winbind needs to be able to talk to ldap directly, not through sssd

diff --git a/policy/modules/services/samba.te b/policy/modules/services/samba.te
index d893f9928f5ff673cc6ca96bb5e77ca7918c9907..bac0112b41593f479b90a2f98302d1f500aa5cdc 100644 (file)
--- a/policy/modules/services/samba.te
+++ b/policy/modules/services/samba.te
@@ -875,10 +875,14 @@ domain_use_interactive_fds(winbind_t)
 
 files_read_etc_files(winbind_t)
 files_read_usr_symlinks(winbind_t)
+files_list_var_lib(winbind_t)
 
 logging_send_syslog_msg(winbind_t)
 
 miscfiles_read_localization(winbind_t)
+miscfiles_read_generic_certs(winbind_t)
+
+sysnet_use_ldap(winbind_t)
 
 userdom_dontaudit_use_unpriv_user_fds(winbind_t)
 userdom_manage_user_home_content_dirs(winbind_t)