Re: refpolicy patch: samba enhancements

[Mike Edenfield <kutulu@kutulu.org>]

Christopher J. PeBenito wrote:
> On Mon, 2008-07-14 at 16:31 -0400, Mike Edenfield wrote:

>> +tunable_policy(`samba_create_home_dirs',`
>> +    unprivuser_home_filetrans_home_dir(smbd_t)
>> +    unprivuser_manage_home_dirs(smbd_t)
> 
> I think we want this to be unprivuser_create_home_dirs(), which would
> need to be added.

That was my first instinct but I didn't see one already present, so I 
just copied what I found for oddjob_mkhomedir.

I'll define a new interface for this -- I assume that's probably a 
separate patch?  And I should convert the sysadm role and oddjob type to 
use the interface?

>> @@ -404,7 +419,7 @@
>>   read_files_pattern(nmbd_t,samba_etc_t,samba_etc_t)
>>
>>   manage_dirs_pattern(nmbd_t,samba_log_t,samba_log_t)
>> -append_files_pattern(nmbd_t,samba_log_t,samba_log_t)
>> +manage_files_pattern(nmbd_t,samba_log_t,samba_log_t)
>>   allow nmbd_t samba_log_t:file unlink;
>>
>>   read_files_pattern(nmbd_t,samba_log_t,samba_log_t)
> 
> If the goal is just to add a rename permission onto nmbd, then that
> permission should be added explicitly.  Manage will allow it to delete
> the log, which we don't want, if we don't have to.

Actually, I missed a line when I was reapplying my patches to do svn 
diffs; the nmbd_t type already has unlink permissions for the type, just 
not rename, so it seemed that manage_files was the correct thing -- it 
should let me get rid of the next line as well.

New patch coming in a bit.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.