smbmount_t)
657 cups_read_rw_config(smbmount_t)
660 ########################################
665 allow swat_t self:capability { dac_override setuid setgid sys_resource };
666 allow swat_t self:process { setrlimit signal_perms };
667 allow swat_t self:fifo_file rw_fifo_file_perms;
668 allow swat_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
669 allow swat_t self:tcp_socket create_stream_socket_perms;
670 allow swat_t self:udp_socket create_socket_perms;
671 allow swat_t self:unix_stream_socket connectto;
673 samba_domtrans_smbd(swat_t)
674 allow swat_t smbd_t:process { signal signull };
676 samba_domtrans_nmbd(swat_t)
677 allow swat_t nmbd_t:process { signal signull };
678 allow nmbd_t swat_t:process signal;
680 allow swat_t smbd_var_run_t:file { lock unlink };
682 allow swat_t smbd_port_t:tcp_socket name_bind;
684 allow swat_t nmbd_port_t:udp_socket name_bind;
686 rw_files_pattern(swat_t, samba_etc_t, samba_etc_t)
687 read_lnk_files_pattern(swat_t, samba_etc_t, samba_etc_t)
689 manage_dirs_pattern(swat_t, samba_log_t, samba_log_t)
690 manage_files_pattern(swat_t, samba_log_t, samba_log_t)
692 manage_files_pattern(swat_t, samba_etc_t, samba_secrets_t)
694 manage_files_pattern(swat_t, samba_var_t, samba_var_t)
696 allow swat_t smbd_exec_t:file mmap_file_perms ;
698 allow swat_t smbd_t:process signull;
700 allow swat_t smbd_var_run_t:file read_file_perms;
702 manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t)
703 manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t)
704 files_tmp_filetrans(swat_t, swat_tmp_t, { file dir })
706 manage_files_pattern(swat_t, swat_var_run_t, swat_var_run_t)
707 files_pid_filetrans(swat_t, swat_var_run_t, file)
709 allow swat_t winbind_exec_t:file mmap_file_perms;
710 domtrans_pattern(swat_t, winbind_exec_t, winbind_t)
711 allow swat_t winbind_t:process { signal signull };
713 allow swat_t winbind_var_run_t:dir { write add_name remove_name };
714 allow swat_t winbind_var_run_t:sock_file { create unlink };
716 kernel_read_kernel_sysctls(swat_t)
717 kernel_read_system_state(swat_t)
718 kernel_read_network_state(swat_t)
720 corecmd_search_bin(swat_t)
722 corenet_all_recvfrom_unlabeled(swat_t)
723 corenet_all_recvfrom_netlabel(swat_t)
724 corenet_tcp_sendrecv_generic_if(swat_t)
725 corenet_udp_sendrecv_generic_if(swat_t)
726 corenet_raw_sendrecv_generic_if(swat_t)
727 corenet_tcp_sendrecv_generic_node(swat_t)
728 corenet_udp_sendrecv_generic_node(swat_t)
729 corenet_raw_sendrecv_generic_node(swat_t)
730 corenet_tcp_sendrecv_all_ports(swat_t)
731 corenet_udp_sendrecv_all_ports(swat_t)
732 corenet_tcp_connect_smbd_port(swat_t)
733 corenet_tcp_connect_ipp_port(swat_t)
734 corenet_sendrecv_smbd_client_packets(swat_t)
735 corenet_sendrecv_ipp_client_packets(swat_t)
737 dev_read_urand(swat_t)
739 files_list_var_lib(swat_t)
740 files_read_etc_files(swat_t)
741 files_search_home(swat_t)
742 files_read_usr_files(swat_t)
743 fs_getattr_xattr_fs(swat_t)
745 auth_domtrans_chk_passwd(swat_t)
746 auth_use_nsswitch(swat_t)
748 init_read_utmp(swat_t)
749 init_dontaudit_write_utmp(swat_t)
751 logging_send_syslog_msg(swat_t)
752 logging_send_audit_msgs(swat_t)
753 logging_search_logs(swat_t)
755 miscfiles_read_localization(swat_t)
758 cups_read_rw_config(swat_t)
759 cups_stream_connect(swat_t)
763 inetd_service_domain(swat_t, swat_exec_t)
770 ########################################
772 # Winbind local policy
775 allow winbind_t self:capability { dac_override ipc_lock setuid sys_nice };
776 dontaudit winbind_t self:capability sys_tty_config;
777 allow winbind_t self:process { signal_perms getsched setsched };
778 allow winbind_t self:fifo_file rw_fifo_file_perms;
779 allow winbind_t self:unix_dgram_socket create_socket_perms;
780 allow winbind_t self:unix_stream_socket create_stream_socket_perms;
781 allow winbind_t self:tcp_socket create_stream_socket_perms;
782 allow winbind_t self:udp_socket create_socket_perms;
784 allow winbind_t nmbd_t:process { signal signull };
786 allow winbind_t nmbd_var_run_t:file read_file_perms;
788 allow winbind_t samba_etc_t:dir list_dir_perms;
789 read_files_pattern(winbind_t, samba_etc_t, samba_etc_t)
790 read_lnk_files_pattern(winbind_t, samba_etc_t, samba_etc_t)
792 manage_files_pattern(winbind_t, samba_etc_t, samba_secrets_t)
793 filetrans_pattern(winbind_t, samba_etc_t, samba_secrets_t, file)
795 manage_dirs_pattern(winbind_t, samba_log_t, samba_log_t)
796 manage_files_pattern(winbind_t, samba_log_t, samba_log_t)
797 manage_lnk_files_pattern(winbind_t, samba_log_t, samba_log_t)
