Christopher J. PeBenito wrote:
On Mon, 2008-07-14 at 16:31 -0400, Mike Edenfield wrote:
+tunable_policy(`samba_create_home_dirs',`
+ unprivuser_home_filetrans_home_dir(smbd_t)
+ unprivuser_manage_home_dirs(smbd_t)
I think we want this to be unprivuser_create_home_dirs(), which would
need to be added.
That was my first instinct but I didn't see one already present, so I
just copied what I found for oddjob_mkhomedir.
I'll define a new interface for this -- I assume that's probably a
separate patch? And I should convert the sysadm role and oddjob type to
use the interface?
@@ -404,7 +419,7 @@
read_files_pattern(nmbd_t,samba_etc_t,samba_etc_t)
manage_dirs_pattern(nmbd_t,samba_log_t,samba_log_t)
-append_files_pattern(nmbd_t,samba_log_t,samba_log_t)
+manage_files_pattern(nmbd_t,samba_log_t,samba_log_t)
allow nmbd_t samba_log_t:file unlink;
read_files_pattern(nmbd_t,samba_log_t,samba_log_t)
If the goal is just to add a rename permission onto nmbd, then that
permission should be added explicitly. Manage will allow it to delete
the log, which we don't want, if we don't have to.
Actually, I missed a line when I was reapplying my patches to do svn
diffs; the nmbd_t type already has unlink permissions for the type, just
not rename, so it seemed that manage_files was the correct thing -- it
should let me get rid of the next line as well.
New patch coming in a bit.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
