1From 7c58f2508efc115dea03e18e1fa611ebf81f6ee6 Mon Sep 17 00:00:00 2001
2From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
3Date: Wed, 4 Aug 2021 11:12:01 +0200
4Subject: [PATCH] policy/modules/services/samba.te: make crack optional
5
6Make crack optional to avoid the following build failure:
7
8 Compiling targeted policy.31
9 env LD_LIBRARY_PATH="/tmp/instance-5/output-1/host/lib:/tmp/instance-5/output-1/host/usr/lib" /tmp/instance-5/output-1/host/usr/bin/checkpolicy -c 31 -U deny -S -O -E policy.conf -o policy.31
10 policy/modules/services/samba.te:399:ERROR 'type crack_db_t is not within scope' at token ';' on line 360232:
11 	allow smbd_t crack_db_t:dir { getattr search open };
12 #line 399
13 checkpolicy:  error(s) encountered while parsing configuration
14
15Fixes:
16 - http://autobuild.buildroot.org/results/ab7098948d1920e42fa587e07f0513f23ba7fc74
17
18Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
19[Upstream status: https://github.com/SELinuxProject/refpolicy/pull/407]
20---
21 policy/modules/services/samba.te | 32 ++++++++++++++++++--------------
22 1 file changed, 18 insertions(+), 14 deletions(-)
23
24diff --git a/policy/modules/services/samba.te b/policy/modules/services/samba.te
25index 9d4665ae6..6c37625a9 100644
26--- a/policy/modules/services/samba.te
27+++ b/policy/modules/services/samba.te
28@@ -396,8 +396,6 @@ userdom_signal_all_users(smbd_t)
29 userdom_home_filetrans_user_home_dir(smbd_t)
30 userdom_user_home_dir_filetrans_user_home_content(smbd_t, { dir file lnk_file sock_file fifo_file })
31
32-usermanage_read_crack_db(smbd_t)
33-
34 ifdef(`hide_broken_symptoms',`
35 	files_dontaudit_getattr_default_dirs(smbd_t)
36 	files_dontaudit_getattr_boot_dirs(smbd_t)
37@@ -413,18 +411,6 @@ tunable_policy(`samba_create_home_dirs',`
38 	userdom_create_user_home_dirs(smbd_t)
39 ')
40
41-tunable_policy(`samba_domain_controller',`
42-	gen_require(`
43-		class passwd passwd;
44-	')
45-
46-	usermanage_domtrans_passwd(smbd_t)
47-	usermanage_kill_passwd(smbd_t)
48-	usermanage_domtrans_useradd(smbd_t)
49-	usermanage_domtrans_groupadd(smbd_t)
50-	allow smbd_t self:passwd passwd;
51-')
52-
53 tunable_policy(`samba_enable_home_dirs',`
54 	userdom_manage_user_home_content_dirs(smbd_t)
55 	userdom_manage_user_home_content_files(smbd_t)
56@@ -505,6 +491,24 @@ optional_policy(`
57 	seutil_sigchld_newrole(smbd_t)
58 ')
59
60+optional_policy(`
61+	usermanage_read_crack_db(smbd_t)
62+')
63+
64+optional_policy(`
65+	tunable_policy(`samba_domain_controller',`
66+		gen_require(`
67+			class passwd passwd;
68+		')
69+
70+		usermanage_domtrans_passwd(smbd_t)
71+		usermanage_kill_passwd(smbd_t)
72+		usermanage_domtrans_useradd(smbd_t)
73+		usermanage_domtrans_groupadd(smbd_t)
74+		allow smbd_t self:passwd passwd;
75+	')
76+')
77+
78 ########################################
79 #
80 # Nmbd Local policy
81--
822.30.2
83
84