799 manage_dirs_pattern(winbind_t, samba_var_t, samba_var_t)
800 manage_files_pattern(winbind_t, samba_var_t, samba_var_t)
801 manage_lnk_files_pattern(winbind_t, samba_var_t, samba_var_t)
802 files_list_var_lib(winbind_t)
804 rw_files_pattern(winbind_t, smbd_tmp_t, smbd_tmp_t)
806 allow winbind_t winbind_log_t:file manage_file_perms;
807 logging_log_filetrans(winbind_t, winbind_log_t, file)
809 manage_dirs_pattern(winbind_t, winbind_tmp_t, winbind_tmp_t)
810 manage_files_pattern(winbind_t, winbind_tmp_t, winbind_tmp_t)
811 manage_sock_files_pattern(winbind_t, winbind_tmp_t, winbind_tmp_t)
812 files_tmp_filetrans(winbind_t, winbind_tmp_t, { file dir })
814 manage_files_pattern(winbind_t, winbind_var_run_t, winbind_var_run_t)
815 manage_sock_files_pattern(winbind_t, winbind_var_run_t, winbind_var_run_t)
816 files_pid_filetrans(winbind_t, winbind_var_run_t, file)
818 kernel_read_kernel_sysctls(winbind_t)
819 kernel_read_system_state(winbind_t)
821 corecmd_exec_bin(winbind_t)
823 corenet_all_recvfrom_unlabeled(winbind_t)
824 corenet_all_recvfrom_netlabel(winbind_t)
825 corenet_tcp_sendrecv_generic_if(winbind_t)
826 corenet_udp_sendrecv_generic_if(winbind_t)
827 corenet_raw_sendrecv_generic_if(winbind_t)
828 corenet_tcp_sendrecv_generic_node(winbind_t)
829 corenet_udp_sendrecv_generic_node(winbind_t)
830 corenet_raw_sendrecv_generic_node(winbind_t)
831 corenet_tcp_sendrecv_all_ports(winbind_t)
832 corenet_udp_sendrecv_all_ports(winbind_t)
833 corenet_tcp_bind_generic_node(winbind_t)
834 corenet_udp_bind_generic_node(winbind_t)
835 corenet_tcp_connect_smbd_port(winbind_t)
836 corenet_tcp_connect_epmap_port(winbind_t)
837 corenet_tcp_connect_all_unreserved_ports(winbind_t)
839 dev_read_sysfs(winbind_t)
840 dev_read_urand(winbind_t)
842 fs_getattr_all_fs(winbind_t)
843 fs_search_auto_mountpoints(winbind_t)
845 auth_domtrans_chk_passwd(winbind_t)
846 auth_use_nsswitch(winbind_t)
847 auth_manage_cache(winbind_t)
849 domain_use_interactive_fds(winbind_t)
851 files_read_etc_files(winbind_t)
852 files_read_usr_symlinks(winbind_t)
854 logging_send_syslog_msg(winbind_t)
856 miscfiles_read_localization(winbind_t)
858 userdom_dontaudit_use_unpriv_user_fds(winbind_t)
859 userdom_manage_user_home_content_dirs(winbind_t)
860 userdom_manage_user_home_content_files(winbind_t)
861 userdom_manage_user_home_content_symlinks(winbind_t)
862 userdom_manage_user_home_content_pipes(winbind_t)
863 userdom_manage_user_home_content_sockets(winbind_t)
864 userdom_user_home_dir_filetrans_user_home_content(winbind_t, { dir file lnk_file fifo_file sock_file })
867 kerberos_use(winbind_t)
871 seutil_sigchld_newrole(winbind_t)
875 udev_read_db(winbind_t)
878 ########################################
880 # Winbind helper local policy
883 allow winbind_helper_t self:unix_dgram_socket create_socket_perms;
884 allow winbind_helper_t self:unix_stream_socket create_stream_socket_perms;
886 allow winbind_helper_t samba_etc_t:dir list_dir_perms;
887 read_files_pattern(winbind_helper_t, samba_etc_t, samba_etc_t)
888 read_lnk_files_pattern(winbind_helper_t, samba_etc_t, samba_etc_t)
890 allow winbind_helper_t samba_var_t:dir search_dir_perms;
891 files_list_var_lib(winbind_helper_t)
893 allow winbind_t smbcontrol_t:process signal;
895 stream_connect_pattern(winbind_helper_t, winbind_var_run_t, winbind_var_run_t, winbind_t)
897 term_list_ptys(winbind_helper_t)
899 domain_use_interactive_fds(winbind_helper_t)
901 auth_use_nsswitch(winbind_helper_t)
903 logging_send_syslog_msg(winbind_helper_t)
905 miscfiles_read_localization(winbind_helper_t)
907 userdom_use_user_terminals(winbind_helper_t)
910 apache_append_log(winbind_helper_t)
914 squid_read_log(winbind_helper_t)
915 squid_append_log(winbind_helper_t)
916 squid_rw_stream_sockets(winbind_helper_t)
919 ########################################
921 # samba_unconfined_script_t local policy
925 type samba_unconfined_script_t;
926 type samba_unconfined_script_exec_t;
927 domain_type(samba_unconfined_script_t)
928 domain_entry_file(samba_unconfined_script_t, samba_unconfined_script_exec_t)
929 corecmd_shell_entry_type(samba_unconfined_script_t)
930 role system_r types samba_unconfined_script_t;
932 allow smbd_t samba_unconfined_script_exec_t:dir search_dir_perms;
933 allow smbd_t samba_unconfined_script_exec_t:file ioctl;
935 unconfined_domain(samba_unconfined_script_t)
937 tunable_policy(`samba_run_unconfined',`
938 domtrans_pattern(smbd_t, samba_unconfined_script_exec_t, samba_unconfined_script_t)