From: Stefan Schulze Frielinghaus <stefan@seekline.net>
To: Daniel J Walsh <dwalsh@redhat.com>
Cc: SE Linux <selinux@tycho.nsa.gov>, cpebenito@tresys.com
Subject: Re: [refpolicy] samba
Date: Mon, 04 Feb 2008 16:05:22 +0100 [thread overview]
Message-ID: <1202137522.2667.5.camel@vogon> (raw)
In-Reply-To: <47A71B22.90506@redhat.com>
[-- Attachment #1: Type: text/plain, Size: 774 bytes --]
On Mon, 2008-02-04 at 09:03 -0500, Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Stefan Schulze Frielinghaus wrote:
> > On Debian machines smbd needs append rights for samba logfiles.
> >
> In Fedora smbd_t needs manage_files_pattern on smbd_log_t. Our samba
> developers informed me that this is ok, since these are not security
> relevent log files.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkenGyIACgkQrlYvE4MpobMFSgCcCAOhKW0zrOmRyf/6zifGOBj0
> IGcAoJ4dsNctCyp4k7LdaLbu468xbiK4
> =iw9h
> -----END PGP SIGNATURE-----
OK than we can easily substitute create_files_pattern with
manage_files_pattern. Attached patch should do that.
[-- Attachment #2: samba.te.patch --]
[-- Type: text/x-patch, Size: 503 bytes --]
--- /usr/src/refpolicy-20071214/policy/modules/services/samba.te 2007-12-14 15:23:18.000000000 +0100
+++ policy/modules/services/samba.te 2008-02-04 15:59:56.000000000 +0100
@@ -222,7 +222,7 @@
allow smbd_t samba_etc_t:file { rw_file_perms setattr };
create_dirs_pattern(smbd_t,samba_log_t,samba_log_t)
-create_files_pattern(smbd_t,samba_log_t,samba_log_t)
+manage_files_pattern(smbd_t,samba_log_t,samba_log_t)
allow smbd_t samba_log_t:dir setattr;
dontaudit smbd_t samba_log_t:dir remove_name;
next prev parent reply other threads:[~2008-02-04 15:06 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-02-03 9:07 [refpolicy] samba Stefan Schulze Frielinghaus
2008-02-04 14:03 ` Daniel J Walsh
2008-02-04 15:05 ` Stefan Schulze Frielinghaus [this message]
2008-02-19 19:22 ` Christopher J. PeBenito
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1202137522.2667.5.camel@vogon \
--to=stefan@seekline.net \
--cc=cpebenito@tresys.com \
--cc=dwalsh@redhat.com \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.